2f707b2e3a4a55233830597e4fc872902b9fed4e671ea05878c1ec0c8965c2a7

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe
Size

794KB
MD5

bf1a01683158943d42226c41051e08a0
SHA1

2800f728cec33be833fbb8762bff4323d28661cf
SHA256

2f707b2e3a4a55233830597e4fc872902b9fed4e671ea05878c1ec0c8965c2a7
SHA512

c56662b4b298f1018026c09bc002cea7a958560cdc551857415ceec322b728f63f2d71f4ede6f28b08c0e308d4aabf42cb3568e8bc8adadd9dff85feb4528b61
SSDEEP

3072:LtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwMykw+imi5wxx4Vao2i1d3:Buj8NDF3OR9/Qe2HdJ8pS4ofWdii6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2524	Casino_ext.exe

Executes dropped EXE 64 IoCs

pid	Process
2300	casino_extensions.exe
2992	Casino_ext.exe
2688	casino_extensions.exe
2708	Casino_ext.exe
2604	casino_extensions.exe
2524	Casino_ext.exe
2616	casino_extensions.exe
2448	casino_extensions.exe
2596	Casino_ext.exe
2472	casino_extensions.exe
2436	casino_extensions.exe
2236	Casino_ext.exe
2892	casino_extensions.exe
2860	casino_extensions.exe
2864	Casino_ext.exe
1004	casino_extensions.exe
1208	casino_extensions.exe
1552	Casino_ext.exe
1560	casino_extensions.exe
2360	casino_extensions.exe
1796	casino_extensions.exe
920	LiveMessageCenter.exe
2492	casino_extensions.exe
2648	casino_extensions.exe
1276	Casino_ext.exe
1808	casino_extensions.exe
748	casino_extensions.exe
1932	Casino_ext.exe
2068	casino_extensions.exe
1268	casino_extensions.exe
2120	casino_extensions.exe
2104	LiveMessageCenter.exe
2220	casino_extensions.exe
2180	casino_extensions.exe
2364	Casino_ext.exe
2356	casino_extensions.exe
1496	casino_extensions.exe
1640	Casino_ext.exe
1316	casino_extensions.exe
832	casino_extensions.exe
1756	Casino_ext.exe
2000	casino_extensions.exe
1312	casino_extensions.exe
2044	Casino_ext.exe
2168	casino_extensions.exe
2804	casino_extensions.exe
2800	Casino_ext.exe
2792	casino_extensions.exe
3004	casino_extensions.exe
476	Casino_ext.exe
2980	casino_extensions.exe
1412	casino_extensions.exe
1152	Casino_ext.exe
1980	casino_extensions.exe
2320	casino_extensions.exe
936	Casino_ext.exe
1988	casino_extensions.exe
2112	casino_extensions.exe
944	Casino_ext.exe
1096	casino_extensions.exe
1332	casino_extensions.exe
1696	Casino_ext.exe
1864	casino_extensions.exe
1620	casino_extensions.exe

Loads dropped DLL 64 IoCs

pid	Process
2504	casino_extensions.exe
2504	casino_extensions.exe
2564	casino_extensions.exe
2564	casino_extensions.exe
2540	casino_extensions.exe
2540	casino_extensions.exe
2616	casino_extensions.exe
2616	casino_extensions.exe
2472	casino_extensions.exe
2472	casino_extensions.exe
2892	casino_extensions.exe
2892	casino_extensions.exe
1004	casino_extensions.exe
1004	casino_extensions.exe
1560	casino_extensions.exe
1560	casino_extensions.exe
1796	casino_extensions.exe
1796	casino_extensions.exe
2492	casino_extensions.exe
2492	casino_extensions.exe
1808	casino_extensions.exe
1808	casino_extensions.exe
2068	casino_extensions.exe
2068	casino_extensions.exe
2120	casino_extensions.exe
2120	casino_extensions.exe
2220	casino_extensions.exe
2220	casino_extensions.exe
2356	casino_extensions.exe
2356	casino_extensions.exe
1316	casino_extensions.exe
1316	casino_extensions.exe
2000	casino_extensions.exe
2000	casino_extensions.exe
2168	casino_extensions.exe
2168	casino_extensions.exe
2792	casino_extensions.exe
2792	casino_extensions.exe
2980	casino_extensions.exe
2980	casino_extensions.exe
1980	casino_extensions.exe
1980	casino_extensions.exe
1988	casino_extensions.exe
1988	casino_extensions.exe
1096	casino_extensions.exe
1096	casino_extensions.exe
1864	casino_extensions.exe
1864	casino_extensions.exe
1500	casino_extensions.exe
1500	casino_extensions.exe
2984	casino_extensions.exe
2984	casino_extensions.exe
948	casino_extensions.exe
948	casino_extensions.exe
1676	casino_extensions.exe
1676	casino_extensions.exe
2256	casino_extensions.exe
2256	casino_extensions.exe
2192	casino_extensions.exe
2192	casino_extensions.exe
2088	casino_extensions.exe
2088	casino_extensions.exe
836	casino_extensions.exe
836	casino_extensions.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	Casino_ext.exe
2708	Casino_ext.exe
2524	Casino_ext.exe
2596	Casino_ext.exe
2236	Casino_ext.exe
2864	Casino_ext.exe
1552	Casino_ext.exe
920	LiveMessageCenter.exe
1276	Casino_ext.exe
1932	Casino_ext.exe
2104	LiveMessageCenter.exe
2364	Casino_ext.exe
1640	Casino_ext.exe
1756	Casino_ext.exe
2044	Casino_ext.exe
2800	Casino_ext.exe
476	Casino_ext.exe
1152	Casino_ext.exe
936	Casino_ext.exe
944	Casino_ext.exe
1696	Casino_ext.exe
1916	Casino_ext.exe
1852	Casino_ext.exe
616	Casino_ext.exe
2924	Casino_ext.exe
1148	Casino_ext.exe
1008	Casino_ext.exe
2880	Casino_ext.exe
1964	Casino_ext.exe
2296	Casino_ext.exe
2316	Casino_ext.exe
1748	Casino_ext.exe
2508	Casino_ext.exe
2504	Casino_ext.exe
2452	Casino_ext.exe
2604	Casino_ext.exe
2588	Casino_ext.exe
2488	Casino_ext.exe
3044	Casino_ext.exe
2844	Casino_ext.exe
800	Casino_ext.exe
860	Casino_ext.exe
1252	Casino_ext.exe
1628	Casino_ext.exe
2264	Casino_ext.exe
1032	Casino_ext.exe
2628	Casino_ext.exe
644	Casino_ext.exe
756	Casino_ext.exe
1808	Casino_ext.exe
2644	Casino_ext.exe
2120	Casino_ext.exe
1532	Casino_ext.exe
2064	Casino_ext.exe
1456	Casino_ext.exe
1484	Casino_ext.exe
2832	Casino_ext.exe
2044	Casino_ext.exe
2968	Casino_ext.exe
2804	Casino_ext.exe
1152	Casino_ext.exe
824	Casino_ext.exe
944	Casino_ext.exe
2240	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1308	bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2504	1308	bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe	28
PID 1308 wrote to memory of 2504	1308	bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe	28
PID 1308 wrote to memory of 2504	1308	bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe	28
PID 1308 wrote to memory of 2504	1308	bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe	28
PID 2504 wrote to memory of 2300	2504	casino_extensions.exe	29
PID 2504 wrote to memory of 2300	2504	casino_extensions.exe	29
PID 2504 wrote to memory of 2300	2504	casino_extensions.exe	29
PID 2504 wrote to memory of 2300	2504	casino_extensions.exe	29
PID 2300 wrote to memory of 2992	2300	casino_extensions.exe	30
PID 2300 wrote to memory of 2992	2300	casino_extensions.exe	30
PID 2300 wrote to memory of 2992	2300	casino_extensions.exe	30
PID 2300 wrote to memory of 2992	2300	casino_extensions.exe	30
PID 2992 wrote to memory of 2564	2992	Casino_ext.exe	31
PID 2992 wrote to memory of 2564	2992	Casino_ext.exe	31
PID 2992 wrote to memory of 2564	2992	Casino_ext.exe	31
PID 2992 wrote to memory of 2564	2992	Casino_ext.exe	31
PID 2564 wrote to memory of 2688	2564	casino_extensions.exe	32
PID 2564 wrote to memory of 2688	2564	casino_extensions.exe	32
PID 2564 wrote to memory of 2688	2564	casino_extensions.exe	32
PID 2564 wrote to memory of 2688	2564	casino_extensions.exe	32
PID 2688 wrote to memory of 2708	2688	casino_extensions.exe	33
PID 2688 wrote to memory of 2708	2688	casino_extensions.exe	33
PID 2688 wrote to memory of 2708	2688	casino_extensions.exe	33
PID 2688 wrote to memory of 2708	2688	casino_extensions.exe	33
PID 2708 wrote to memory of 2540	2708	Casino_ext.exe	34
PID 2708 wrote to memory of 2540	2708	Casino_ext.exe	34
PID 2708 wrote to memory of 2540	2708	Casino_ext.exe	34
PID 2708 wrote to memory of 2540	2708	Casino_ext.exe	34
PID 2540 wrote to memory of 2604	2540	casino_extensions.exe	35
PID 2540 wrote to memory of 2604	2540	casino_extensions.exe	35
PID 2540 wrote to memory of 2604	2540	casino_extensions.exe	35
PID 2540 wrote to memory of 2604	2540	casino_extensions.exe	35
PID 2604 wrote to memory of 2524	2604	casino_extensions.exe	36
PID 2604 wrote to memory of 2524	2604	casino_extensions.exe	36
PID 2604 wrote to memory of 2524	2604	casino_extensions.exe	36
PID 2604 wrote to memory of 2524	2604	casino_extensions.exe	36
PID 2524 wrote to memory of 2616	2524	Casino_ext.exe	37
PID 2524 wrote to memory of 2616	2524	Casino_ext.exe	37
PID 2524 wrote to memory of 2616	2524	Casino_ext.exe	37
PID 2524 wrote to memory of 2616	2524	Casino_ext.exe	37
PID 2616 wrote to memory of 2448	2616	casino_extensions.exe	38
PID 2616 wrote to memory of 2448	2616	casino_extensions.exe	38
PID 2616 wrote to memory of 2448	2616	casino_extensions.exe	38
PID 2616 wrote to memory of 2448	2616	casino_extensions.exe	38
PID 2448 wrote to memory of 2596	2448	casino_extensions.exe	39
PID 2448 wrote to memory of 2596	2448	casino_extensions.exe	39
PID 2448 wrote to memory of 2596	2448	casino_extensions.exe	39
PID 2448 wrote to memory of 2596	2448	casino_extensions.exe	39
PID 2596 wrote to memory of 2472	2596	Casino_ext.exe	40
PID 2596 wrote to memory of 2472	2596	Casino_ext.exe	40
PID 2596 wrote to memory of 2472	2596	Casino_ext.exe	40
PID 2596 wrote to memory of 2472	2596	Casino_ext.exe	40
PID 2472 wrote to memory of 2436	2472	casino_extensions.exe	41
PID 2472 wrote to memory of 2436	2472	casino_extensions.exe	41
PID 2472 wrote to memory of 2436	2472	casino_extensions.exe	41
PID 2472 wrote to memory of 2436	2472	casino_extensions.exe	41
PID 2436 wrote to memory of 2236	2436	casino_extensions.exe	42
PID 2436 wrote to memory of 2236	2436	casino_extensions.exe	42
PID 2436 wrote to memory of 2236	2436	casino_extensions.exe	42
PID 2436 wrote to memory of 2236	2436	casino_extensions.exe	42
PID 2236 wrote to memory of 2892	2236	Casino_ext.exe	43
PID 2236 wrote to memory of 2892	2236	Casino_ext.exe	43
PID 2236 wrote to memory of 2892	2236	Casino_ext.exe	43
PID 2236 wrote to memory of 2892	2236	Casino_ext.exe	43

C:\Users\Admin\AppData\Local\Temp\bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bf1a01683158943d42226c41051e08a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        10⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        13⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2892
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        18⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        21⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1208
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        24⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:920
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2492
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        28⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1276
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        31⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:748
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1932
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2068
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        34⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1268
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        35⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2120
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        36⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2104
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        37⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2220
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        38⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        39⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2364
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        41⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        42⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1640
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        43⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1316
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        44⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:832
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        45⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        47⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        48⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2044
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        49⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        50⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        51⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2800
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2792
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        53⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3004
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        54⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:476
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        55⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        56⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1412
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        57⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1152
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        58⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        59⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        60⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:936
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        61⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        62⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        63⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:944
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        64⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1096
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        65⤵
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        66⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1696
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        67⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1864
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        68⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        69⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1916
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        70⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        71⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        72⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1852
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        73⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        74⤵
        Drops file in Program Files directory
        
        PID:1664
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        75⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:616
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        76⤵
        Loads dropped DLL
        
        PID:948
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        77⤵
        Drops file in Program Files directory
        
        PID:712
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        78⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2924
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        79⤵
        Loads dropped DLL
        
        PID:1676
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        80⤵
        Drops file in Program Files directory
        
        PID:2948
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        81⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1148
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        82⤵
        Loads dropped DLL
        
        PID:2256
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        83⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        84⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1008
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        85⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        86⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        87⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        88⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2088
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        89⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        90⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1964
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        91⤵
        Loads dropped DLL
        
        PID:836
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        92⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        93⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        94⤵
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        95⤵
        Drops file in Program Files directory
        
        PID:1516
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        96⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2316
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        97⤵
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        98⤵
        Drops file in Program Files directory
        
        PID:2916
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        99⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1748
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        100⤵
        Drops file in System32 directory
        
        PID:1760
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        101⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        102⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2508
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        103⤵
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        104⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        105⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        106⤵
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        107⤵
        Drops file in Program Files directory
        
        PID:2688
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        108⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2452
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        109⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        110⤵
        Drops file in Program Files directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        111⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        112⤵
        Drops file in System32 directory
        
        PID:2524
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        113⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        114⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2588
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        115⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        116⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        117⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2488
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        118⤵
        Drops file in System32 directory
        
        PID:2500
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        119⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        120⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        121⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        122⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        123⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2844
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        124⤵
        Drops file in System32 directory
        
        PID:564
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        125⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        126⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:800
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        127⤵
        Drops file in System32 directory
        
        PID:2892
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        128⤵
        Drops file in Program Files directory
        
        PID:752
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        129⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:860
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        130⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        131⤵
        Drops file in Program Files directory
        
        PID:1128
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        132⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1252
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        133⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        134⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        135⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        136⤵
        Drops file in System32 directory
        
        PID:588
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        137⤵
        Drops file in Program Files directory
        
        PID:1680
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        138⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2264
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        139⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        140⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        141⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1032
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        142⤵
        Drops file in System32 directory
        
        PID:1324
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        143⤵
        Drops file in Program Files directory
        
        PID:2248
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        144⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2628
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        145⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        146⤵
        Drops file in Program Files directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        147⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:644
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        148⤵
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        149⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        150⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        151⤵
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        152⤵
        Drops file in Program Files directory
        
        PID:2384
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        153⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1808
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        154⤵
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        155⤵
        Drops file in Program Files directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        156⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2644
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        157⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        158⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        159⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2120
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        160⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        161⤵
        Drops file in Program Files directory
        
        PID:2008
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        162⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        163⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        164⤵
        Drops file in Program Files directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        165⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        166⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        167⤵
        Drops file in Program Files directory
        
        PID:1724
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        168⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        169⤵
        Drops file in System32 directory
        
        PID:1460
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        170⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        171⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1484
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        172⤵
        Drops file in System32 directory
        
        PID:2520
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        173⤵
        Drops file in Program Files directory
        
        PID:2464
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        174⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        175⤵
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        176⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        177⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2044
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        178⤵
        Drops file in System32 directory
        
        PID:1196
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        179⤵
        Drops file in Program Files directory
        
        PID:3032
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        180⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2968
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        181⤵
        Drops file in System32 directory
        
        PID:2148
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        182⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        183⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2804
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        184⤵
        Drops file in System32 directory
        
        PID:2800
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        185⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        186⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1152
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        187⤵
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        188⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        189⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:824
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        190⤵
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        191⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        192⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:944
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        193⤵
        
        PID:772
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        194⤵
        Drops file in Program Files directory
        
        PID:1376
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        195⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2240
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        196⤵
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        197⤵
        Drops file in Program Files directory
        
        PID:1304
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        198⤵
        
        PID:1332
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        199⤵
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        200⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        201⤵
        
        PID:1864
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        202⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        203⤵
        Drops file in Program Files directory
        
        PID:1776
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        204⤵
        Drops file in Program Files directory
        
        PID:1648
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        205⤵
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        206⤵
        Drops file in Program Files directory
        
        PID:892
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        207⤵
        Drops file in Program Files directory
        
        PID:1636
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        208⤵
        Drops file in System32 directory
        
        PID:1828
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        209⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        210⤵
        
        PID:1852
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        211⤵
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        212⤵
        Drops file in Program Files directory
        
        PID:1164
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        213⤵
        Drops file in Program Files directory
        
        PID:964
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        214⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        215⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        216⤵
        
        PID:2840
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        217⤵
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        218⤵
        
        PID:2948
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        219⤵
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c $$2028~1.BAT
        220⤵
        
        PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
833KB

MD5
3ae80b7b4169e9625db5107c0d62187a

SHA1
40df7a5512bf8a6cd02245ee67b1bc7df1910c5b

SHA256
3c0db5084c625a3325634a8b6cb3a7df6c93d603011dd524f16cdb5f8e4762dc

SHA512
3856d144e07d0d5422fa3c7aea3fdb193a0bf4d18406d4721d22bd7a54e892482733fbe2bdc23a56016b04c7cd0444b5499f7af69198110dd656099965fec17e

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
841KB

MD5
6de364dbb69d2384b412f365617b965e

SHA1
e8b04a3ee0456f0fb9cc1560316db0ab2f42ff50

SHA256
55835516f3c14592a760134b07b097f4033197e07b218465a520ae8be1a355ab

SHA512
1eecb0505c5879dd288df78ea56ddc38220d85eb66a63a6c7e0529a73759cbf5787c4932148fad791341f952c1429b665f272dab39a429a312439ab5a170f86b

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
865KB

MD5
92f813c78f91ab11cde33bf3cb1db69f

SHA1
389d0afce2ccd02aef6d0b62891aadb2994ffca5

SHA256
16a089ea2cce6295a5fbda40a12c4a0d01cebb25884b56bfcc87c944a3209c0b

SHA512
6470cfc115f9602e53a15ec65ca565298d42e5d24d7889120a0a61a9f58c788fff0be2aae5d940a16add0891f14cf2abc4d26fdd7a017c7a7af887394f9d6b31

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
864KB

MD5
d20551627fbc57c84956aeeacf272f66

SHA1
e6e2cbd03ff03f6db24deb19c6dfa2982ca7d0bf

SHA256
e65662d6f52cd84512fcb060708782b080eff04d461d885e00ed5d77f9fb656e

SHA512
f886e5da9171e5a95de4a137f0315481869856995bff451fef6245643d132bf5b17734558d7233eb201346a99a56a0b992a265648aa11a6e8d077e099c7bd147

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
814KB

MD5
80da868172ee1a749d73efd0a85259d9

SHA1
26be23b700ed9f6961e610e6ee31f0ec689c7279

SHA256
63591279c0470176f6942328e670ab9d235a80c9c6375a15c68c665f05299065

SHA512
5136fba5c8de079812d643d804d441c7334587f85df3a866fee612f9ce1512e99c83c25ebb990fdcf8617824287424622847b53eeac26201faaf52d339244c85

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
879KB

MD5
853b2c2239535619c847870f08dd9916

SHA1
03c8ad3de77158b429a314276a54a925bff378fd

SHA256
dff54828ee8584ff048afb51ed02ab1977d95f6ef023615bd32cf11f919a689c

SHA512
afc3d9c727a96234526795fc392b7bf05e21e6153c5e7dbacf8c2250b3458062e3f96f83de65233f8f32fab411394d273c6a24931490af957526d72192480b58

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
840KB

MD5
1a0967539a32982fbfd98200eee27c94

SHA1
9396561eb7b6442224a20e607abedd102751661e

SHA256
de9d9e380ebe95b3ba55b54e5728789b9e995fd62bb881faf20dfeb4f1dcb6bc

SHA512
780c48e8ae34d3cb6db4c7b50a639dcede8924f389a407c824c13105f237db1122514907bda1e88bb135b767836e1533ab256ceca1d7f78cda6fc40d0b6a6ffe

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
897KB

MD5
f589b4fe6f4cd4c32228b0c2a7a52152

SHA1
b3ae5ee51a23167e7c693445aa1dbf336f408f2b

SHA256
317a695de5a81f383d0312bfbdc00c96ed27fb98f13b54caa41edc445205c7f5

SHA512
a51f527e17d07f757675fba2acf5ce34460dd11485926bf1e104f84b9a280004624783c4dcc4724a1d8c7198dbb9d423956ed16d8e0e67fc727244adfe306468

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
847KB

MD5
cefdc63b5a63767ce07403ce08ae805d

SHA1
3a0801a78164da89941d60ea6b6b82f71dfe3762

SHA256
3cc586196359a96bee9c1e6d1111b4708e746b3f8451e0e4d09860668a0f70db

SHA512
5acb35e89f1123dd11ad234a05b7c9b7528bfab7834b5152ea2c40ccf72562ca870c73e72668cc87e3c7e6ba322f43922e53939aa7ed64c5180360ea8a2fe914

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
810KB

MD5
9a6d246ed487f89d8766f9f28115be15

SHA1
8798a48689d0f0c617deafcf837b83cfd91b840f

SHA256
7e2a12ba3162e45cbdc7dd142c0b2d7da057968c3441f0a0671e84927f81a6dc

SHA512
462214ed0a28d762f6b6251aa8bed065285dd0b07d5959e72478fcba50b31ffddfafb0d21ca770ea7bf548c97a34b0f9979b352d08c4cb61f31d45b50ce2b5b7

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
874KB

MD5
e6a9c2012b6180570d13d87139391100

SHA1
b3a8bb13ab222929d0ef8318ad93049396e06a27

SHA256
b1581469833e8505ea342390aa5c4ae3f748450573ece27d4f0babcbd5fa2319

SHA512
1795d30209644fadbb3933410258ebdc5adce0888afe06fcd9143167551504547e08e5921d65f18fc38711eedf691f2fbfc81c3d1ca2f354d7f01b3334fcbc0a

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
817KB

MD5
29b887c1049621b35f10e999f923b762

SHA1
c6da8ea6044e1b4fbaba94677258692f12fe85b3

SHA256
611273000c51521d3bf22c3fb5d8a2d5a79ddeeaf145bfe8404599104e498c73

SHA512
6bca780bfbfa32852ff4dc4caa7a5f4d7c6d892f9063f3286c349dfb1e7360c35b93821963a724e08200a28c14471288acd0d18f1f845b3e9a88b79bb83d6b37

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
869KB

MD5
a1567c05270d793b88531e026309a61e

SHA1
6d63811fa9d6d32218e2100d6bec5aa4645ff6b5

SHA256
7ff74648327a351e699ff4989036c6a0860ded8241b606597bee3780a28aaf53

SHA512
ea299c2a31ccd4a5c4df7a27aae4ddd4921570d479a1f7ed99f808bb358531ac94503566cb3046bb0b41b2d47118c311ab531ffba7bc82a97ea77fb1b7531600

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
827KB

MD5
372922cdd404356096824fcdb0c18784

SHA1
9f44dbc68de01002981777e630ca5596b97c4da5

SHA256
7efba3d01a4219dad624a3a3d5d455b7ac200f35ee7a235bf0b8ba0133cdd61c

SHA512
76a464fe2ac7bcffa95dbdf0aa6d2ed2d2e2e62700749de0af3b81cecc8b03e77dbf1d59487e052b6a36f34bfa95cd4f91dd44d5915530f3bf466a95e391bd02

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
881KB

MD5
e80639a27285062f7d8721ed72384da7

SHA1
53443d40ebdde464d0602b705d413b4740bebb63

SHA256
05fd1e2a7e0e941aa0466e89147aaff596463bedf3183109681033b773b4f85a

SHA512
987a2e2fc125004f5e67dac19a4b7c88dc20d1d0a5d51f30f93e2e4ee70a6eee253ea22387eb4d01190253b472856715ffa80771e7220e36993192e4ee2fb359

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
857KB

MD5
7b681c74ea296e4cfbf85b0c266f4442

SHA1
26dd852b17394fd117e8abc1b3c2e22317caeca0

SHA256
ad8d4d617e3380559d7f5825cf146f0caf0c9b2abe228bde2a704e06bec7b7c6

SHA512
b8600dfa78de56f97d7c3cf38628621b15adcc93aac0c9da7d8cb6b27ff02a92b172c6f23726885cd4e111199e5bfd9d096e33358ce9df5cf99c7cfbb2feec08

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
850KB

MD5
bc898109d9ce16bbcc2f3e8fed319f8e

SHA1
64de07a1772b893c7556fb2afaa65ed460c3d906

SHA256
ab41e6c4fa833e8039b0d6e2eef428d19aca5882414c4c23c99e9fd2917b774c

SHA512
60c256cefcd5e7b40a627262fe08f73201b4c3f2be45dae02e2fa74d2ae0c8bf078f8f1c28470e00d638e834eee025a2e006f34fc73272b099d558177c6d4c0f

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
877KB

MD5
18fa13b6cc8a53b99aa1fb8cafebade3

SHA1
cb4adac5db7128b15883a3fadff30aac439707e4

SHA256
0f41d4c104ca186aa70c275d4113edd0745a952a1437ddebc8273dc1ed5c3f0a

SHA512
1edef1853f28aa3b6a25b7aff40ba826673177d621afc6bc7e81d8a63b36b4a92904ae0139fa2a17fce48fc912f870e37d030ccb8595fd4800bae592a42945f2

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
884KB

MD5
c07d0fee0f7f5539491294b14105be46

SHA1
02a6b074a61fd62f600be785a18ef1d214056548

SHA256
c5bc8e4242d659b8a148d18a3c932d7fdc77ff3c9d16fd99dd1d35f66217b633

SHA512
f51ef11be1734e54c7099d824fd997f52d6a570f1cb2abe69e0869a0c252254ea62fe9ee8e1be97e616b6a68e5c420c83f3fde37942a12944a61f0bca42d2de2

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
896KB

MD5
35cff4757f2bf668089ec59f973911a8

SHA1
ee687bc96c714c9aebd50eb9dd87c37dd2c6d496

SHA256
f8ef351407cd787e881b6077dd054c4db66cc8b089eb609b7627037c9729e027

SHA512
3129938311edd0a979846c47012ef615e43b3d3f570c7dd738930771f5e8f94c8e18485481a0b7055d88d7abac772306b92c87808bd07f4db04c610b8cbf9442

Download Submit
\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
820KB

MD5
90e3e7f53d523aa307e1095fc3c8090b

SHA1
5eec9d4bc783a0b0b6791e455b7bb7fc5cb8b680

SHA256
c8c2945b36ad3cbe90c1f351df9eb94e45ece2af3bd10e9cc831f40dc155ee1d

SHA512
4c6146ee1dfb1e66bd18470e701ad4da4bb20415b7028871f4dfca44491979aa398a00fa2cb944cb9c6d86a4964e98d55ce108432903e43976f1eca266fe640f

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
812KB

MD5
5c0418e313ad800ac1516a5ead19b2fa

SHA1
caff5c400654c088da346e324bb6c9b5f5fd4b84

SHA256
c6b514b4fdfe1aecd39f974192887a65e16503d886ced18248034253d537b318

SHA512
2ef84ad0190619d6d848f4c52b260900d54c70d866f358dd4e1f41b1db632b7c40095531abf7b45edbb2741a0779505f42e8dafbf997c3e11fa305ed71f235fc

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
800KB

MD5
2d7c710ea25b498c0d122ffee5713afe

SHA1
b65c8fa19b8fbda22265ce9459d9ce125565ff12

SHA256
7753687e0e948ac46f14a1a257acb3da041c51a36fff90ad5e45723ae7ac5572

SHA512
a473c6674a7fac4779ebc044bf49f6721b39ac733336f37b3f8d6465f490e20552858b1de9c821553a7e8981eaa87cee6d33ac0272749bb9ab9b01d27f3275e7

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
816KB

MD5
292d57a5efe9dc7286cd92364aaef767

SHA1
914ec93e1dc086fe7783620313cb1db65f38d836

SHA256
c985dcf278d1c764689e4f17cac817ebdf6cba39d844353c0c7d5f31b5ee116d

SHA512
2e7c5a14b1d6d350286420acca644b66d7ea802f791537521becc461ed4d06d9460fd0bd2946a021856e8b73dbc624058a97c4c59f8582437f908bc74421aab9

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
809KB

MD5
82b38e5bdfd93c9c6011c06435ca4684

SHA1
d0b7cce3e62cbee2f7bbf7c2f7419c4b0f7a0744

SHA256
d6047d2a66575df4c3b7044c0318cf7b03eec48664a3b71061d0a8050cb272d9

SHA512
f1dbb6a960ead37ad6449c5de3065151479c857499028052b7f7fb08d2e3d1d3674bcd87976c3e01412abac3c031a1e5a97ba5a8c6f3a197684a10fd2a7644f8

Download Submit
memory/476-143-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/644-256-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/752-228-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/800-227-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/832-125-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/936-153-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/944-154-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/948-294-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/964-295-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-182-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1152-286-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1152-144-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1208-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1252-237-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1308-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1332-155-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1456-264-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1484-265-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1488-165-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1552-85-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1640-126-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-163-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1728-236-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1916-164-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1932-115-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-192-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1984-245-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2044-135-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2044-274-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2072-285-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2180-116-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2236-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2244-191-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2264-246-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2300-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2316-201-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2320-145-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2364-124-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2372-254-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2420-218-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-35-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2464-266-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2492-255-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2508-210-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2524-36-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2588-219-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-92-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2804-284-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2804-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2864-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2884-183-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2916-200-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2924-174-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2932-209-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2948-173-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2968-276-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2988-275-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download