47bc15b221a193ce995f1cee01ec44948d28480cbca32a9e66bd3bbf9dc79e5d

Resubmissions

30/12/2022, 00:20

221230-am6t1see59 8

29/12/2022, 23:59

221229-31shrsee28 8

29/12/2022, 21:37

221229-1gmgashe3w 8

29/12/2022, 18:49

221229-xgm62sha6w 8

Analysis

max time kernel
77s
max time network
259s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bol_setup.exe
Size

1.3MB
MD5

8303cfa6502fd0c42eff4133bc1938e4
SHA1

6cdbd45bb72b1524113bba8e613b21682b4af497
SHA256

47bc15b221a193ce995f1cee01ec44948d28480cbca32a9e66bd3bbf9dc79e5d
SHA512

a4c58e5e50a4ba5427267e54cd3a30df9c0d20db71c8b194e0d96827c27d0e7910e0bafefb231d9bf760910507a67812faa79ad4a359846bf8da8ab37e58bf2e
SSDEEP

24576:2CQjv/3EH3aLXerTO6uP7UJc9GA5bYUkDXZIxfqdPxw0pZHgbfeOqP:5aB6iJlxkzCJqdPxJwf+

Score

8^/10

bootkit discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1796	LauncherAssistant.exe
1384	GameClient.exe
1756	GameBrowser.exe
944	GameBrowser.exe
1128	GameBrowser.exe
1688	GameBrowser.exe
744	GameBrowser.exe
2060	GameBrowser.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-55-0x0000000000400000-0x0000000000698000-memory.dmp	upx
behavioral1/memory/1700-63-0x0000000000400000-0x0000000000698000-memory.dmp	upx
behavioral1/memory/1700-129-0x0000000000400000-0x0000000000698000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	GameBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	GameBrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	GameBrowser.exe

Loads dropped DLL 34 IoCs

pid	Process
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1384	GameClient.exe
1756	GameBrowser.exe
1756	GameBrowser.exe
944	GameBrowser.exe
944	GameBrowser.exe
1128	GameBrowser.exe
1128	GameBrowser.exe
1688	GameBrowser.exe
1688	GameBrowser.exe
944	GameBrowser.exe
944	GameBrowser.exe
944	GameBrowser.exe
744	GameBrowser.exe
2060	GameBrowser.exe
2060	GameBrowser.exe
744	GameBrowser.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GameClient.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BetOnline\BOL\gui\FilterBlockWindfallJackpotSlideContent.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Polar_Picnic_selected.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Blackjack_5_Hand.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Oasis_Poker_selected.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\cards\deck\fine_beige\face_7giant.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\progress_level_progress.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\cards\deck\fullcolor_gloss\suit_7giant.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\player_level_tooltip.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\ProfilesSlider.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\directory_treeView.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\LeftDownInfoPanel\Move\gui\ContentLeftDownInfoPanelPopupInfoPokerMove.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Move\gui\profiles\ProfilesSlider.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\cards\deck\move\preview_table_color_light_alt.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\BlackJack_SingleDeck.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\SafariSam.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\SugarPop.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonPoker\gameScripts\GamesDesign.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\bb_windfall_cell.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\bitmap_border_grayblack_graygrad.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\button_expand.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\GameBrowser64\locales\es.pak	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\LeftDownInfoPanel\Move\gui\profiles\images\Move_reportlist.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\cards\back\preview_table\CARDS_BACK_RED.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\Seat\Edge\main.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Edge\gui\profiles\ProfilesMenuBar.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\cards\deck\fullcolor_gloss\suit_1small.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Move\gui\ContentRaiseValueAndGameButtonsPanelMove.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Move\gui\profiles\images\Move_bg_jackpot_counter.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\Edge_icon_chat.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Kiss_of_Luck.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonPoker\gui\profiles\ProfilesBitmap.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\Cashier.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\PrizeHeaderCell.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\lobby\banner_cash_games_logo.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\audio\RandomPrizeTakeWait.ogg	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\text_label_buying_chips.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\SafariSam_selected.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\LeftDownInfoPanel\Move\gui\profiles\images\Move_icon_chat_message.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\TablesViewClassic.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\lobby\tf_cashier.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\combobox_dialogs.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Red_Temple.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\themes\theme_Edge.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\button_avatars.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\button_report_right.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\managed\datablocks.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gameScripts\Connection.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\notification_message_bitmap_background.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\profiles\images\Edge_button_popup_casino.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\game\Edge_table_red_pattern.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\RaiseValueAndGameButtonsPanel\Edge\gui\profiles\images\Move_button_game.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Edge\gui\jackpotControl.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\gui\EmptyDialogForTablesFilter.gui.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\Super_Sweets_selected.jpg	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\WitchCraft_selected.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_mods\Game\RaiseValueAndGameButtonsPanel\Edge\gui\profiles\ProfilesForModsGameRaiseValueAndGameButtonsPanelEdge.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Edge\gui\profiles\Profiles.cs.dso	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\casino\RooksRevenge_selected.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\common\gui\images\GG_Icon.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\gui\profiles\images\icon_attach_size4.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\BOL\data\images\lobby\wft_tsep.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\cards\back\02_red.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\commonTG\data\images\chips\chips_move.png	bol_setup.exe
File created	C:\Program Files (x86)\BetOnline\_theme_Move\gui\profiles\images\Move_bb_avatar_background.png	bol_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	GameClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\0	GameClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\0\DiskController	GameClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter\0\DiskController\0	GameClient.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	GameClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	GameClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\MultifunctionAdapter	GameClient.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	GameClient.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	GameClient.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	GameClient.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	GameClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\GameClient.exe = "11000"	GameClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	GameClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\GameClient.exe = "1"	GameClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	GameClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\GameClient.exe = "0"	GameClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	GameClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	GameClient.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C64BB769-24EF-CA4A-6970-1D0A35EB1053}	GameClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C64BB769-24EF-CA4A-6970-1D0A35EB1053}\{1A44A010-B3DA-23C0-490B-0F3739692031}	GameClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C64BB769-24EF-CA4A-6970-1D0A35EB1053}\{1A44A010-B3DA-23C0-490B-0F3739692031}\0A97B727D0E029943B01EBE3BBCD211DDC = "07A30FAF78906C44FCB98AFE046F19188D844BB28807A19485BC0C22F76229056A723255EFDAE10FBE849D1B4E64CAB7BA92652631645AE190FB8BB8A69C0F25DDD046F2D5C461778B049613E7826EED3550E4AD53AA7A644B19220AF03556B547"	GameClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA4F5CEC-BC42-4b64-8B18-EFFC62ADDA31}	GameClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA4F5CEC-BC42-4b64-8B18-EFFC62ADDA31}\SNPR1 = "MjAyMiAxMiAzMCAwMToxAA9jc9qENyBJg67gBmzImpcHW2l719n6a4xBL+3Uf0Bo8J5CygFUROpNt2wpvHWvNrc="	GameClient.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	bol_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	bol_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	bol_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	bol_setup.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1700	bol_setup.exe
1384	GameClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1976	AUDIODG.EXE
Token: 33	1976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1976	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1740	wmic.exe
Token: SeSecurityPrivilege	1740	wmic.exe
Token: SeTakeOwnershipPrivilege	1740	wmic.exe
Token: SeLoadDriverPrivilege	1740	wmic.exe
Token: SeSystemProfilePrivilege	1740	wmic.exe
Token: SeSystemtimePrivilege	1740	wmic.exe
Token: SeProfSingleProcessPrivilege	1740	wmic.exe
Token: SeIncBasePriorityPrivilege	1740	wmic.exe
Token: SeCreatePagefilePrivilege	1740	wmic.exe
Token: SeBackupPrivilege	1740	wmic.exe
Token: SeRestorePrivilege	1740	wmic.exe
Token: SeShutdownPrivilege	1740	wmic.exe
Token: SeDebugPrivilege	1740	wmic.exe
Token: SeSystemEnvironmentPrivilege	1740	wmic.exe
Token: SeRemoteShutdownPrivilege	1740	wmic.exe
Token: SeUndockPrivilege	1740	wmic.exe
Token: SeManageVolumePrivilege	1740	wmic.exe
Token: 33	1740	wmic.exe
Token: 34	1740	wmic.exe
Token: 35	1740	wmic.exe
Token: SeIncreaseQuotaPrivilege	1740	wmic.exe
Token: SeSecurityPrivilege	1740	wmic.exe
Token: SeTakeOwnershipPrivilege	1740	wmic.exe
Token: SeLoadDriverPrivilege	1740	wmic.exe
Token: SeSystemProfilePrivilege	1740	wmic.exe
Token: SeSystemtimePrivilege	1740	wmic.exe
Token: SeProfSingleProcessPrivilege	1740	wmic.exe
Token: SeIncBasePriorityPrivilege	1740	wmic.exe
Token: SeCreatePagefilePrivilege	1740	wmic.exe
Token: SeBackupPrivilege	1740	wmic.exe
Token: SeRestorePrivilege	1740	wmic.exe
Token: SeShutdownPrivilege	1740	wmic.exe
Token: SeDebugPrivilege	1740	wmic.exe
Token: SeSystemEnvironmentPrivilege	1740	wmic.exe
Token: SeRemoteShutdownPrivilege	1740	wmic.exe
Token: SeUndockPrivilege	1740	wmic.exe
Token: SeManageVolumePrivilege	1740	wmic.exe
Token: 33	1740	wmic.exe
Token: 34	1740	wmic.exe
Token: 35	1740	wmic.exe
Token: SeIncreaseQuotaPrivilege	2216	wmic.exe
Token: SeSecurityPrivilege	2216	wmic.exe
Token: SeTakeOwnershipPrivilege	2216	wmic.exe
Token: SeLoadDriverPrivilege	2216	wmic.exe
Token: SeSystemProfilePrivilege	2216	wmic.exe
Token: SeSystemtimePrivilege	2216	wmic.exe
Token: SeProfSingleProcessPrivilege	2216	wmic.exe
Token: SeIncBasePriorityPrivilege	2216	wmic.exe
Token: SeCreatePagefilePrivilege	2216	wmic.exe
Token: SeBackupPrivilege	2216	wmic.exe
Token: SeRestorePrivilege	2216	wmic.exe
Token: SeShutdownPrivilege	2216	wmic.exe
Token: SeDebugPrivilege	2216	wmic.exe
Token: SeSystemEnvironmentPrivilege	2216	wmic.exe
Token: SeRemoteShutdownPrivilege	2216	wmic.exe
Token: SeUndockPrivilege	2216	wmic.exe
Token: SeManageVolumePrivilege	2216	wmic.exe
Token: 33	2216	wmic.exe
Token: 34	2216	wmic.exe
Token: 35	2216	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1700	bol_setup.exe
1384	GameClient.exe
1756	GameBrowser.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1796	1700	bol_setup.exe	30
PID 1700 wrote to memory of 1384	1700	bol_setup.exe	32
PID 1700 wrote to memory of 1384	1700	bol_setup.exe	32
PID 1700 wrote to memory of 1384	1700	bol_setup.exe	32
PID 1700 wrote to memory of 1384	1700	bol_setup.exe	32
PID 1384 wrote to memory of 1756	1384	GameClient.exe	35
PID 1384 wrote to memory of 1756	1384	GameClient.exe	35
PID 1384 wrote to memory of 1756	1384	GameClient.exe	35
PID 1384 wrote to memory of 1756	1384	GameClient.exe	35
PID 1384 wrote to memory of 1740	1384	GameClient.exe	36
PID 1384 wrote to memory of 1740	1384	GameClient.exe	36
PID 1384 wrote to memory of 1740	1384	GameClient.exe	36
PID 1384 wrote to memory of 1740	1384	GameClient.exe	36
PID 1756 wrote to memory of 944	1756	GameBrowser.exe	38
PID 1756 wrote to memory of 944	1756	GameBrowser.exe	38
PID 1756 wrote to memory of 944	1756	GameBrowser.exe	38
PID 1756 wrote to memory of 1128	1756	GameBrowser.exe	39
PID 1756 wrote to memory of 1128	1756	GameBrowser.exe	39
PID 1756 wrote to memory of 1128	1756	GameBrowser.exe	39
PID 1756 wrote to memory of 1688	1756	GameBrowser.exe	40
PID 1756 wrote to memory of 1688	1756	GameBrowser.exe	40
PID 1756 wrote to memory of 1688	1756	GameBrowser.exe	40
PID 1756 wrote to memory of 744	1756	GameBrowser.exe	42
PID 1756 wrote to memory of 744	1756	GameBrowser.exe	42
PID 1756 wrote to memory of 744	1756	GameBrowser.exe	42
PID 1756 wrote to memory of 2060	1756	GameBrowser.exe	43
PID 1756 wrote to memory of 2060	1756	GameBrowser.exe	43
PID 1756 wrote to memory of 2060	1756	GameBrowser.exe	43
PID 1384 wrote to memory of 2216	1384	GameClient.exe	44
PID 1384 wrote to memory of 2216	1384	GameClient.exe	44
PID 1384 wrote to memory of 2216	1384	GameClient.exe	44
PID 1384 wrote to memory of 2216	1384	GameClient.exe	44

C:\Users\Admin\AppData\Local\Temp\bol_setup.exe
"C:\Users\Admin\AppData\Local\Temp\bol_setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe
  "C:\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe" 459040
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Program Files (x86)\BetOnline\GameClient.exe
  "C:\Program Files (x86)\BetOnline\GameClient.exe" -server https://poker.betonline.ag -appID "AppID_BetOnline_1685449045"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
    "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --main_proc=true --hwndgc=590110 --pipename=cg_browser_1672363043 --lop="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --appid="AppID_BetOnline_1685449045" --ln="BetOnline" --lp="C:\Program Files (x86)\BetOnline\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --mojo-platform-channel-handle=1032 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:944
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --mojo-platform-channel-handle=1404 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1128
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --mojo-platform-channel-handle=1468 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1688
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --first-renderer-process --no-sandbox --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1804 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:744
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --no-sandbox --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=1936 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:2060
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --mojo-platform-channel-handle=1292 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      PID:2312
  - - C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe
      "C:\Program Files (x86)\BetOnline\GameBrowser64\GameBrowser.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\LocalLow\GB\UDCache" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files (x86)\BetOnline\logs\20221230_011647.1384\\br.log" --mojo-platform-channel-handle=1112 --field-trial-handle=1108,i,14931827073389989718,10770512951839775352,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      PID:2392
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic computersystem get Manufacturer
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic computersystem get Model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://poker.betonline.ag/client-redirect?LANG=en&client=win32&faceId=bol&sid=8432e28785a546dd-bb0533c7bf58c038&to=deposit
    3⤵
    PID:2464
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:2
      4⤵
      PID:2516
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://poker.betonline.ag/client-redirect?LANG=en&client=win32&faceId=bol&sid=8432e28785a546dd-bb0533c7bf58c038&to=deposit
    3⤵
    PID:1936
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
      4⤵
      PID:2260
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://poker.betonline.ag/client-redirect?LANG=en&client=win32&faceId=bol&sid=8432e28785a546dd-bb0533c7bf58c038&to=profile
    3⤵
    PID:3016
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
      4⤵
      PID:3068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BetOnline\BOL\data\fonts\font.cs.dso

Filesize
353B

MD5
08a56dbd6a9689f71b79b99bb8b82d19

SHA1
9bf8c63ed1670ca3a4a8a80a679bc933dabed0b2

SHA256
eba28428cbc4629df99b0b083b7fafa6b5d3e8d47b5bcad4fbabfe3ac19ae48f

SHA512
3eb81ab691f5a961ef592e9e7df5c49ab456c9abfaf1ca60cf31aade7a4478337c4e575889f2b1fe2422b6a40c3d4ed072b259d8c5bdf0e5770a9ac5e4bb3a0c

Download Submit
C:\Program Files (x86)\BetOnline\BOL\preferences\defaultPrefs.cs.dso

Filesize
3KB

MD5
5855e9267fb2133bfd5ae5a2c6f8d0d4

SHA1
49497f440c3577e1c6ee8fc587ed53c81f651176

SHA256
72af2f9f7d64ed6ef153d60afba1b871c447d6d871cf6d23785154b183b4b073

SHA512
4087f4b153d2336ce79536255caebf6fc9f433d14df96f29a26a901664d477e6f629c8943d23b358795e1489b37bc172c2e4e54e7c5a41c4c4aec8cfe2dab60b

Download Submit
C:\Program Files (x86)\BetOnline\GameClient.exe

Filesize
9.5MB

MD5
41a3467812a117ec8bc4c8f4fc86bbd9

SHA1
3b7547b5db84a4494d864ab8d65dc8f39210beb1

SHA256
d7e531cfe379dd5795b7fdcc5afa52233dd6c63b84c6e262b63c5bfc37f0c7a5

SHA512
ef3a2fc355232655f3a60c3dc38e36ce358747636cdd1c105babfbf0019b881aea1edc6905b5464d2bea287cd513fb8f797b2741c0de70ec51cb263f933a0aa4

Download Submit
C:\Program Files (x86)\BetOnline\GameClient.exe

Filesize
9.5MB

MD5
41a3467812a117ec8bc4c8f4fc86bbd9

SHA1
3b7547b5db84a4494d864ab8d65dc8f39210beb1

SHA256
d7e531cfe379dd5795b7fdcc5afa52233dd6c63b84c6e262b63c5bfc37f0c7a5

SHA512
ef3a2fc355232655f3a60c3dc38e36ce358747636cdd1c105babfbf0019b881aea1edc6905b5464d2bea287cd513fb8f797b2741c0de70ec51cb263f933a0aa4

Download Submit
C:\Program Files (x86)\BetOnline\MSVCP140.dll

Filesize
436KB

MD5
addc83e063ddc88422a4fe7aade7cfcd

SHA1
3c31040526cb13adbb849e30c1a85d86cf7298f0

SHA256
557d76338488e28c7761dfe5ee4fa722f65f0c945563002e86de09c95f02b2aa

SHA512
05e379bfe23887107fd7f3ca52dbcc453624c48d35c4ce43a110ea3e360fecf284f77628ed240ceee940e7bf5e2c87c054fb8b19046c79cfe5559246e4b0e68d

Download Submit
C:\Program Files (x86)\BetOnline\OpenAL32.dll

Filesize
108KB

MD5
ce0cdc5459eaa1d574af781ddb8f2685

SHA1
709f3ea879ee83ca8b61dba5a2e497919bb8a4da

SHA256
26ba695d73fdf78ff133ab9c0e12300c26076441627a25ffba80c8b8aedb10ec

SHA512
8ccff5c8f02580116d539f63e8b849b57447d83d8b1eb7c91c4ad34761ca4c058dbbe57fd8e114f9eb7f463915b6c089c854f4d89800381f91a8f4088a6a3687

Download Submit
C:\Program Files (x86)\BetOnline\VCRUNTIME140.dll

Filesize
88KB

MD5
a0df29af5f6135b735dee359c0871ecf

SHA1
f7ebb9a9fd00e1ac95537158fae1167b06f490bd

SHA256
35afadbacc9a30341c1a5ee2117e69583e5044cea0bfab636dccbdcc281a8786

SHA512
fdc7a62d0b187829708ec544de52b4037da613e01a7591a2abc55f95c4719ee04f9c51d31f01edb7161b5edc3cd85004c3a55d375116baa76fb44553df592b3e

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Game\LeftDownInfoPanel\Move\main.cs.dso

Filesize
248B

MD5
8a84d24194e7f9ec0aba9ffe5f741d13

SHA1
75bedd03306b9b9f01b8f5276ea3b7a1d0fbea52

SHA256
22483ded89d8db518633b6c0a1f4ea3d665bd712b3084edd3c0b976dfaa4422e

SHA512
70ebffdae74661e882e8c283902e78ea5a07fd0348d271faa1b8a24feadf5fa52fd199b5268a188d186f60649fd06b352e2f7628dfdcf16886487631049c52cc

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Game\RaiseValueAndGameButtonsPanel\Edge\main.cs.dso

Filesize
193B

MD5
c034ca72cf344166b61f63e878b296c2

SHA1
69e3359dcb7657f201ae801e8631de8bb2227607

SHA256
466c4abb2cbd2d3dc05984bc95820c93eb5483a2a6df0546e5a12d7e63c32584

SHA512
12ec12ec4bce0f3eab0220004ba9ff9595d587af38008ec939949ca2fc1a5dd64c20eab8ac5912833a3330a26c82bb6f699f540bfb5bf7c7a177def5a92191ff

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Game\Seat\Edge\main.cs.dso

Filesize
172B

MD5
849a463a9d268f3ff0a6c18074ec9bf1

SHA1
733b350514b77eb9a81c4c71dc83de566c80afcc

SHA256
e74ee4f5139d0bc72bef09c12548663433737478d2483d8b241a2b36e4d41dac

SHA512
9e5bd54bd2f8f6f94765812831d89e96274d16cf7d8bdab9f3d07c1c6d0b254461f1d41ae0f9d66e35d69ca7a190f54f4d0387dc1d781e0d3087e7fa364b7020

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Game\TInfo\main.cs.dso

Filesize
280B

MD5
7a6cd83a59096a3bcb6402a684671b3a

SHA1
19a35f8c7fa1a2e88fb5a9ba89f99e7fc11cf4da

SHA256
0e7999eec9d7d4030d0412144e83e1944b070806b7d72e50c0911231753dc962

SHA512
386f048804afc5efbe497859f1376e5db7f975b41c5149ef3b484c7274d0d11ae2d33d9fe3d7c89c96df24cf480f41eb31ca485dbbe6179457a3ef3496b98586

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Game\TopButtonsPanel\Move\main.cs.dso

Filesize
183B

MD5
faaa37eabe024bb85edffb663f6c5af9

SHA1
603d7d90a1457630e9e88b6fd540831bc777c991

SHA256
7ffc99617dfb29b33af9e6c9932e9fcc11b9467f0be86d0524d405e8b1c93bc0

SHA512
51123e799bfbc95647f9f5458313a3e51af39c5f1fde536379768ce2967d0ad36a1ed059a539e051781fba0599b6a63125af8786bccc812bb02667d69e16db86

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Lobby\Filters\Chico\main.cs.dso

Filesize
381B

MD5
b9afcaf0be0ac2e3cc26739f7cd73bca

SHA1
c2e8310e1f25352b619f349f31b6e1f93ae5b5fe

SHA256
12582c13ee0fda8d2c638d953ded76d6e5b63dbee8e609655aaca67225dcfff6

SHA512
47e20db713c1b0c3f62344a1cf97bb141dc4c52550ac22de009c4d8a563d9614c12052f7c2ab5301ffa6649b960f1cf6d2f7ebd31d8da062ee48d2df72207f1b

Download Submit
C:\Program Files (x86)\BetOnline\_mods\Networks\Chico\main.cs.dso

Filesize
988B

MD5
1de5912f730dc4d04be888858425adea

SHA1
a0085725acfd746aec8adfe38a86be5a7b61cbf6

SHA256
caa2efb6f74db2e352ad211403b7236dc2125db2064fd62e8a25679c747b3fdb

SHA512
b8eb7b16e35b05f3eb0997bcd522ca0b210bcc60ad811010a2763eb2b2b38065f88b2e6cff94d9b5c923bd88993e341ee353b6094a7e450c74d1f49dc7233a6f

Download Submit
C:\Program Files (x86)\BetOnline\_theme_Edge\main.cs.dso

Filesize
522B

MD5
a169e50146abe38f283294d133c94322

SHA1
11298f1b5a8ee247077a404eb3cc931b8cd33621

SHA256
682ad10196cc75f7f13ec3470d23a7d160efe7360e49c39cdf68dd50cd92fb87

SHA512
572e8c5d9ec4afb7f28275b801be45d97c1d0e47b540dd9ce50148f62e3c613121548ae3e2b3d6fd70013d95d9040a038771c70744bfcde6c232ed2bdcf33be7

Download Submit
C:\Program Files (x86)\BetOnline\_theme_Move\main.cs.dso

Filesize
522B

MD5
294d218ca7ad587ea84e1f0deed60d43

SHA1
3fbbc22a90cac9cb81a7d384a90acbaf053c01d7

SHA256
1835d5705389b3823638c8265f1b0ca54ff44d10fea2979514eb9d22bea31957

SHA512
ee7d42a0dbf94fa1c45877bc9846a8d1ee87ca5bbfe94a847a17ecfe4ea6925497b992788a7b62128f7416b8df25a5e342048ff2b3a5b48414792ddc2a6a189d

Download Submit
C:\Program Files (x86)\BetOnline\commonPoker\main.cs.dso

Filesize
402B

MD5
ec6c7557f75bcb53a27b9dbc9bb5f219

SHA1
b99e08272d9d195a193f52b3f188310d9b998b74

SHA256
5e1393c31aaf88d1fb78f99a748d0f1b3721ab46fd391cd7800d4a34524fdb00

SHA512
fd260c3c69a7aec05f38a10feb3fc84f1959e77b0ebbb4c54439974213028f3ca2ed5ac2259d340cc0f5ee8077830330240c6059b4c61bb389fc004fd7a63b4a

Download Submit
C:\Program Files (x86)\BetOnline\commonTG\main.cs.dso

Filesize
2KB

MD5
c45bd610356ff45642bfa87eb5f61468

SHA1
64a4e99130ef976ce490b30351e9743cef28f9b8

SHA256
53b99e8198e3557e02c0e1f97a44c1ce9a4f9693cc570545ad5f7437ff5cbd1c

SHA512
eed688334ae75f6391bf5be0081ebfd440f32939e564bf0da6b191795e7c4803942f52bfe374b24295a1d4bb3e19951eca6696a8a053d2d96294b91177337352

Download Submit
C:\Program Files (x86)\BetOnline\commonTG\preferences\defaultPrefs.cs.dso

Filesize
23KB

MD5
7ec31aad0a315f24616ef8a8eb553137

SHA1
10c0ecc40f320481f2a3b4fdf2c0cd7ee25a0f90

SHA256
1978a825d076507836fe5383caf970ccbd858c40cba1a37dfccc18ab4b67c3f0

SHA512
2bcb255350e667d8e12ebfdf81b7f918f7c00dd8a58bbd76235bd567484687b499fb211dfb50cbf27c174327e217ea65e85af9812d1ed2cd5f7e8b102435026e

Download Submit
C:\Program Files (x86)\BetOnline\common\gameScripts\audio.cs.dso

Filesize
1KB

MD5
4a13e9b63041ebb864bc858ffff0e8eb

SHA1
aa6961e181059c3934bdd89d1df0071cd70e440d

SHA256
d2724d86633386bc7260e8e31b8859a76b8f3dfebd52e1eccd74debd5bff4ed9

SHA512
a16ef553873de4b54d076576a81df4f01179d527a5427949f2495f00cd20f5edff2d38675ffbe908b16526a05c43ffaa7124eb7cf88793fb8361e9b486a24a59

Download Submit
C:\Program Files (x86)\BetOnline\common\gameScripts\canvas.cs.dso

Filesize
1KB

MD5
180fd80e6d6152fce51396f599a1a174

SHA1
7f3a5fa340e5f661f99b36f53c0b8e1e9b89721a

SHA256
77e57476592f764bf773715a5322a4901b4bae786223f028cd183eb099256e22

SHA512
5754ca25982362de36c01f17506d3c51ee87d06da3419f17bdfc7d96d618e40554555afd1dfca93b31f5d0ec45f7dc2fdae235a9b2aa73191b19c94c600e8950

Download Submit
C:\Program Files (x86)\BetOnline\common\gameScripts\common.cs.dso

Filesize
2KB

MD5
e963d2a50d5bf1b8bebbd23b1bfca373

SHA1
fadede46b33d460159ec4ae51be821ee8fa074f0

SHA256
1e8d497856e934ef71e245eb9b160e8b01907ad97feb3826c2f47af112b4907e

SHA512
bce9e41c423f19ef1bd101c42fb6111fe8c08749dbddacf178f9261174001d06c870b079d2417b1ba01b2479dc4766a778acd6d2dfaecbd56813713897b638c4

Download Submit
C:\Program Files (x86)\BetOnline\common\gameScripts\cursor.cs.dso

Filesize
1KB

MD5
1d0cf2f14b0674cde83e86d083c3a3c8

SHA1
5262bec67d30f143a74300a5edd7e2cff466d629

SHA256
a990d1cf057f7f293234856b0f4a96ce79144f6765d9694e48f34d41dc033e5f

SHA512
1be8fffd79cbf1c62eb65c89febb8f5ad97a01a65f5d4c76cb6f4891012f1a8c35283c5e332265c0f3cc1c3462446d21a72fe16883e2a15db64b70a843f7cffa

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\HelpDlg.gui.dso

Filesize
2KB

MD5
dcacd1356b31f5cc537851a9b15220aa

SHA1
1c59dd6887c24d07af0cac5ba8ea67eca7a90606

SHA256
c5e8d7b728b17f9c356307158fe3e7e5a3df48235293ceead247b68909d5ad22

SHA512
ead03465d4aab5bc7674dbb399915fbd40cb8767f4a472e9e6cb754391e0900a7c39582dcac7b0a35166747c34c1cd69eee841384cb0dabf50e6717c70eb5c6f

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\MessageBoxOKCancelDetailsDlg.gui.dso

Filesize
3KB

MD5
63384a45a4def645c89a4f0629cb2edb

SHA1
f1d6cfb7b8d60918e660113fb05f50a85af4cd1c

SHA256
e107a42d1d19f3a65c1ebfa1eaf109c65f87c49bcacbcb2e8886c2bb885045b6

SHA512
3d4244ffc95e379358b8fdeeb92bcc82b4481befb49b77cc7e8436c4bb9283413ed5423fdc0249b93b415a9e1e4beec34d43e4a828266aa0257299920d7159af

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\Profiles.cs.dso

Filesize
9KB

MD5
f3ce6fffbc4bafaa1f9f832c51dfd958

SHA1
a8d42b1210a396ff445f611d1f4c54f5250b90fa

SHA256
886cbb8a9dcb021c47eb540cbee03bef66b93137e48b55d2542ba4eb9fcbca28

SHA512
7ee9fd207891ef6a2278401d9258bf640d90867f4455bd74ff5da188e530a6724ee2153152e58db40ebb1f9ba07f43be82b9567af550771c40466e2df8828b00

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\console.gui.dso

Filesize
6KB

MD5
dbd49c79071605a78cd95e8b95beac77

SHA1
885abd58725a5281906e5f06f5ca78ee87dc1a73

SHA256
da39cd28c4a54e09fb2d1e3c521ff380c6bbfddf4d58d85eb10b71832078a690

SHA512
69ce795a8b3210256aaf715025838d563648c02f384d8a078930259a8a36b1b83362457daf70006046ec00bded9b3af742824f2e9d75dd2afbcfd73cb3dc251d

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\cursors.cs.dso

Filesize
377B

MD5
f467d8d73104b66821c4d45cd3bd86d3

SHA1
acce5cd77ff6bc0a7ea6cf4dc37fa9d87da4c705

SHA256
b9f47fe0acd017fc83c0d8200516ec33a9980a793cfc7daed988c56fad97f2ed

SHA512
5d077436109fbe5c22dcd67bc90b4967b1740bf892e7563b3c9289d01d063dae312279a2071b832a94be8cd953573d3773499ad4188347ca614105b291f6c843

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\images\checkbox.png

Filesize
1KB

MD5
4bd08337f9e2343a7c59a6dbb78e7267

SHA1
4c81ae91481decdfc0e0337b20f25a9081a9f810

SHA256
ac187ce1dda3d7184bee791317bed9c3c9931a95c2ef3e4e1ce7cb674c75dda6

SHA512
1d92c86f1ba782d6ab1779647266d8ff93d8a33c4bb918b38a01c8e3243e9a1a120b55e9cb23f792881c0715fa5c7422287a076c1f80423009379468e97aa580

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\images\numeric.png

Filesize
165B

MD5
a038b7e515dc6422c08d5baa91fc4dd9

SHA1
81743938db9f2f670c8c515d4dc7fc2cddb7dc5b

SHA256
d1f29146f2489b00646386a6c0b8bacf7cf90ede294ab5f71f0b17a0c197de11

SHA512
c38b124118d89720fbd6630382ed6a926732f9422152ec5b85c7e670a75b1d0d9478291fcf1355bc83f72b267a46517b166fa0730ad6e9ea1e170b8773873852

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\images\scrollbar.png

Filesize
6KB

MD5
e2c28f46921a535e55284ab2885df4fb

SHA1
1a9f101fbe7301f5f043ee666ce2ad61d6d03ee5

SHA256
f3610f74fb5e9c616a2b758bd6b5e6abc8755a5186280cc43d9e7910e61023cd

SHA512
7c69f7abe9a7710d372947cb5c8cbda836cb94ba87423c2b5aa6226c9a964bb0cdc1908eb5b8829f73b3fa6b60299a05eed004e44c30b81af335221772812afb

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\images\slider.png

Filesize
694B

MD5
2026d417ef4f87f4f85bc522265e076f

SHA1
9613fd1be3552e7af950037d5f7cf5efba0b0d68

SHA256
de770788149877b8037a2a5a7a432be228d2c1d4dce22c6a2bdd10b3884b81f5

SHA512
a8a4567d1ffa2d499c83a260f3689d2cb90875d4ae1665f0a10d521f9ff22e438242cc4a72b3111f665ab3f0f5f29922cdb42e288214605a53e1a0e99d9adbbd

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\messageBoxOk.gui.dso

Filesize
1KB

MD5
71e42c055038097ba3d2f1f8f66dd5d2

SHA1
4ae4bd46d4b66a60a5ed92684bff08ebab3232d0

SHA256
54af06d377b1ffbbd1ed4cdb511861fe49518e556eacdbc47b431b243c703a75

SHA512
ffbcef343bd6347d3c27df1896527043c86934f3933736814ef7dd88dca8e1f1ab7b43edd8cc29a71af1c998c2cc1ad140ad96d927f0a902439c433ecfd52f63

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\messageBoxOkCancel.gui.dso

Filesize
1KB

MD5
b8305e1527381e63206ea69b35f7f700

SHA1
53f19caf6c5946757c63ef66bb630318f04954bc

SHA256
1a967481387b737dd3f31251fb8d79ab429d817df9a0f008314c488f1d157022

SHA512
a819451770306c08020ba164ac04ec269c2896569a0e45cabd65e520fce1a4ba7ebec9b188e15304d363167f147ed8fde26f84a22a86d38d7852d859a3f90b56

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\messageBoxYesNo.gui.dso

Filesize
1KB

MD5
6b8bbb3b785a19931b371c06560c5801

SHA1
e0cec4639013221b8633b7c088ba55da951d39ef

SHA256
156dfeb095801fab298342ff05c88cd3b45188a18a905d1795821cc7a5692f6d

SHA512
61af176be4e4d38f3e2a2c2d4b0702650a54fc638cabd467ed2795c2c7fe2dad049eb776dcd34119215c2a398dd0e4b10a66611fdd1a6cd63cb8163af6ca8d20

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\messageBoxYesNoCancel.gui.dso

Filesize
2KB

MD5
9a22c0ac5ce3bfd2a2e021145e11d90f

SHA1
29b4ddf0c8f3b88b44fab52d5b6822700dd7c303

SHA256
36665eb0493c9112ca593a724090c60e5551bd87a541dba353abf3b93c0cd86a

SHA512
550f51d07198a3947d3f4f0d65e660dd673c632479b6f582fca702d9b74f9832cd47bfa574c74e7c7cadb829e072f4817bc9f054eb4a3719143d9fbd7a21c457

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\messagePopup.gui.dso

Filesize
1KB

MD5
08ac9a99aa49101c1090713b82b37f90

SHA1
50b67920d8af286524381d3b12b0bfdff7d85f72

SHA256
f429be44b7092b392dd11fb3302ef271462484d42284f68ff8f2820e86fb8102

SHA512
21db0d42ed8c2f756ef603ffbef1fd89b7114da66444cd7e48c7c3f27357d56bdf1ec488954d4506b43b082ec8251fbad521851fc766d5c1f5911dbfda7a8551

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\options.gui.dso

Filesize
8KB

MD5
b2fa17dfcfe09b9d4501e45741186409

SHA1
24989d375f9ea806a37560af0fd6eb2cc8aecb25

SHA256
2ff5e0fdce9fbff06f6ee3baa9dc895846cb20394e39b8d4befcbf9b2b6134d1

SHA512
a962d4b70b856a4b5020f90dd239fc05f7f1723dd8eb958ce59f26ce2014b233c15b4233bb0b4f380453b866b42846139a625b37901ccb73d91466126989f35d

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\profiles\Profiles.cs.dso

Filesize
180B

MD5
94bc0ef602b8630ab9f9ab93c26f9628

SHA1
68267e9fb8fa535370ba12fc74b12f8e36f2bb7f

SHA256
03861afa2c034f93b1bf139bb943d00f697460e08c8d44c5312d356529d9618b

SHA512
3bf3176a29459a4201b331d8dbe5011cbf4124acf517082e5cafcff015294d5c5322b8659905622329c8a9ac93d107c82db33c783cbc4146d196a807829d88e0

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\profiles\ProfilesBitmap.cs.dso

Filesize
521B

MD5
eff50f94cd7e69b4e4d706432cd1789a

SHA1
cff365f6c78e266588a2c632281fd9f9953ae136

SHA256
f4be5fc5c2c2a4c2f6ea59b22b6ad0a53a3eb65371c7631f8666bfc64fa64f3a

SHA512
f6dab16dff4479b3b6fe09e75755e5e319d42072453816a8de9f145e67390a15c5fc3aa46c4c55e45b9d5fbb75568f1f285339adc985044b3adebaed34bb019d

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\profiles\ProfilesControl.cs.dso

Filesize
376B

MD5
bd9eb89063c61a326ce267ceb12b50eb

SHA1
475f382a477538ceb331d599d1d5095070f71d4d

SHA256
6c9d9dde2a2366a0bea99d5bfb4a58aed3fbe78cea40b053c2dc273025c83f63

SHA512
863278e918526f05a9958ede501382296f9be00db7c6b8ce05367333e4e88be5a9f372d4001d14fbd33dc05900aecf7b49f71183a405e2bd4ace6822ae6913dc

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\profiles\ProfilesCountry.cs.dso

Filesize
421B

MD5
a65db30be5381cdcfd93e8690a09e92f

SHA1
20994a1994a0dfbc423d1c204f3f138bf47f5fbd

SHA256
f2c67895b5f48da4f852fac179d84b5d90315e89cea6d4b19d122755acb9926f

SHA512
9bd18cad53be6ee8b589a3561754e937f196f568af64559462a845e45daec4f7c94377d2fae178a42eadebe564eab814c5411a55f0ddfc76e82c170172fc69a2

Download Submit
C:\Program Files (x86)\BetOnline\common\gui\profiles\ProfilesDialog.cs.dso

Filesize
321B

MD5
e20494ecb79a5bf26989976786c6ee17

SHA1
243bddab314f5c589d9001f1bfc37e4c5d8842a7

SHA256
dbb0cba57d6cb043505cf12c97fdb355da047eb1cf4fa1f345e9ede689821cba

SHA512
643299cdad9ff66ec65988889f2ce10081999b3ed08afd8c71dee4c40315a8114568a591edef102aebd638ddc10235e65229eb88f2a2bab0ee1db6c6c8eee0c8

Download Submit
C:\Program Files (x86)\BetOnline\common\main.cs.dso

Filesize
3KB

MD5
3f78bb732ca2ce9387c1403516322be5

SHA1
69e6e1531abfad960f6b1daa4531daac3976a189

SHA256
d1513f55eab7566d6333709451f485d61ad4778666692b4e212a7a11b855b7d7

SHA512
483e4570ce140e99ff3ee21ab87f05e223a7a5aadbd510213f78ec7a33f3afa3070e9a286ee137479a2baee8706dc976210f2ba0198a648dbd285f0443baccb5

Download Submit
C:\Program Files (x86)\BetOnline\common\preferences\defaultPrefs.cs.dso

Filesize
4KB

MD5
0e5dc5deb38bb4fe3274f04727c746fd

SHA1
4e9fe4ff075ecfccc8202eb8016c2e15bbcd4e8e

SHA256
8b5e28516aa34bd27c660c605c6fcfc2357c9e3d1f5699c800f38b90c8681e00

SHA512
da60bc09645a31d1c928a2761d84d4c91b3870cf8377d46f78ee87d9921a7f4d7c2913cb5e6ccc7c4b55d378b0eb38011e7da87153cc0f80b8c717a736c4b3f0

Download Submit
C:\Program Files (x86)\BetOnline\glu2d3d8.dll

Filesize
22KB

MD5
a0ed6ea1b8d8be72d544c82eb09cca5a

SHA1
dd5b8a8a01c28f0fcb2a55be8ee2ea0f80d5c2ce

SHA256
08ca01f4e63f1d6e8ecc9f7227e5041c915c7075b381d69de52f7efe3aeb7851

SHA512
0c43445b6cc137c74ceb32604665e1cff5f5a9cbd212c98ee00dd24ef54d101f1f916301537cecd141aa5356341ea2d77c02d2fe23d5d752f1c67e1ba5d73399

Download Submit
C:\Program Files (x86)\BetOnline\main.cs.dso

Filesize
5KB

MD5
f02dc766d1ce4e813280878ebeca81ff

SHA1
bc3f66a2d5bead8bd20ebb0126b2a338ddb75a94

SHA256
f6f8e0353e7b6fe387c547d6d196498b8446de504274da5cfe3321f016976a29

SHA512
1acf0bd2d8069c8f2f4c65ab1216642bbf9647ef790c96f3c2bfaeef55012468bf1d170bc44dea954d2cd2bc94f238cd1fb1cd1698a833f9a6815633f65186db

Download Submit
C:\Program Files (x86)\BetOnline\opengl2d3d8.dll

Filesize
190KB

MD5
8ad71e4b6ae25836fb70b846f0763a70

SHA1
fba72d87289456ce81799349c8f773f363fb3df3

SHA256
0e737154732e9d0fb89fdc4ebb4336bcfaf6c5540719be13b1fd37f00c36dc14

SHA512
54d02b88e4a2a1c32a081cd7b17029e863f4bb43ac20cd0208a995403e6e8ef0b95fde03a60eebd05840dc093e217946680a6309bf9048d317896efe98558c22

Download Submit
C:\Program Files (x86)\BetOnline\wrap_oal.dll

Filesize
404KB

MD5
9c24ed831ddfa8319382b2bfd9691aa9

SHA1
ab7872c0c0f48ed156d505ebad2dc4b0baff36a4

SHA256
c2ef86cbdb7fa07a9da8f56d5ffa548c57c5eaafd1ce5462ed397de7b8c823a3

SHA512
f424c7f4ab4c40a0c53756f4441e911e0d0279e221547c9c04c640d857df0ec61f5e2c4c61fdbd464fe6a3b96605ca31b24bf753dd991959c47c85299a1b0aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe

Filesize
239KB

MD5
239a4c37f08ee973b24544f7ddaf5873

SHA1
2de8a57495b2a0d4e3547421394b2af5fae8bf0c

SHA256
53174d20fc3354d9af80e9caa3ee2585fdd69bcbeb911e553658afb0f9157f54

SHA512
7e8d7f0492e749a684be2bbfe492b197faecd8fd1f9b50953f751ce3cf42b847c6d01a8fea2846249666a8db6d913a46994410d87e250fe3b8c3fc450d1f4063

Download Submit
C:\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe

Filesize
239KB

MD5
239a4c37f08ee973b24544f7ddaf5873

SHA1
2de8a57495b2a0d4e3547421394b2af5fae8bf0c

SHA256
53174d20fc3354d9af80e9caa3ee2585fdd69bcbeb911e553658afb0f9157f54

SHA512
7e8d7f0492e749a684be2bbfe492b197faecd8fd1f9b50953f751ce3cf42b847c6d01a8fea2846249666a8db6d913a46994410d87e250fe3b8c3fc450d1f4063

Download Submit
\Program Files (x86)\BetOnline\GameClient.exe

Filesize
9.5MB

MD5
41a3467812a117ec8bc4c8f4fc86bbd9

SHA1
3b7547b5db84a4494d864ab8d65dc8f39210beb1

SHA256
d7e531cfe379dd5795b7fdcc5afa52233dd6c63b84c6e262b63c5bfc37f0c7a5

SHA512
ef3a2fc355232655f3a60c3dc38e36ce358747636cdd1c105babfbf0019b881aea1edc6905b5464d2bea287cd513fb8f797b2741c0de70ec51cb263f933a0aa4

Download Submit
\Program Files (x86)\BetOnline\GameClient.exe

Filesize
9.5MB

MD5
41a3467812a117ec8bc4c8f4fc86bbd9

SHA1
3b7547b5db84a4494d864ab8d65dc8f39210beb1

SHA256
d7e531cfe379dd5795b7fdcc5afa52233dd6c63b84c6e262b63c5bfc37f0c7a5

SHA512
ef3a2fc355232655f3a60c3dc38e36ce358747636cdd1c105babfbf0019b881aea1edc6905b5464d2bea287cd513fb8f797b2741c0de70ec51cb263f933a0aa4

Download Submit
\Program Files (x86)\BetOnline\GameClient.exe

Filesize
9.5MB

MD5
41a3467812a117ec8bc4c8f4fc86bbd9

SHA1
3b7547b5db84a4494d864ab8d65dc8f39210beb1

SHA256
d7e531cfe379dd5795b7fdcc5afa52233dd6c63b84c6e262b63c5bfc37f0c7a5

SHA512
ef3a2fc355232655f3a60c3dc38e36ce358747636cdd1c105babfbf0019b881aea1edc6905b5464d2bea287cd513fb8f797b2741c0de70ec51cb263f933a0aa4

Download Submit
\Program Files (x86)\BetOnline\OpenAL32.dll

Filesize
108KB

MD5
ce0cdc5459eaa1d574af781ddb8f2685

SHA1
709f3ea879ee83ca8b61dba5a2e497919bb8a4da

SHA256
26ba695d73fdf78ff133ab9c0e12300c26076441627a25ffba80c8b8aedb10ec

SHA512
8ccff5c8f02580116d539f63e8b849b57447d83d8b1eb7c91c4ad34761ca4c058dbbe57fd8e114f9eb7f463915b6c089c854f4d89800381f91a8f4088a6a3687

Download Submit
\Program Files (x86)\BetOnline\glu2d3d8.dll

Filesize
22KB

MD5
a0ed6ea1b8d8be72d544c82eb09cca5a

SHA1
dd5b8a8a01c28f0fcb2a55be8ee2ea0f80d5c2ce

SHA256
08ca01f4e63f1d6e8ecc9f7227e5041c915c7075b381d69de52f7efe3aeb7851

SHA512
0c43445b6cc137c74ceb32604665e1cff5f5a9cbd212c98ee00dd24ef54d101f1f916301537cecd141aa5356341ea2d77c02d2fe23d5d752f1c67e1ba5d73399

Download Submit
\Program Files (x86)\BetOnline\msvcp140.dll

Filesize
436KB

MD5
addc83e063ddc88422a4fe7aade7cfcd

SHA1
3c31040526cb13adbb849e30c1a85d86cf7298f0

SHA256
557d76338488e28c7761dfe5ee4fa722f65f0c945563002e86de09c95f02b2aa

SHA512
05e379bfe23887107fd7f3ca52dbcc453624c48d35c4ce43a110ea3e360fecf284f77628ed240ceee940e7bf5e2c87c054fb8b19046c79cfe5559246e4b0e68d

Download Submit
\Program Files (x86)\BetOnline\opengl2d3d8.dll

Filesize
190KB

MD5
8ad71e4b6ae25836fb70b846f0763a70

SHA1
fba72d87289456ce81799349c8f773f363fb3df3

SHA256
0e737154732e9d0fb89fdc4ebb4336bcfaf6c5540719be13b1fd37f00c36dc14

SHA512
54d02b88e4a2a1c32a081cd7b17029e863f4bb43ac20cd0208a995403e6e8ef0b95fde03a60eebd05840dc093e217946680a6309bf9048d317896efe98558c22

Download Submit
\Program Files (x86)\BetOnline\vcruntime140.dll

Filesize
88KB

MD5
a0df29af5f6135b735dee359c0871ecf

SHA1
f7ebb9a9fd00e1ac95537158fae1167b06f490bd

SHA256
35afadbacc9a30341c1a5ee2117e69583e5044cea0bfab636dccbdcc281a8786

SHA512
fdc7a62d0b187829708ec544de52b4037da613e01a7591a2abc55f95c4719ee04f9c51d31f01edb7161b5edc3cd85004c3a55d375116baa76fb44553df592b3e

Download Submit
\Program Files (x86)\BetOnline\wrap_oal.dll

Filesize
404KB

MD5
9c24ed831ddfa8319382b2bfd9691aa9

SHA1
ab7872c0c0f48ed156d505ebad2dc4b0baff36a4

SHA256
c2ef86cbdb7fa07a9da8f56d5ffa548c57c5eaafd1ce5462ed397de7b8c823a3

SHA512
f424c7f4ab4c40a0c53756f4441e911e0d0279e221547c9c04c640d857df0ec61f5e2c4c61fdbd464fe6a3b96605ca31b24bf753dd991959c47c85299a1b0aed

Download Submit
\Program Files (x86)\BetOnline\wrap_oal.dll

Filesize
404KB

MD5
9c24ed831ddfa8319382b2bfd9691aa9

SHA1
ab7872c0c0f48ed156d505ebad2dc4b0baff36a4

SHA256
c2ef86cbdb7fa07a9da8f56d5ffa548c57c5eaafd1ce5462ed397de7b8c823a3

SHA512
f424c7f4ab4c40a0c53756f4441e911e0d0279e221547c9c04c640d857df0ec61f5e2c4c61fdbd464fe6a3b96605ca31b24bf753dd991959c47c85299a1b0aed

Download Submit
\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe

Filesize
239KB

MD5
239a4c37f08ee973b24544f7ddaf5873

SHA1
2de8a57495b2a0d4e3547421394b2af5fae8bf0c

SHA256
53174d20fc3354d9af80e9caa3ee2585fdd69bcbeb911e553658afb0f9157f54

SHA512
7e8d7f0492e749a684be2bbfe492b197faecd8fd1f9b50953f751ce3cf42b847c6d01a8fea2846249666a8db6d913a46994410d87e250fe3b8c3fc450d1f4063

Download Submit
\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe

Filesize
239KB

MD5
239a4c37f08ee973b24544f7ddaf5873

SHA1
2de8a57495b2a0d4e3547421394b2af5fae8bf0c

SHA256
53174d20fc3354d9af80e9caa3ee2585fdd69bcbeb911e553658afb0f9157f54

SHA512
7e8d7f0492e749a684be2bbfe492b197faecd8fd1f9b50953f751ce3cf42b847c6d01a8fea2846249666a8db6d913a46994410d87e250fe3b8c3fc450d1f4063

Download Submit
\Users\Admin\AppData\Local\Temp\LauncherAssistant.exe

Filesize
239KB

MD5
239a4c37f08ee973b24544f7ddaf5873

SHA1
2de8a57495b2a0d4e3547421394b2af5fae8bf0c

SHA256
53174d20fc3354d9af80e9caa3ee2585fdd69bcbeb911e553658afb0f9157f54

SHA512
7e8d7f0492e749a684be2bbfe492b197faecd8fd1f9b50953f751ce3cf42b847c6d01a8fea2846249666a8db6d913a46994410d87e250fe3b8c3fc450d1f4063

Download Submit
memory/1384-104-0x0000000005040000-0x0000000005260000-memory.dmp

Filesize
2.1MB

Download
memory/1700-63-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/1700-55-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/1700-129-0x0000000000400000-0x0000000000698000-memory.dmp

Filesize
2.6MB

Download
memory/1700-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1756-132-0x000007FEFC191000-0x000007FEFC193000-memory.dmp

Filesize
8KB

Download