Overview

overview

7

Static

static

3

2026-04-16...op.exe

windows10-2004-x64

7

2026-04-16...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/04/2026, 21:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_316ace6b689e2e2b757f7216a92b4b38_elex_stealc_stop.exe
  • Size 1.2MB
  • Sample260416-1gvsnset9w
  • SHA256 2a7dbe1caf4a9a601bb4ac6f44599251f88a9a7708a73e7a4ac9e20d6041b8b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 59 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 59 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 44 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_316ace6b689e2e2b757f7216a92b4b38_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_316ace6b689e2e2b757f7216a92b4b38_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5224
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/larivieraenglish/La Riviera Casino English20260408063541.msi" DDC_DID=3862721 DDC_UPDATESTATUSURL=http://190.4.88.58:8080/lariviera/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.88.58:8080/lariviera/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=downloadid CUSTOMVALUE02=3862721 SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-04-16_316ace6b689e2e2b757f7216a92b4b38_elex_stealc_stop.exe"
      2⤵
      • Use of msiexec (install) with remote resource
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Program Files (x86)\La Riviera Casino English\casino.exe
        "C:\Program Files (x86)\La Riviera Casino English\casino.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=gpu-process --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --mojo-platform-channel-handle=1760 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:2316
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --mojo-platform-channel-handle=2324 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Modifies trusted root certificate store through registry
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:5420
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:668
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4236
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4908
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4216
        • C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
          "C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --field-trial-handle=1724,5643558261229478874,10771682297641317209,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files (x86)\La Riviera Casino English\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2496
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B2E2344A301AE16DD616D7AA64F5349F C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Users\Admin\AppData\Local\Temp\{FD133FF7-2862-45B1-9F84-69600AFF5D66}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{FD133FF7-2862-45B1-9F84-69600AFF5D66}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C6A465C-6BC2-4A87-84EA-63E83B8BB35E}
        3⤵
        • Executes dropped EXE
        PID:1532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 1680
        3⤵
        • Program crash
        PID:2728
      • C:\Users\Admin\AppData\Local\Temp\{BED54747-FB7A-416A-9AF8-6615C4E952C1}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BED54747-FB7A-416A-9AF8-6615C4E952C1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2F66DB6B-8B5E-418A-95DC-C1C705FDBA36}
        3⤵
        • Executes dropped EXE
        PID:5244
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5A727B9DC43319B4149E9421F6C6A8B7
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Users\Admin\AppData\Local\Temp\{7CE3965D-F860-4EDE-A342-399734C988A5}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{7CE3965D-F860-4EDE-A342-399734C988A5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3B227C85-D165-456A-A79F-27FBF991FE05}
        3⤵
        • Executes dropped EXE
        PID:1448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1112
        3⤵
        • Program crash
        PID:5680
      • C:\Users\Admin\AppData\Local\Temp\{26DFAA53-01A9-4494-9A72-FAC785F5A2E1}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{26DFAA53-01A9-4494-9A72-FAC785F5A2E1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8ECA9D00-2B15-4BD2-912B-96AF0FE14074}
        3⤵
        • Executes dropped EXE
        PID:6112
      • C:\Users\Admin\AppData\Local\Temp\{78CB91F4-18B0-4D7C-9745-BD4E99BA1388}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{78CB91F4-18B0-4D7C-9745-BD4E99BA1388}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3610AA0-59E8-4D38-AE9F-963627F29055}
        3⤵
        • Executes dropped EXE
        PID:2776
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C4205997E3B79F288D154C152C0061C9 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5372
      • C:\Users\Admin\AppData\Local\Temp\{EDFAAFCB-C533-488B-8CBA-1E604DE44AA5}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{EDFAAFCB-C533-488B-8CBA-1E604DE44AA5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{62E8310F-777F-4B19-B0C9-DD641B5D244B}
        3⤵
        • Executes dropped EXE
        PID:4856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 1056
        3⤵
        • Program crash
        PID:2160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5176 -ip 5176
    1⤵
      PID:3772
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3764
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3744 CREDAT:17410 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 652 -ip 652
      1⤵
        PID:5544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5372 -ip 5372
        1⤵
          PID:3920

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e58c3e7.rbs
              • Path C:\Config.Msi\e58c3e7.rbs
              • Size 41KB
              • SHA256 fbf899deda54ed251a524c375674e4731b7464a32be5fe728a8f714c7e1711b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Fonts - Latin
              • Path C:\Program Files (x86)\La Riviera Casino English\_patch\Fonts - Latin\installed\Fonts - Latin
              • Size 89B
              • SHA256 a4301eac1ca4e25aafaa8c449eda20bd38a139d8785102c7dd59ddfca78503e7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              browser_configuration.html
              • Path C:\Program Files (x86)\La Riviera Casino English\browser_configuration.html
              • Size 3KB
              • SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index
              • Path C:\Program Files (x86)\La Riviera Casino English\cache\Code Cache\js\index-dir\the-real-index
              • Size 696B
              • SHA256 0adb33e4849dd0181385be174d31fc6d7776b9ef1a5c3dfb41f8276109124d67
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              the-real-index~RFe597c99.TMP
              • Path C:\Program Files (x86)\La Riviera Casino English\cache\Code Cache\js\index-dir\the-real-index~RFe597c99.TMP
              • Size 48B
              • SHA256 fd73670d373d903ad069d8975d9fa076171671958d14597806d576ef50b843bf
              • MD5 SHA1 SHA512
              Submit Download

              CURRENT
              • Path C:\Program Files (x86)\La Riviera Casino English\cache\Local Storage\leveldb\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              Network Persistent State
              • Path C:\Program Files (x86)\La Riviera Casino English\cache\Network Persistent State
              • Size 1KB
              • SHA256 09cbe03135b0af8111194ddc9bda73cdef47f1655fb714863cb8e602ca8104d9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State~RFe5a277f.TMP
              • Path C:\Program Files (x86)\La Riviera Casino English\cache\Network Persistent State~RFe5a277f.TMP
              • Size 59B
              • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              casino.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\casino.dll
              • Size 4.5MB
              • SHA256 6989ac23f3c5d171fba2639190d504037fffb4ebac6a050bc711a7316205078b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              casino.exe
              • Path C:\Program Files (x86)\La Riviera Casino English\casino.exe
              • Size 20KB
              • SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              casino.ico
              • Path C:\Program Files (x86)\La Riviera Casino English\casino.ico
              • Size 23KB
              • SHA256 8e73c43e4add31b72716f1dbffac60dd305a968b02ae8c357e1166237328512b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              casino.ini
              • Path C:\Program Files (x86)\La Riviera Casino English\casino.ini
              • Size 5KB
              • SHA256 8104c8103a9bc0c364966d141eba03f4f04400b0456f716cb76837c4e0e69231
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cef.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\cef.pak
              • Size 1.9MB
              • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cef_100_percent.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\cef_100_percent.pak
              • Size 262KB
              • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cef_200_percent.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\cef_200_percent.pak
              • Size 413KB
              • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cef_extensions.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\cef_extensions.pak
              • Size 1.2MB
              • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cefsubproc.exe
              • Path C:\Program Files (x86)\La Riviera Casino English\cefsubproc.exe
              • Size 328KB
              • SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_elf.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\chrome_elf.dll
              • Size 795KB
              • SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              concrt140.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\concrt140.dll
              • Size 246KB
              • SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              console.log
              • Path C:\Program Files (x86)\La Riviera Casino English\console.log
              • Size 2KB
              • SHA256 a07bb8d03c54913cf5c43415c42e52f374a7ac8383df6198dad6454e78388b71
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              console.log
              • Path C:\Program Files (x86)\La Riviera Casino English\console.log
              • Size 7KB
              • SHA256 74ab73ce51e22275d9056127acf563b940195868eecac82e693d628254c5eaa0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              d3dcompiler_47.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\d3dcompiler_47.dll
              • Size 3.5MB
              • SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              devtools_resources.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\devtools_resources.pak
              • Size 1.5MB
              • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              directsound.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\directsound.dll
              • Size 221KB
              • SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extgame.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\extgame.dll
              • Size 1.6MB
              • SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              00readme.txt
              • Path C:\Program Files (x86)\La Riviera Casino English\fonts\00readme.txt
              • Size 127B
              • SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              albw.ttf
              • Path C:\Program Files (x86)\La Riviera Casino English\fonts\albw.ttf
              • Size 165KB
              • SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mhb.ttf
              • Path C:\Program Files (x86)\La Riviera Casino English\fonts\mhb.ttf
              • Size 3.8MB
              • SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mhgbb.ttf
              • Path C:\Program Files (x86)\La Riviera Casino English\fonts\mhgbb.ttf
              • Size 1.7MB
              • SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              icudtl.dat
              • Path C:\Program Files (x86)\La Riviera Casino English\icudtl.dat
              • Size 10.0MB
              • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Extgame
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Extgame
              • Size 99B
              • SHA256 3573b2f57cb3d7b4c11443aeea02736382ff5aa13a8a8a3ff5986ba66d861011
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Extgame.ini
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Extgame.ini
              • Size 761B
              • SHA256 c8b48d7efec9cf1249e5ff5c3482ba2af301bbbd80876199ae97e5827ec21c9c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Fonts - Latin.ini
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Fonts - Latin.ini
              • Size 623B
              • SHA256 8135c20bdf8e0f991369fa150bba2cd235f2855ab347fd4c9ab4bed7af1e3c7c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Fonts - Latin.ini~e9d10b85f5dd97fedc903b04d700.zip
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Fonts - Latin.ini~e9d10b85f5dd97fedc903b04d700.zip
              • Size 648B
              • SHA256 829e978dd1a3fad11ebfb8c961b2b742f67854a0347376a855dcbb157368556d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Lobby
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Lobby
              • Size 2KB
              • SHA256 a86c823fcc8fd02a6a8e0912aed3efb94e4fc83bfd91aa92a92b0d8d9ea8eb44
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Lobby.ini
              • Path C:\Program Files (x86)\La Riviera Casino English\installed\Lobby.ini
              • Size 24KB
              • SHA256 65bcd1e8955226edf411dd34f998a2caa6547ec6d49147f5c47719972d10a80e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lbyinst.exe
              • Path C:\Program Files (x86)\La Riviera Casino English\lbyinst.exe
              • Size 504KB
              • SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libEGL.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\libEGL.dll
              • Size 305KB
              • SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libGLESv2.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\libGLESv2.dll
              • Size 6.6MB
              • SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lobby.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\lobby.dll
              • Size 2.7MB
              • SHA256 7e792d346315088383337f445f71ce8931a7cac49ccea07a669b734936d3b7fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lobby.ini
              • Path C:\Program Files (x86)\La Riviera Casino English\lobby.ini
              • Size 3KB
              • SHA256 33273810d67b739200284c97d09c5f24825570af7378f0c5d8212eb5221ebf03
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              en-US.pak
              • Path C:\Program Files (x86)\La Riviera Casino English\locales\en-US.pak
              • Size 219KB
              • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcp140.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\msvcp140.dll
              • Size 445KB
              • SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msvcrt.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\msvcrt.dll
              • Size 260KB
              • SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              plibc32.dll
              • Path C:\Program Files (x86)\La Riviera Casino English\plibc32.dll
              • Size 537KB
              • SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              action_button.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\action_button.rsc
              • Size 593KB
              • SHA256 1df5b2af9a563beacdc073334f91c90db84c5bb6e7f6f761866de64bd131ba2f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              card.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\card.rsc
              • Size 143KB
              • SHA256 191fa426072acc583644aff7e103540d53611c30ac12516c793281c70fcd7668
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cards32.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\cards32.rsc
              • Size 402KB
              • SHA256 817adcc2b5fcc1b8d92ce5ba3f4a1a5699900ca2861312261f656d22ed1eca8f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              casino.bd1.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\casino.bd1.rsc
              • Size 18KB
              • SHA256 4c90c8be26cd8ebc481c877550615172c3866f6649ed7ddbf62ccfe99d33572f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              casino.usd.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\casino.usd.rsc
              • Size 18KB
              • SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chips32.eur.rsc
              • Path C:\Program Files (x86)\La Riviera Casino English\rsc\chips32.eur.rsc
              • Size 239KB
              • SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              imagestore.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dtalr6s\imagestore.dat
              • Size 19KB
              • SHA256 201056cc2ce67f877408ed41340140770f074de092f0621db86b10eb790ffb07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              package_list.ini[1].crc
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CRFV07G3\package_list.ini[1].crc
              • Size 24B
              • SHA256 5c382510384013d1bdde787c88b209cc88049df4e9266d9657a36fc6f0b69500
              • MD5 SHA1 SHA512
              Submit Download

              suggestions[1].en-US
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U5GKMXA3\suggestions[1].en-US
              • Size 17KB
              • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              touch-icon-highres~599E59070D688D95896346AFE6FDFB1A[1].png
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U5GKMXA3\touch-icon-highres~599E59070D688D95896346AFE6FDFB1A[1].png
              • Size 18KB
              • SHA256 df33a93b9e96815dc20e04cf3f2131131dda551012ed41da4e0822a642c9d6cc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI5EA6.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI5EA6.tmp
              • Size 1.2MB
              • SHA256 800f55417e0e8fd8c4200a27ec1f33eccf9cbc132738adddf103131aedd06692
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _is4391.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_is4391.tmp
              • Size 1KB
              • SHA256 c7df7c16ccc979b3574ed005993f9f389dbc5ddcdc272bd93e75d2db944225f3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _isBD11.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_isBD11.tmp
              • Size 285B
              • SHA256 ba73c27bc6086eaf8c4abbb1e0dcce83857fee52874fe6ad0ea3ec24d08c8b4b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              _isBD32.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_isBD32.tmp
              • Size 176KB
              • SHA256 d8f4f6a8e0f95b9d77147f9ddc7f15e22e4d5bc6b5f482a9a33b88b62abd7d41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isBD42.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_isBD42.tmp
              • Size 250KB
              • SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isBD62.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_isBD62.tmp
              • Size 50KB
              • SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isBEEA.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\_isBEEA.tmp
              • Size 24KB
              • SHA256 fd895d6162df6db73580753f95b4495016a975c4d9dfa887ccf131399466ab33
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              0x0409.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{54EAF6EB-DFE4-499A-BE86-EF08821C1CF5}\0x0409.ini
              • Size 21KB
              • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ISMSIDEL.INI
              • Path C:\Users\Admin\AppData\Local\Temp\{54EAF6EB-DFE4-499A-BE86-EF08821C1CF5}\_ISMSIDEL.INI
              • Size 20B
              • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
              • MD5 SHA1 SHA512
              Submit Download

              String1033.txt
              • Path C:\Users\Admin\AppData\Local\Temp\{BED54747-FB7A-416A-9AF8-6615C4E952C1}\String1033.txt
              • Size 172KB
              • SHA256 cba88a08ab502bbdd9045caac5c8c1798e64bd6d4369931f2c4c6687ddb33517
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.inx
              • Path C:\Users\Admin\AppData\Local\Temp\{BED54747-FB7A-416A-9AF8-6615C4E952C1}\setup.inx
              • Size 271KB
              • SHA256 1e8d2c33ad8b3af5fe3c53531f605ab6664522dba5dc51e0adcce33ad552b777
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISBEW64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{FD133FF7-2862-45B1-9F84-69600AFF5D66}\ISBEW64.exe
              • Size 104KB
              • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISRT.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{FD133FF7-2862-45B1-9F84-69600AFF5D66}\ISRT.dll
              • Size 258KB
              • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IsConfig.ini
              • Path C:\Users\Admin\AppData\Local\Temp\{FD133FF7-2862-45B1-9F84-69600AFF5D66}\IsConfig.ini
              • Size 518B
              • SHA256 b66606b8de65bd9657f9bf1bbb06c9765e392b692852730292e245b9ffecb7da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ~437E.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\~437E.tmp
              • Size 5KB
              • SHA256 9defba5eede6ae76590877d20910a00677c23cc11529ec35068ac475d3056c98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI5956.tmp
              • Path C:\Windows\Installer\MSI5956.tmp
              • Size 2.4MB
              • SHA256 5aa87dd4b064ac591f22c8e6870c530193e29be43c9584478b71716a78b281b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIC06E.tmp
              • Path C:\Windows\Installer\MSIC06E.tmp
              • Size 141KB
              • SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/652-465-0x0000000000DB0000-0x0000000000DF5000-memory.dmp
              Download

              memory/652-133-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/652-159-0x0000000003330000-0x00000000033D6000-memory.dmp
              Download

              memory/652-509-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/652-530-0x00000000035F0000-0x0000000003696000-memory.dmp
              Download

              memory/652-531-0x00000000035F0000-0x0000000003696000-memory.dmp
              Download

              memory/652-544-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/652-565-0x0000000003270000-0x0000000003316000-memory.dmp
              Download

              memory/652-566-0x0000000003270000-0x0000000003316000-memory.dmp
              Download

              memory/652-578-0x0000000000DB0000-0x0000000000DF5000-memory.dmp
              Download

              memory/764-244-0x0000016DBCE80000-0x0000016DBD2F2000-memory.dmp
              Download

              memory/1380-585-0x0000000001200000-0x0000000001245000-memory.dmp
              Download

              memory/1380-77-0x0000000001200000-0x0000000001245000-memory.dmp
              Download

              memory/1532-71-0x0000000140000000-0x000000014001D000-memory.dmp
              Download

              memory/3764-1693-0x0000000000930000-0x00000000009EF000-memory.dmp
              Download

              memory/3764-266-0x0000000000930000-0x00000000009EF000-memory.dmp
              Download

              memory/5176-78-0x0000000000ED0000-0x0000000000F15000-memory.dmp
              Download

              memory/5176-110-0x0000000003E10000-0x0000000003EB6000-memory.dmp
              Download

              memory/5176-111-0x0000000003E10000-0x0000000003EB6000-memory.dmp
              Download

              memory/5176-85-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/5176-584-0x0000000000ED0000-0x0000000000F15000-memory.dmp
              Download

              memory/5176-65-0x0000000003E10000-0x0000000003EB6000-memory.dmp
              Download

              memory/5176-40-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/5372-491-0x0000000002E30000-0x0000000002ED6000-memory.dmp
              Download

              memory/5372-490-0x0000000002E30000-0x0000000002ED6000-memory.dmp
              Download

              memory/5372-469-0x0000000010000000-0x00000000101B4000-memory.dmp
              Download

              memory/5372-579-0x0000000000AA0000-0x0000000000AE5000-memory.dmp
              Download