Overview

overview

7

Static

static

3

2026-08-03...op.exe

windows10-2004-x64

7

2026-08-03...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_fa8c8e4a0d32e2096a86311168974462_elex_stealc_stop.exe
  • Size 1.2MB
  • Sample260804-krhyvsgc89
  • SHA256 79a634d4fc65d31277d3b3638d140b81b12f6d5e83b28747a7199b21c9f7f8b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 51 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa8c8e4a0d32e2096a86311168974462_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_fa8c8e4a0d32e2096a86311168974462_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/captainjack/CaptainJack Casino20260704070454.msi" DDC_DID=3251480 DDC_RTGURL=https://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=3251480%26filename=Setup%2Eexe%26affid=4850%26CASINONAME=captainjack DDC_DOWNLOAD_AFFID=4850 DDC_UPDATESTATUSURL=http://190.4.94.3:8080/captain/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.94.3:8080/captain/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=trackingID CUSTOMVALUE02=CJCb6f0ce49d03592b4ceaabc39e925168b CUSTOMNAME03=NAME CUSTOMNAME04=EMAIL SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-08-03_fa8c8e4a0d32e2096a86311168974462_elex_stealc_stop.exe"
      2⤵
      • Use of msiexec (install) with remote resource
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4148
      • C:\Program Files (x86)\CaptainJack Casino\casino.exe
        "C:\Program Files (x86)\CaptainJack Casino\casino.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --mojo-platform-channel-handle=1756 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:3568
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --mojo-platform-channel-handle=2408 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3084
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4316
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2852
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1096
        • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
          "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1744,6336481913911960202,3188459403414156596,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1248
        • C:\Program Files (x86)\CaptainJack Casino\temp\lbyinst.exe
          "C:\Program Files (x86)\CaptainJack Casino\temp\lbyinst.exe" 00000cac EN C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5852
          • C:\Program Files (x86)\CaptainJack Casino\casino.exe
            "C:\Program Files (x86)\CaptainJack Casino\casino.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5968
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --mojo-platform-channel-handle=1776 /prefetch:2
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              PID:6076
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --mojo-platform-channel-handle=1920 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Modifies trusted root certificate store through registry
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:1644
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1868
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4976
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3104
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5096
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1040
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5040
            • C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
              "C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --field-trial-handle=1768,3151636608949278955,3684632450191574534,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files (x86)\CaptainJack Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9C6912EF9DD252565D5C8D1D9145F190 C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Local\Temp\{44C52D66-C3CB-44A1-B0B1-EADA63C42644}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{44C52D66-C3CB-44A1-B0B1-EADA63C42644}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68D4E2C-08CB-42BF-86EC-E176348B7533}
        3⤵
        • Executes dropped EXE
        PID:4056
      • C:\Users\Admin\AppData\Local\Temp\{A79F619D-8448-4694-AAFB-C1583034D822}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{A79F619D-8448-4694-AAFB-C1583034D822}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{367D07F5-DCAB-498F-A442-235826A6D8A1}
        3⤵
        • Executes dropped EXE
        PID:1956
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D2093797F38B19554FF7150A92DC5DF3
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Users\Admin\AppData\Local\Temp\{94EE6ECE-9DF5-438D-A196-A94196C33CCA}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{94EE6ECE-9DF5-438D-A196-A94196C33CCA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E1119CB-FDF3-4894-B8F8-8BF4E9B8B265}
        3⤵
        • Executes dropped EXE
        PID:2824
      • C:\Users\Admin\AppData\Local\Temp\{E1246F53-C3BF-4F1D-BFC5-B17234C92D22}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{E1246F53-C3BF-4F1D-BFC5-B17234C92D22}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C72964B-7E82-4113-9942-672560CC531A}
        3⤵
        • Executes dropped EXE
        PID:2376
      • C:\Users\Admin\AppData\Local\Temp\{A7EB9656-F9D1-464E-A6AA-24C49E04120D}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{A7EB9656-F9D1-464E-A6AA-24C49E04120D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1516CEFA-BA8C-48D0-905C-1A100E73D03D}
        3⤵
        • Executes dropped EXE
        PID:4628
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 54CD28F792D542376C52C1E32250826A E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Users\Admin\AppData\Local\Temp\{CFBF9800-42AE-4006-AFBD-C75C4A21B92E}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{CFBF9800-42AE-4006-AFBD-C75C4A21B92E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BBA646EC-B385-4C59-8484-607C6D893A0D}
        3⤵
        • Executes dropped EXE
        PID:1264

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58ae2d.rbs
        • Path C:\Config.Msi\e58ae2d.rbs
        • Size 39KB
        • SHA256 594d33bc690aa99a03ad94c80f7aeee4544719852b9fd0407e019636a8e33376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Fonts - Latin
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Fonts - Latin\installed\Fonts - Latin
        • Size 89B
        • SHA256 af7b74b5aa8b2dd3d3638c561a7b57d3b2246f1525278063705904becf28a833
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\installed\Lobby
        • Size 2KB
        • SHA256 0a4afc8ada971d08c6465efbbc2dd6eed0ed25ef7eb89c90b19c47a0e18d08fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        casino.bd1.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\casino.bd1.rsc
        • Size 18KB
        • SHA256 4c90c8be26cd8ebc481c877550615172c3866f6649ed7ddbf62ccfe99d33572f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.brl.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\casino.brl.rsc
        • Size 40B
        • SHA256 37f41eff037700e864d42a066ca90cda5bb54977a5d0e21f0d88eed0fa59acf1
        • MD5 SHA1 SHA512
        Submit Download

        casino.jpy.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\casino.jpy.rsc
        • Size 18KB
        • SHA256 32cb8a484450c9f3041a27d12e71ea37a5675e88afd9cfcc07b6550e52e165d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips.cny.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips.cny.rsc
        • Size 118KB
        • SHA256 7c4e4e20abd3bb14ac060bc3bf80e192fe115e76f41323d2f04ff063a9bd5a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips.rub.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips.rub.rsc
        • Size 118KB
        • SHA256 7005bbdca4f9ebb2d0bd42bd459ddd0c94d95a5aa4e1df5d32290296dc887994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips.twd.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips.twd.rsc
        • Size 104KB
        • SHA256 02b506cd07089a9a7cd47de92228499e858253a7f6cedc4ac505b4111c71b13c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips.usd.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips.usd.rsc
        • Size 118KB
        • SHA256 f1c54212c08182ad54813faab52fd9a9f2e75f47b9c77e9379f0f3d503b3deed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.rub.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips32.rub.rsc
        • Size 239KB
        • SHA256 0438b96763b110e459c662639b0338d8ddc671b771427cc2d76c4c933276cd19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.twd.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips32.twd.rsc
        • Size 162KB
        • SHA256 d46a2150c5dafd5072be0e2010e7eeb06d198925d2173cc7a6ae3708d59fafca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.zar.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\chips32.zar.rsc
        • Size 239KB
        • SHA256 9f535a871f1fe259409579324ffd5e151c9f34ced98b49833910477fbba50917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        quicklaunchtrigger.34.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\Lobby\rsc\quicklaunchtrigger.34.rsc
        • Size 11KB
        • SHA256 fb2051867f2647a4e14fa8564968391b809978fe407ff0d7281e0603ff56e1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package_list.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\package_list.ini
        • Size 134KB
        • SHA256 938659ba528456f348bceac1582e3b3dbe1322d5184d4bfa7a2af20594cf8809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package_list.ini.crc
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\package_list.ini.crc
        • Size 28B
        • SHA256 c0a6495724eea10737cba5c1384169eeb7ca25526d6c7b7cd378dd2d43563053
        • MD5 SHA1 SHA512
        Submit Download

        package_list.ini.zip
        • Path C:\Program Files (x86)\CaptainJack Casino\_patch\package_list.ini.zip
        • Size 19KB
        • SHA256 ef7b3d2d89c730648d62960f227a0ee5282a254bf745e2c035affece45688de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        browser_configuration.html
        • Path C:\Program Files (x86)\CaptainJack Casino\browser_configuration.html
        • Size 3KB
        • SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Code Cache\js\index-dir\the-real-index
        • Size 456B
        • SHA256 1d2c45e09c57a1be6ce0d4121decaef9b2e53eef8c066496485eda618c7832df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index~RFe59dcf8.TMP
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Code Cache\js\index-dir\the-real-index~RFe59dcf8.TMP
        • Size 48B
        • SHA256 749574a0d3a5af58d67c4b3bb3862b15f479b137e03b8cb73e1ed596d01f6c1e
        • MD5 SHA1 SHA512
        Submit Download

        Network Persistent State
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Network Persistent State
        • Size 111B
        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe594f6e.TMP
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Network Persistent State~RFe594f6e.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\Program Files (x86)\CaptainJack Casino\cache\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        casino.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\casino.dll
        • Size 4.5MB
        • SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.exe
        • Path C:\Program Files (x86)\CaptainJack Casino\casino.exe
        • Size 20KB
        • SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ico
        • Path C:\Program Files (x86)\CaptainJack Casino\casino.ico
        • Size 24KB
        • SHA256 1daf3ba00fd30b9c4a101a274493c2768910f97b948cead86521a7837b6a69b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\casino.ini
        • Size 5KB
        • SHA256 576cd0a8aeca14f2a43657162d5add19b102c98921eed59d73895a1b8decadce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\cef.pak
        • Size 1.9MB
        • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_100_percent.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\cef_100_percent.pak
        • Size 262KB
        • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_200_percent.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\cef_200_percent.pak
        • Size 413KB
        • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_extensions.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\cef_extensions.pak
        • Size 1.2MB
        • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cefsubproc.exe
        • Path C:\Program Files (x86)\CaptainJack Casino\cefsubproc.exe
        • Size 328KB
        • SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_elf.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\chrome_elf.dll
        • Size 795KB
        • SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        concrt140.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\concrt140.dll
        • Size 246KB
        • SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        console.log
        • Path C:\Program Files (x86)\CaptainJack Casino\console.log
        • Size 2KB
        • SHA256 5730fdaf444dee396a2831e4e4c8b3726b5908c84ddf02ab2663e8fb96a96f8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        console.log
        • Path C:\Program Files (x86)\CaptainJack Casino\console.log
        • Size 8KB
        • SHA256 0b323444b02a1112b8cd6ce2ff53ddffb3ca93ff3afd12e09e3f3e8509a2e8da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\d3dcompiler_47.dll
        • Size 3.5MB
        • SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devtools_resources.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\devtools_resources.pak
        • Size 1.5MB
        • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directsound.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\directsound.dll
        • Size 221KB
        • SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extgame.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\extgame.dll
        • Size 1.6MB
        • SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        00readme.txt
        • Path C:\Program Files (x86)\CaptainJack Casino\fonts\00readme.txt
        • Size 127B
        • SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        albw.ttf
        • Path C:\Program Files (x86)\CaptainJack Casino\fonts\albw.ttf
        • Size 165KB
        • SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhb.ttf
        • Path C:\Program Files (x86)\CaptainJack Casino\fonts\mhb.ttf
        • Size 3.8MB
        • SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhgbb.ttf
        • Path C:\Program Files (x86)\CaptainJack Casino\fonts\mhgbb.ttf
        • Size 1.7MB
        • SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files (x86)\CaptainJack Casino\icudtl.dat
        • Size 10.0MB
        • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Extgame
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Extgame
        • Size 99B
        • SHA256 6a05e9ced8a3302f9000141905b9322ff66d88a08391789a164f9b55e815c9fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Extgame.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Extgame.ini
        • Size 741B
        • SHA256 4462481ec21f76de6c8f208b047608cb98a2a9ce424505bdb9286cca1473b4c1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts - Latin.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Fonts - Latin.ini
        • Size 603B
        • SHA256 118fc00fa0166298cc4b1d0241027b18eb1746a46889389f40d039b96ad20e45
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts - Latin.ini~e9d10b99f5c297bd965c173da057.zip
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Fonts - Latin.ini~e9d10b99f5c297bd965c173da057.zip
        • Size 635B
        • SHA256 a1fc0d654ef7a5f6a9d5d5a9d38ba4d49ef184aae041577c2b833e72362c2182
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Lobby
        • Size 2KB
        • SHA256 b228f47652b3c4dab60866bb3b41429ed17e325bab02579e80350ccdda6bbd95
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Lobby.ini
        • Size 24KB
        • SHA256 ddfa9689d90f15d4d27820db2852e1aa6ff5ab8ec617694e98be33be828b120c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lobby.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Lobby.ini
        • Size 24KB
        • SHA256 8fbbbe62a5b76319075b522338acea394d2f19b62003354609194d519d0f383f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lobby.ini~e9d10b8cf5cb97ba530b0d90d0e2.zip
        • Path C:\Program Files (x86)\CaptainJack Casino\installed\Lobby.ini~e9d10b8cf5cb97ba530b0d90d0e2.zip
        • Size 7KB
        • SHA256 effad035c1e752333a017cc07b5ac45da155190576b1351408d8387202546bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lbyinst.exe
        • Path C:\Program Files (x86)\CaptainJack Casino\lbyinst.exe
        • Size 504KB
        • SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\libEGL.dll
        • Size 305KB
        • SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\libGLESv2.dll
        • Size 6.6MB
        • SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\lobby.dll
        • Size 2.7MB
        • SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.ini
        • Path C:\Program Files (x86)\CaptainJack Casino\lobby.ini
        • Size 5KB
        • SHA256 04cdf29e342a5e99646f4355cb3410dd820f46322dbfdc8e309a235523c7a391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Program Files (x86)\CaptainJack Casino\locales\en-US.pak
        • Size 219KB
        • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\msvcp140.dll
        • Size 445KB
        • SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcrt.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\msvcrt.dll
        • Size 260KB
        • SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plibc32.dll
        • Path C:\Program Files (x86)\CaptainJack Casino\plibc32.dll
        • Size 537KB
        • SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.usd.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\rsc\casino.usd.rsc
        • Size 18KB
        • SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.eur.rsc
        • Path C:\Program Files (x86)\CaptainJack Casino\rsc\chips32.eur.rsc
        • Size 239KB
        • SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S9SIAAA3\lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc
        • Size 16KB
        • SHA256 5a7b338a6f0bc51b4d9ae109a83e7b398f85444449db0faecde03cc117fb5926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI4811.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI4811.tmp
        • Size 1.3MB
        • SHA256 fe2cac2ce342991f6bfce3a33abfe3e111e258ad691c100e1beb8d27b9bad7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is13F5.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is13F5.tmp
        • Size 1KB
        • SHA256 e27d5cbe1948450884f35d99883db78f345e516b2ab4a9633989f14daf0c3ce0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isA459.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA459.tmp
        • Size 286B
        • SHA256 e7fd76d04e483e63cabeda5d44db218d860af830aa251789c3e217b272eac979
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isA583.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA583.tmp
        • Size 176KB
        • SHA256 7f6eadfabe40375586f407c38a9b6f57c2128d4fd5c2ec9025bd385014767d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isA5B3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA5B3.tmp
        • Size 250KB
        • SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isA5D3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA5D3.tmp
        • Size 50KB
        • SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isA5F3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA5F3.tmp
        • Size 113KB
        • SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isA614.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isA614.tmp
        • Size 24KB
        • SHA256 34f218fe41812e1e34796359d6579f2deae78cae0bbd579a1bcf3d992c4985c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{2D149CA4-EA90-449B-A253-A47F7DAFBC39}\0x0409.ini
        • Size 21KB
        • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{2D149CA4-EA90-449B-A253-A47F7DAFBC39}\_ISMSIDEL.INI
        • Size 20B
        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
        • MD5 SHA1 SHA512
        Submit Download

        ISBEW64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{44C52D66-C3CB-44A1-B0B1-EADA63C42644}\ISBEW64.exe
        • Size 104KB
        • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISRT.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{44C52D66-C3CB-44A1-B0B1-EADA63C42644}\ISRT.dll
        • Size 258KB
        • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isres_0x0409.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{44C52D66-C3CB-44A1-B0B1-EADA63C42644}\_isres_0x0409.dll
        • Size 540KB
        • SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IsConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{A79F619D-8448-4694-AAFB-C1583034D822}\IsConfig.ini
        • Size 518B
        • SHA256 02cb6693241715f61b454cf6908d874b0167909f8507bf0f4dfa94b2aebe5de0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        String1033.txt
        • Path C:\Users\Admin\AppData\Local\Temp\{A79F619D-8448-4694-AAFB-C1583034D822}\String1033.txt
        • Size 172KB
        • SHA256 89c520dd94bdee516951c97799ce0475d56f97e1572bdbeb275cc35a44c7fec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.inx
        • Path C:\Users\Admin\AppData\Local\Temp\{A79F619D-8448-4694-AAFB-C1583034D822}\setup.inx
        • Size 271KB
        • SHA256 8e6a29c3acbc7e49f19c55274fd3c08963f4189854e2aca26578b8ddb7c60bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~13E3.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~13E3.tmp
        • Size 6KB
        • SHA256 b604a283bd1b208433dd73f255b6b1ceb915fbfa022119f0bb28f0f9f0b4b8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI2C89.tmp
        • Path C:\Windows\Installer\MSI2C89.tmp
        • Size 2.5MB
        • SHA256 5e0b0c41b911cb0feb1dd6fbe2e401bedef2c59d0d13c24f004a418c25a009df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIA8FE.tmp
        • Path C:\Windows\Installer\MSIA8FE.tmp
        • Size 141KB
        • SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1108-119-0x0000000004040000-0x00000000040E6000-memory.dmp
        Download

        memory/1108-69-0x0000000004230000-0x00000000042D6000-memory.dmp
        Download

        memory/1108-89-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1108-124-0x00000000044B0000-0x0000000004539000-memory.dmp
        Download

        memory/1108-74-0x0000000004390000-0x0000000004419000-memory.dmp
        Download

        memory/1108-39-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4036-395-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4036-421-0x0000000002AC0000-0x0000000002B66000-memory.dmp
        Download

        memory/4036-424-0x0000000002C80000-0x0000000002D09000-memory.dmp
        Download

        memory/4968-513-0x00000000035B0000-0x0000000003639000-memory.dmp
        Download

        memory/4968-469-0x00000000034C0000-0x0000000003566000-memory.dmp
        Download

        memory/4968-442-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4968-170-0x00000000034C0000-0x0000000003566000-memory.dmp
        Download

        memory/4968-484-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4968-510-0x00000000034C0000-0x0000000003566000-memory.dmp
        Download

        memory/4968-171-0x00000000034C0000-0x0000000003566000-memory.dmp
        Download

        memory/4968-140-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4968-176-0x0000000003570000-0x00000000035F9000-memory.dmp
        Download