2d9d38a58e52ff332b519b523cb4ea70e3060fa560b3d9cd0af2491c12aefa40

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe
Size 1.2MB
Sample260919-2d6ansyyat
SHA256 2d9d38a58e52ff332b519b523cb4ea70e3060fa560b3d9cd0af2491c12aefa40
MD5 a161ae882c60004df83c83c333712607
SHA1 640eb2b40086a9b7d3f35f76103799dffcb26f24
SHA512 a1952b9bc1b29ad39f4ee82ca10f039553ce38ec141b8df80b4571ab42daa0a21fd9f2fa5cfa6d7861fd8e430b70f7c35754a481f709b9c9a8529ebc70ea2979
SSDEEP 24576:YxNlFSIthzcjw4hfvyERsHo0VxvkTbFB7QWYy:Y7KIzyhh5Oo0wTbFVZb
TLSH
T1B5455A1376C1C03FE2B215728C6F9EB846A17D275A30451BB594FE2C2EF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	cefsubproc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	cefsubproc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	casino.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	cefsubproc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	cefsubproc.exe

Executes dropped EXE 13 IoCs

pid	Process
3720	ISBEW64.exe
4276	ISBEW64.exe
4348	ISBEW64.exe
2548	ISBEW64.exe
3500	ISBEW64.exe
5600	ISBEW64.exe
452	casino.exe
856	cefsubproc.exe
5656	cefsubproc.exe
5028	cefsubproc.exe
3060	cefsubproc.exe
872	cefsubproc.exe
5904	cefsubproc.exe

Loads dropped DLL 64 IoCs

pid	Process
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1884	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
2544	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
1144	MsiExec.exe
452	casino.exe
452	casino.exe
452	casino.exe
452	casino.exe
452	casino.exe
452	casino.exe
452	casino.exe
856	cefsubproc.exe
856	cefsubproc.exe
856	cefsubproc.exe
856	cefsubproc.exe
452	casino.exe
856	cefsubproc.exe
856	cefsubproc.exe
856	cefsubproc.exe
5656	cefsubproc.exe
5656	cefsubproc.exe
5656	cefsubproc.exe
5656	cefsubproc.exe
3060	cefsubproc.exe
5028	cefsubproc.exe
3060	cefsubproc.exe
3060	cefsubproc.exe
3060	cefsubproc.exe
5028	cefsubproc.exe
5028	cefsubproc.exe
5028	cefsubproc.exe
872	cefsubproc.exe
872	cefsubproc.exe
872	cefsubproc.exe
872	cefsubproc.exe
5904	cefsubproc.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
908	MSIEXEC.EXE

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
19	908	MSIEXEC.EXE
20	1884	MsiExec.exe
39	2052	msiexec.exe
41	1144	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Las Vegas USA Casino\_patch\Fonts - Latin\fonts\albw.ttf	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_0	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.myr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\quicklaunchcoordinates.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\table.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Code Cache\js\index	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\LOCK	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhb.ttf	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\icudtl.dat	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.php.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.pen.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.rub.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.usd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\zlib.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\index	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.try.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.myr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.uah.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.zar.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\sounds\cmn000.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log	cefsubproc.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_1	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby.ini	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.bd1.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\lobby.en.st.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_1	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.rub.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino32.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.thb.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\sounds\cmn001.wav	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\swf_Download\casino-rsc.swf	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Code Cache\wasm\index	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.twd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\history.rsc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\MANIFEST-000001	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.jpy.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.zar.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Code Cache\js\index-dir\temp-index	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cookies	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\MANIFEST-000001	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.ars.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\table.en.rsc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cef.pak	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\chrome_elf.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\lobby.ini	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.thb.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.usd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.pen.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\downloaddlg.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\lobbyall.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.mbt.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\quicklaunchtrigger.34.rsc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\_patch\Fonts - Latin\fonts\albw.ttf	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\installed\packages	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_2	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Network Persistent State~RFe5ae909.TMP	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.krw.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\lobby.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.try.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.php.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.ars.rsc	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{f1f75b50-c5af-446d-ad5b-b11d94445775}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI995C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73C1.tmp	msiexec.exe
File created	C:\Windows\Installer\e59766f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF076.tmp	MSIEXEC.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI777B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{f1f75b50-c5af-446d-ad5b-b11d94445775}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\	casino.exe
File opened for modification	C:\Windows\Installer\MSI7249.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BCF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CE9.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343306772234901"	msedge.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{4DC55940-B80A-422C-8490-057EB8EB7E9E}	cefsubproc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Version = "2584281088"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\ = "URL: Realtime Gaming Protocol"	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\URL Protocol	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}\LocalServer32\ = "c:\\program files (x86)\\las vegas usa casino\\casino.exe %1"	casino.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\ProductName = "Las Vegas USA Casino"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL\SourceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{FEA7225D-0D31-4163-AEAC-D34D306FCB27}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\rtg.lasvegasusacasino	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\DefaultIcon\ = "casino.exe"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open\command	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\CLSID\ = "{62503E3D-4F35-4C8D-8F20-06395F009142}"	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\PackageCode = "C546AEC4B460E9147BA9395CC565033D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL\1 = "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open\command\ = "c:\\program files (x86)\\las vegas usa casino\\casino.exe %1"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\ProductIcon = "C:\\Windows\\Installer\\{f1f75b50-c5af-446d-ad5b-b11d94445775}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\403D11E862CAEB749A41C189E1E04FA8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\403D11E862CAEB749A41C189E1E04FA8\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\CLSID	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}\ProgID\ = "rtg.lasvegasusacasino"	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\05b57f1ffa5cd644dab51bd149447557\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\PackageName = "Las Vegas USA Casino20260905115826.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\LastUsedSource = "u;1;https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\DefaultIcon	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}\ = "Las Vegas USA Casino"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}\ProgID	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62503E3D-4F35-4C8D-8F20-06395F009142}\LocalServer32	casino.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2052	msiexec.exe
2052	msiexec.exe
856	cefsubproc.exe
856	cefsubproc.exe
5656	cefsubproc.exe
5656	cefsubproc.exe
3060	cefsubproc.exe
3060	cefsubproc.exe
5028	cefsubproc.exe
5028	cefsubproc.exe
872	cefsubproc.exe
872	cefsubproc.exe
5904	cefsubproc.exe
5904	cefsubproc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	908	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	908	MSIEXEC.EXE
Token: SeRestorePrivilege	908	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	908	MSIEXEC.EXE
Token: SeSecurityPrivilege	2052	msiexec.exe
Token: SeCreateTokenPrivilege	908	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	908	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	908	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	908	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	908	MSIEXEC.EXE
Token: SeTcbPrivilege	908	MSIEXEC.EXE
Token: SeSecurityPrivilege	908	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	908	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	908	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	908	MSIEXEC.EXE
Token: SeSystemtimePrivilege	908	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	908	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	908	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	908	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	908	MSIEXEC.EXE
Token: SeBackupPrivilege	908	MSIEXEC.EXE
Token: SeRestorePrivilege	908	MSIEXEC.EXE
Token: SeShutdownPrivilege	908	MSIEXEC.EXE
Token: SeDebugPrivilege	908	MSIEXEC.EXE
Token: SeAuditPrivilege	908	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	908	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	908	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	908	MSIEXEC.EXE
Token: SeUndockPrivilege	908	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	908	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	908	MSIEXEC.EXE
Token: SeManageVolumePrivilege	908	MSIEXEC.EXE
Token: SeImpersonatePrivilege	908	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	908	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	908	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	908	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	908	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	908	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	908	MSIEXEC.EXE
Token: SeTcbPrivilege	908	MSIEXEC.EXE
Token: SeSecurityPrivilege	908	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	908	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	908	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	908	MSIEXEC.EXE
Token: SeSystemtimePrivilege	908	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	908	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	908	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	908	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	908	MSIEXEC.EXE
Token: SeBackupPrivilege	908	MSIEXEC.EXE
Token: SeRestorePrivilege	908	MSIEXEC.EXE
Token: SeShutdownPrivilege	908	MSIEXEC.EXE
Token: SeDebugPrivilege	908	MSIEXEC.EXE
Token: SeAuditPrivilege	908	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	908	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	908	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	908	MSIEXEC.EXE
Token: SeUndockPrivilege	908	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	908	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	908	MSIEXEC.EXE
Token: SeManageVolumePrivilege	908	MSIEXEC.EXE
Token: SeImpersonatePrivilege	908	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	908	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	908	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
908	MSIEXEC.EXE
908	MSIEXEC.EXE
5112	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 908	5896	2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe	90
PID 2052 wrote to memory of 1884	2052	msiexec.exe	93
PID 1884 wrote to memory of 3720	1884	MsiExec.exe	94
PID 1884 wrote to memory of 4276	1884	MsiExec.exe	105
PID 2052 wrote to memory of 1144	2052	msiexec.exe	107
PID 1144 wrote to memory of 4348	1144	MsiExec.exe	108
PID 2052 wrote to memory of 2544	2052	msiexec.exe	111
PID 2544 wrote to memory of 2548	2544	MsiExec.exe	112
PID 1144 wrote to memory of 3500	1144	MsiExec.exe	113
PID 1144 wrote to memory of 5600	1144	MsiExec.exe	114
PID 908 wrote to memory of 452	908	MSIEXEC.EXE	118
PID 452 wrote to memory of 856	452	casino.exe	119
PID 452 wrote to memory of 5656	452	casino.exe	120
PID 452 wrote to memory of 5028	452	casino.exe	121
PID 452 wrote to memory of 3060	452	casino.exe	122
PID 452 wrote to memory of 872	452	casino.exe	123
PID 452 wrote to memory of 5904	452	casino.exe	125
PID 452 wrote to memory of 5588	452	casino.exe	138
PID 452 wrote to memory of 5112	452	casino.exe	137
PID 5112 wrote to memory of 5576	5112	msedge.exe	139
PID 5112 wrote to memory of 3288	5112	msedge.exe	140
PID 5112 wrote to memory of 2584	5112	msedge.exe	141
PID 5112 wrote to memory of 2584	5112	msedge.exe	141
PID 5112 wrote to memory of 2584	5112	msedge.exe	141
PID 5112 wrote to memory of 2880	5112	msedge.exe	142
PID 5112 wrote to memory of 2880	5112	msedge.exe	142
PID 5112 wrote to memory of 5132	5112	msedge.exe	144
PID 5112 wrote to memory of 5132	5112	msedge.exe	144
PID 5112 wrote to memory of 5132	5112	msedge.exe	144
PID 5112 wrote to memory of 4260	5112	msedge.exe	143
PID 5112 wrote to memory of 4260	5112	msedge.exe	143
PID 5112 wrote to memory of 4260	5112	msedge.exe	143
PID 5112 wrote to memory of 5408	5112	msedge.exe	145
PID 5112 wrote to memory of 5408	5112	msedge.exe	145
PID 5112 wrote to memory of 5408	5112	msedge.exe	145
PID 5112 wrote to memory of 1504	5112	msedge.exe	147
PID 5112 wrote to memory of 1504	5112	msedge.exe	147
PID 5112 wrote to memory of 1504	5112	msedge.exe	147
PID 5112 wrote to memory of 6056	5112	msedge.exe	150
PID 5112 wrote to memory of 6056	5112	msedge.exe	150
PID 5112 wrote to memory of 6056	5112	msedge.exe	150
PID 5112 wrote to memory of 5728	5112	msedge.exe	151
PID 5112 wrote to memory of 5728	5112	msedge.exe	151
PID 5112 wrote to memory of 4692	5112	msedge.exe	152
PID 5112 wrote to memory of 4692	5112	msedge.exe	152
PID 5112 wrote to memory of 704	5112	msedge.exe	154
PID 452 wrote to memory of 556	452	casino.exe	158
PID 5112 wrote to memory of 4180	5112	msedge.exe	159
PID 5112 wrote to memory of 4180	5112	msedge.exe	159
PID 5112 wrote to memory of 4180	5112	msedge.exe	159
PID 5112 wrote to memory of 2468	5112	msedge.exe	160
PID 5112 wrote to memory of 2468	5112	msedge.exe	160
PID 5112 wrote to memory of 2468	5112	msedge.exe	160

C:\Users\Admin\AppData\Local\Temp\2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/Las Vegas USA Casino20260905115826.msi" DDC_DID=7415477 DDC_UPDATESTATUSURL=http://190.112.221.40:8080/lvcasino/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/lvcasino/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe"
  2⤵
  - Use of msiexec (install) with remote resource
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
    "C:\Program Files (x86)\Las Vegas USA Casino\casino.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=1752 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:856
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=2288 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5656
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5028
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3060
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:872
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1744,1795052666035325200,7317878697534862699,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff95770c188,0x7ff95770c194,0x7ff95770c1a0
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,17918856542906235937,10559833357513914960,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1295036427576148806,18167831122559005760,262144 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,9473159478110097028,4869911904309411199,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
        5⤵
        
        PID:2880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10955778596903009099,10323427643830549803,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1728857656474972343,185878035113559355,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,13469852644868135738,9388666283336930625,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5004,i,12722209975769082388,14313242633233063261,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
        5⤵
        
        PID:1504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5272,i,3156653484483567401,12388377814924747789,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13216421867776437397,3235892956254023410,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,4197266767114626512,6572540679858592786,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
        5⤵
        
        PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10117937396538188107,8252383028158935023,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10117937396538188107,8252383028158935023,524288 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6084,i,15334439701798744953,7047782883835908081,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
        5⤵
        
        PID:4180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6412,i,10155915782506225374,10189340075735804518,2097152 --field-trial-handle=2540,i,18131022581813519942,4461151050502729342,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
        5⤵
        
        PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      PID:556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E36CBD7BE0210238C3FD55CF6447DDFE C
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\{C2D6A31C-04AB-4D2C-80C0-F6C5BC0DDD33}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{C2D6A31C-04AB-4D2C-80C0-F6C5BC0DDD33}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB50639F-D85F-4749-A9A5-551D8A4AB14F}
    3⤵
    - Executes dropped EXE
    PID:3720
- - C:\Users\Admin\AppData\Local\Temp\{FB69A2D7-3793-49EC-9BEF-3184C60B4EBF}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{FB69A2D7-3793-49EC-9BEF-3184C60B4EBF}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58A4901C-FD38-410C-98EE-209060D442CD}
    3⤵
    - Executes dropped EXE
    PID:4276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C881670591585B5035F1119190FBCDCC
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\{72F06274-D1AB-4A8D-A3EA-9A213604A982}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{72F06274-D1AB-4A8D-A3EA-9A213604A982}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{432D964C-1C68-4BC2-8C4C-71378E6FB1A9}
    3⤵
    - Executes dropped EXE
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\{4E1DDCD1-72CC-4B63-832A-371FFAA7CA10}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{4E1DDCD1-72CC-4B63-832A-371FFAA7CA10}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E99A96E3-DEFF-4F9F-A165-DFCCE5834EC9}
    3⤵
    - Executes dropped EXE
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\{544CC022-9D12-47E3-ABFA-02C3A9129EC0}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{544CC022-9D12-47E3-ABFA-02C3A9129EC0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4010FB93-CD4C-46E6-BC12-94099035E245}
    3⤵
    - Executes dropped EXE
    PID:5600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 06FA0E1561BE5B0BD87ADE9E7142197C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\{760F9AC4-004C-482B-ADBC-CD8C59DE6365}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{760F9AC4-004C-482B-ADBC-CD8C59DE6365}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81178EEA-0B0C-449A-ACF1-01E7543025F8}
    3⤵
    - Executes dropped EXE
    PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59766e.rbs

Path C:\Config.Msi\e59766e.rbs
Size 40KB
SHA256 d94071821ce35c10c338f42e80a8012a867e509901db9486b9708deff2562dbc
MD5 33d390165c1ecd32a453801e51804f0e
SHA1 68200508e96cc6ee70d30e578c7e3e6e51b6ebd3
SHA512 57ee9c0a28b97214af0fe09df8b17ed2a680d8076c456ab3a03499241dee2cead09cbe60c1f588ac8e288cf2efcb2124f2008326b29a5abb87f8923f2edbc82f
SSDEEP 768:2Dddt+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+tG:mp7
TLSH
T1E903E2434680CBD3E68B5778FBAB1E043B32CCD9A394425356DC4779C8C2B951AFAB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fonts - Latin

Path C:\Program Files (x86)\Las Vegas USA Casino\_patch\Fonts - Latin\installed\Fonts - Latin
Size 89B
SHA256 339137603f0f8df7e1e519074516fcd1357766ba3412e33fa59d8428331a2b6f
MD5 9f403d6958410b57fb7d37a3b675dfd2
SHA1 b9ff5279ed9f1a5a46a8ca0121e1ba8d5364a829
SHA512 4edb0a408669861e70734f9839d61c62ca58dd757c16f0726a2ffdba88118a4c5c46b4dbebd1860ef8ada861b1f6ba9d0a8922b91640042be1b5163eb099e0b7
TLSH
T1DAB0220223220028C0003C320AB2C3B30F3EC00CC0A8838200020030CCAC2000FA2B00
MD5 SHA1 SHA512 TLSH

Submit Download

browser_configuration.html

Path C:\Program Files (x86)\Las Vegas USA Casino\browser_configuration.html
Size 3KB
SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
MD5 0d6ad6c487e8e290d0589d340ba5db48
SHA1 9072cf3e65596b0310d614527a48bb6463f91481
SHA512 76c3b0ee5e9e7dda9a74dd7dfd4c69ad7776b10b02a8fb1345d5ec1f4507bf5087da706c7754792b7e846c4cd652281a5bbb56135fe3bff1fba1575d5606d2e9
TLSH
T1AF81ACB9A89174137733627BB7DBA09CFB7209176144C162788DE21A2FF444185ABFF8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\Las Vegas USA Casino\cache\Network Persistent State
Size 193B
SHA256 f8a8f3b4163fdd1ef1a0eef8a1961783cc1a678231039275d25c8c2531a0909b
MD5 6b1c96eef6a442164212242f8e028a3e
SHA1 291aa4a1b11fcd3e1fc7e0ebbcd18cbc6179e770
SHA512 4aa0495c4a9fc8998ddb196382832b7e3e963a3d4a9abbea63dd0aca46bff87e95a5ee9acb3d3aa9497caa766a0ee469841a52866a9e52b2078bef0f2ed54ef9
TLSH
T12AC0226E41206CFF038683A00524BA23C2FE000A4208586DC528732C8135AAE480486B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ae909.TMP

Path C:\Program Files (x86)\Las Vegas USA Casino\cache\Network Persistent State~RFe5ae909.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

casino.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.dll
Size 4.5MB
SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
MD5 4118fbad8ec0bb9a3b21c911d76d52fd
SHA1 fcee086f7327f719a1e40320b213c5b3ba03c314
SHA512 95aab12fafa5cc81841a82a6d2d3be336cd92a7fbef3ea87628a917337946d39d446f55bd7f3ffc47af13295ec9959890c4165bea63a6ac1fc8d13bcadf49589
SSDEEP 49152:r3AlgM/VBWpdU/T5goEPyUoBNVbEINKA6mvP8OBubWwg/fJQz/6w0fSsuRr3m3eo:r3AlgM/VBWe5glol/YA6ECz/6w0fVvN
TLSH
T183265D307702C13AEAEE10B69D7DEA4E5408BBA01B6404EBA3D81B5F7B745D33A32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
Size 20KB
SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
MD5 61805738e66d9407cfba9b86136ee7df
SHA1 8de7b1de940ece408e238ed25d22f2032477e9cd
SHA512 1aba4a80e9adac8395dbf1db77efec9c269a16ccccbea54da92bc12a8a1f3e3132afbde21055f5f6fc1a32141bc71f58dba9ba0c5a2a155e935782689982a7c1
SSDEEP 384:b1LsT61EYFJeNC8QFJ4QOOmabJUoNwOj7S:b6T68NC84CdOjbmoWOj7
TLSH
T18E92730BAFF706E2CF93913A1C2191E76D3F64A0CE4C6537CA9439E9C434B36A42569D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.ico

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ico
Size 45KB
SHA256 6b56cc21c731e65c825fa4b87ba1cfde4001cc74c42eb345db2da7c728524e27
MD5 d402d827c495227aac04187628b28117
SHA1 8bd26c129141a8cb36fb776865bb6ee24f5db830
SHA512 79e4006103c4b60335c710ad84583450c5c78207c753ef2a001469ab6b905e4eed0ff5994b3e3da7745f08e759b633f7d4d4dee8fad89c688f010eedff5fafba
SSDEEP 768:hEb0ZZSZhN9vML9dgO9Krj8/IpYV2XHXKOOO8ftSe:hEMZw9vML9dm38/EHKOOO8ftS
TLSH
T1C1238049B21F38CDF619B7B1452F693BC3E95EA98051825A133F353C19B3230678E9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ini
Size 5KB
SHA256 5e7ac57f831a003cf3fc9006ac86600f06fcd269caf3afdd86595a59a7c64b12
MD5 1a3914f451811cb0fb6c2da20f94ea55
SHA1 bba44ab7b7504640e50c436fb7713a24966ad886
SHA512 c407328b075eb2e511aaf604a1ce8cb0179607d943826d38f493d05522e67d00236a678223472a5e17836316c8e8f6caa64b5100e78d05ec3c5730ad31689436
SSDEEP 96:VSc9FKw1k23TA3To3Tpw3TynYGzcDyRQlXt5mBo:VSc9FKw1LjAjojmjynYNDyRQld5mBo
TLSH
T1E4C1A8AE4131EA3139719C5574A47B4C2C5B74F3C801CF04AD35B31E4AAD6E9A1B57F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef.pak
Size 1.9MB
SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
MD5 dd85c83433f8417b4b7fefebb135b2ad
SHA1 a2ffcfddaa22218319ba1964226d6b676791bfe3
SHA512 cb3ac426807f4a1a55d48e9ccd459c465ed779c487811799899130d8e775960d64a87a8c10f5c8635799c23ef1f63bf6f2a05d87217c221d75806ce385542770
SSDEEP 49152:xuO6GF+4e3xlU2R4ipYMuOqnveEyjD8d16/pT:vFfehlU2R4TbOkvujkcB
TLSH
T1B1952310EDD56E66D7EAE779B4A4A1225D7A948349A0BC0CF0CF420FCBBD55A10B833D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_100_percent.pak
Size 262KB
SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
MD5 9db96c13fa9c1c0ee63145665783798e
SHA1 560c075aa1378f4b42f17618374a53f520c0344b
SHA512 7e3d3f6072623b3186e50f11ad3696179c6d4e70c866ff969c12c6146b2a5dfcbdbdc331e1df32e203c98d347f53fda53f8ef9bd85dd41a0fa87bb4d6b6bb7bc
SSDEEP 6144:lNk7S+yq1H1yFepjbzwVyTYFhwEx5c1YC7x10fSucY7OP2ITQ:lNcXjxYF2kgf1d/dQ
TLSH
T1CE44F1F3B3B4BC7ED69B0A3371510A77D43A423A06530309C28689756E5AB94EDDE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_200_percent.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_200_percent.pak
Size 413KB
SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
MD5 4e5334990bb928aabd5a70bb894d085c
SHA1 97412161b8aa498c7285df8c5025b16985515a57
SHA512 323fe198f2c618aa2e16b45bd2bbc12745b1512abd1e87942b5ce6293d6090c228746a468745de826ca18c57cb49a1ac3b50c98dfe0aec0e9d155d7c6c8eb8a3
SSDEEP 6144:jk7S+yq1H1yFepjpDQYaR+9bGHgs4jTlvFhwIz73QYV85u/oFYvwoytKi6obByPF:jcXjGfIegs4jTZF2sg5u/oFFpxLlFYb
TLSH
T1319402E6F3F8AC79D9930E33511209B3D977153506A7030AC28B9C397D56B9889CE39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_extensions.pak
Size 1.2MB
SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
MD5 589da360b8c57889db5fc8d541fd149b
SHA1 0527e2413154145a35a67084d7e8dad5b0f5bea0
SHA512 7d5f3e3c825725e2a6bdbf1f0d58831a976aee9fd944f1d9c9bb91cddd3287728e7535f91a721b57927d2e3f5db2df4afc11ce18338fb5c33a12b2bf6de43c02
SSDEEP 24576:U6rcKQtJb9RLONDAG13xdT0b+e/mp2IsWvRBr2k+CGFH3GrH/orJm22O+EcRc7Pb:UhxR6N0G1hdAKe/rIsWZBakZGpKHgryE
TLSH
T10B552330BA9C643FE0E0E7B0D9B850726A2C491729D5696CB29F825DDF8931903F197F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cefsubproc.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
Size 328KB
SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
MD5 3da07b7bcbef647a5452435cff33e82e
SHA1 cc16d8bf23da8c96787ac4d0da9cd19d527e0802
SHA512 c98036cc203fcc10f449d7d0641f40fd53f7be05e98aae9244959f175069eb0f76a226b9bb4a9bf56ec0686ebe3c77845b70da4f0fffbc53f58d2f96f4e64a50
SSDEEP 6144:vOZ6jwP9gN3lblEyT0V34vjRFDxBQ3fS:GZ6A9wxP0VEzQPS
TLSH
T181643B703B15C13BDE6110F25D7ADABF505CA2090BA178C767C82BAEDE716D22B3191B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\chrome_elf.dll
Size 795KB
SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
MD5 b89e3241fb538533a3a19977e3dcab8f
SHA1 23060547c1dca7ceb0f190e3022b48eb568f8bfc
SHA512 07e15425adac13ba840afce1be804f7519b905dfbf54c78569219523c453f51415d3de4f5abb6980f6388a31b6b52fd18177250300c6b7a412447534e0da3d8f
SSDEEP 24576:XjjcLs8g0U/cAbbwjOVZ9wjZrDsCfTpQei:XjmLg0U7SOVZQGCbKei
TLSH
T1E605AF02B580D035D4661530912CE739AB3DE6194F248FDBD3C88CAA9FB15D16B3A7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\concrt140.dll
Size 246KB
SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
MD5 3da20013485a5651b687711bf859d8b9
SHA1 6c4071f22f5f5c6b14b8019ad8becc2d2dd7a14f
SHA512 ffa88023f5c54674944f7ef2062027c76251e451c0ee42a6b4594ec503fe09e7118e73993c1bfc49f3e0497f42a980e53f4e6a70e11d3db55afda2c4e505c03c
SSDEEP 6144:HdynmUAZcA2pxuarMEc+vA54+0omeCrB/04LU+KS1yQZS0IuVx8i5S12z/VsTB:6pLnxB/0AncuVx8cz
TLSH
T19A345CE1344048F7F76F07328528D7BA94BEA68027EB81D71B6CA64D1E646C1EE33593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\d3dcompiler_47.dll
Size 3.5MB
SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
MD5 f76b1d2cd95385b21e61874761ddb53a
SHA1 e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA512 8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP 49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai
TLSH
T184069E20FB058176D8CB01B2A59D7BB6A47C9B31473440C361B4AE99FD712E32F39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devtools_resources.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\devtools_resources.pak
Size 1.5MB
SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
MD5 c3ac46f4cd5b964a270f1f2758f8e773
SHA1 c7f888725085c5b5069374639e557db1f1cef922
SHA512 07d7653a28b4dea51361befcc1c88b01a7c43ca25197cf300c314a8650d69acab936bb060e963041ac14bca31d1730268d53ca013676fb32f5201a97c4ab877d
SSDEEP 49152:UWTnZD7WUC15ShDmDddtZ3gyzzYLxVi0UiHkNOs1:HnZD7PjgDlZAniWHRs1
TLSH
T1AA752302B15A2690F012BC3B540EA93453F7CAE57294A5B1D68E2A773CFF81BB587770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

directsound.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\directsound.dll
Size 221KB
SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
MD5 0f7b6cb21b4e93caf046230c1a091a36
SHA1 9e9c761485a7594de547d527d9f1bfacfa702bf9
SHA512 4b2b12444a6f53cbd15549b9a971adc83fcaddd52de282b24dac4b628f1628e6cff696770d41b8fdfcda4db0c998485312e5389b3353c9383a800420448bcc0b
SSDEEP 3072:Y/X6+rZBE596vtGPY9eP4tdIsfn2SnDvq8rS/0cve8bMLAfKobRIYTh28c//dwBh:Yf6+rZB+92KPuLAbGk5UymR0l
TLSH
T18F248D017A9180BED5F60270D1AF749BE825172C17189CFB139C18F8D5A8DD7BEBAB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extgame.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\extgame.dll
Size 1.6MB
SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
MD5 4006f992b454b8a1f3ec7c440f0fbfd4
SHA1 a4ad2dcf1ebf04b4ec5e6586365c5ce8aa2ab2cc
SHA512 40915659c81a3faf3f5e167368f91fb989e0654cc1d2fd79c4fe13bd6a525b549814026fc7053c94f813ffd6fe6c115302bfd55071a59f1190cc7a893ced106f
SSDEEP 24576:OsJraxp5TNZpLduGOIij+0jeZsDZhozg/3fXj1vJxguA/l9fGH3if1Vs:OKaxHD0CeK0/3f58/l9k30js
TLSH
T123754B717706C575DCCE12B59E28EE4F505CEA981BB004EBB2CC1B5EA8B51E32E31A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00readme.txt

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\00readme.txt
Size 127B
SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
MD5 c75060e5255f8a3a07938a55c5b3d20b
SHA1 d786597681bc820488cd10f9d5263227ef5c09dd
SHA512 d53f2b4efa0ab9f682073d22656957471f42f2931db96fd2290a5125c1e8ec0054b9df1bcf1803fa7c26260cc38f8626a808c1fcfbc1d820b82eb9653d3f6c30
TLSH
T1C9B0920BF25AA075186D004B0546E1B33B7819EEA2D2841B628286DA020233BAB54D19
MD5 SHA1 SHA512 TLSH

Submit Download

albw.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\albw.ttf
Size 165KB
SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
MD5 510a06a2a3192f5b99f26c3323a50a96
SHA1 2f0ed7a97b31e15c6baf14f86dcdb74d1dda6da5
SHA512 ca8f6230fbae73648fc19690ea5307ff3f368119cf7aa13f5b2c214b30c83c772924bc4f41cb0986238be3f28b9266ffcf209ba8b0c785ce18970b78cccce31c
SSDEEP 3072:huU7GC2Q0wZ485NdsDSPneJL2iVsweQaU/HfiUqydCPMR4O:gQ0wZ485NdsDS/ecimwhlqodR4O
TLSH
T1BBF38D4FE252FD37E2A0613DD528ABBB1613BC1D536AC69AE58D0A6F84CEF204F14750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhb.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhb.ttf
Size 3.8MB
SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
MD5 ee060a995ae4fbd7f722646017560c99
SHA1 f6fc6770744a288aefd502b6e8280646b96da010
SHA512 b3f969311a21db77dc60cd9362cbeea422c4a6d3fb09b22190e65b62282288e0f93709659ed4387a2fbc104eb9edc83a04c1e972bbe6900682a72ae4ae58aec2
SSDEEP 98304:6unGP1IakNGkNbvK5ujgl7MK6oed9XnfU:6unfaVkNbSoUt56o29PU
TLSH
T14A069ED3CBDE9A1E11317C7D8500F09FB1C2C132072686965FAA2F3E540BE9A8AD7579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhgbb.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhgbb.ttf
Size 1.7MB
SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
MD5 824ba12e66960b01a30d52f7a30aacc2
SHA1 3e6f232a6aa6c11a0b13736c9308288000dafb2d
SHA512 abb8bb0153eb37e98b22c7b781d67faf7163b7701d180e4194d095d1914a3f8a593af2dc4f9cf58565d1ac9e00d7d980813118044e408477de24c93a7e43bfcd
SSDEEP 24576:zDvEYRHarD0NDay+AeveonSvltx0awmH757Xuh44N+seJEKuCMDSWgX5zMz0hJmU:3cvDGHBnKkH75m4Lseg+zU0T4pfU
TLSH
T1DF85BFD3CB9E9A5A91317CBC4900F05BB1C2C03247119AD71F7A2F3A540AEDA4BE7679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\Las Vegas USA Casino\icudtl.dat
Size 10.0MB
SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
MD5 bc7064ba87454ff6ae541132d6678c94
SHA1 ad0f0a5c7aa60e113706971f10b523c57e5ef075
SHA512 6899cb7ec0595e938f9efd6798b5646f5e4ca18ab257b57b8995e1dd2d152c1f7d355222ccf66e9a445997672f877cb0d137598020a0fd75b45743058dcb5445
SSDEEP 196608:a+wSv9AAQQ5EliXUxR0rHf93WhlA6tv1r:OKlQQuliXUxR0rHf93WhlA6tv1r
TLSH
T154B61742B2EB4DC1F9FBAE71D9F463639526BC05AE31815906042F3B5C773E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extgame

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame
Size 99B
SHA256 10c0f7136acfc7d53e888946dd9cbb5c37985b1a2663c5fac4f7ae7d6fc8426b
MD5 81891ae9cc87dad5fa4d40a9786f1b9c
SHA1 655c37bd100b96cbf263527b6e0bfe6261bc5ed6
SHA512 78c87eeced3c019c00e70d9e11f3da6dd30a120bd158626b50325bf19f15cf2fced6c0c713f4f6cee97bfb09894390d7bc59c06e38ae57a9bf8d0ae7407e5e12
TLSH
T13EB0118A02CB8320C8BC3AB20200330B02A8EB80228C0303022200202CEABC20B0202B
MD5 SHA1 SHA512 TLSH

Submit Download

Extgame.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame.ini
Size 743B
SHA256 885a92d105718d0bd6f19189548b2c8dca3838322497b66bace6dc92ecfb184f
MD5 906462d63bfa43cc0d99fa3d7901ac41
SHA1 bdffb2d74f45de8d2cde0159a99c1ab1783edf4c
SHA512 657600be924875c621f70479273d718b1c2c9018871a859f527766f54337d9436267b980deb5c235a3a82913d89d973bf3394be90c9f05c88a97674ba92a559d
TLSH
T194019C0312E98F5585BCD985B6523C8B126F9B52100EB01803F5B47A75D12B98BDB53A
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Fonts - Latin.ini
Size 605B
SHA256 1b54bf4ea654beb5bb2f598ac859240175accaaecc7ab4fbf76beb92ceed68d0
MD5 6d04d8fc8787d26820b1f6e85ede9030
SHA1 503972da0fe2f44fe76973381497c8a35252a9bd
SHA512 9b983a4968abb1b0fca95e627c72c9c59537f9d267eb7c073ed991f1a7f3ea0c7a88115ebec9d69e0ea8f304006d1a58dd7c142b8bb423109fc2c8c436082f79
TLSH
T1CEF0A20302FCAF19114598C1F1D35937E925D8D5A422790A5EA0B8EF05C516D42EFB38
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini~e9990b85f5cd97ad28cf2be6.zip

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Fonts - Latin.ini~e9990b85f5cd97ad28cf2be6.zip
Size 643B
SHA256 1c2359284527f2d850eb551cb974c74a8e2ffb6b8adf1b0d825220073c3b3e8d
MD5 5dcdec3a549ef2b7bb1c13283076fd50
SHA1 f80efac31f97d9e09875a615005b64336ced4d27
SHA512 6f76710085601176faca722434af68ad81744d40ce56da1eb5c032875d42305abd33fd9b83bf45fbc707b187211f0412ba1bd0855a932df74cda8ebc70c7a26c
TLSH
T19BF06241A067EE2BD4C7703133CD0964E7380028E2E98FC2D28200EB9D913B2B3BAC40
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby
Size 2KB
SHA256 3f9bcc074a0fe98a6fd617b57b983f186bd0284886313126da3af21401841dca
MD5 46664f623f8822b5be3a7e5ad5a047e3
SHA1 f2d78c50c52dd2c7a9eed4aa164ab53d9cdac6e6
SHA512 bfcffa1e4b6b4a1cd531ae88d21f98cb28e7e25a05f4903c6543691253c518af37589c953db967624ee06fba4f36effaa6abe633c5c49e21086d9de5a0620d4f
TLSH
T1F351E373B9046E96BC08933F52AAB2B74E934D983C7A3535D9620150047FDC360AFB8A
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby.ini
Size 24KB
SHA256 97af53d240382804349286b230e81c1e4f41e653351688bc7f6d4fc75096bf12
MD5 bd2763cdaa383e2a498bb3843768990a
SHA1 50b055178c06189635195205d7b3950e9972ad2c
SHA512 a85e1702a4e233d96a3a7f34bdcac5c0b8da2946d6bbd9aa97c40315962eb4f0098106362c4d9728fdb6f55d833043e62613f973d4cb1e9bf9f011cf77b0f6db
SSDEEP 384:AKfQf806dPeExlHdeEeA9a4mGfsFKrmSYSaF1DsZii:qsM/Sa4fsFKrDaFJsZb
TLSH
T1B8B2FF2360CE1D262B10C57CB5E07C5B3677E9022837740996AAB38E67A17FF45DF4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbyinst.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\lbyinst.exe
Size 504KB
SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
MD5 108cbf5d33ee178c900bec4056ce4891
SHA1 349e2e116f409f07ef0a8d1a41a42078c05f57e2
SHA512 d602626485c7b75ace34272a498c389df11d2d804547821ae5a9dd4e876ec8a36c2c0afa51084a8a8d2672a6103732999349ac111f12c5c000f7001d4f838810
SSDEEP 12288:7mUzrXwirssr+eA/sREmfw5viGqcxuJs7/vg/DCr8NBBXboO9:Lwiwsr+eA/sdIg/DCr8NLX
TLSH
T1D0B47D10BA80D032D67324B14AFEC5BE195C79314B1905DB77C80A7A9FA48F17E36A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\libEGL.dll
Size 305KB
SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
MD5 d333565fded30d59c53db71fc4f58068
SHA1 3d258ac779383248a538c7f85ae3b834605898e4
SHA512 9273431f417b4e37fe7255cddf5da855c582818b52207f160b84b6886079c77937ab853b281a772ff508b8522aab1288fab700e1c4dda17cc371f656968735e4
SSDEEP 6144:etJvzntGgCdDbvqb21v+bl5azaijx5dGKWjDKPvUCffBWoDcd3UMzgiz0B:eHvzntBCdO+2bl5azzsKWjDKPsYIoDcq
TLSH
T10A649E01B940C036D19E01347628E77D4E3EBE615FA1C9CBD7984ABD4FB16C09A39B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\libGLESv2.dll
Size 6.6MB
SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
MD5 fa78b488cf076522e1d0ab94a5f25f2a
SHA1 af11302aac45724c53f347de2f64a51fd301aeda
SHA512 a10127d72fe9ad09f30b1e6f84a0adc74c8d2003a5c0b68f59a0f9afff3765f2ff6d8ea0dfc4e618fff2d8d452e3ceca3fad59ba547eeba9ae4072d9e354a059
SSDEEP 98304:jBDaKvhQV6lJ5Z1TQjwWinEPRQMSffPqKQV2RP9lcKVL/ymJhGFO:jBD/v5Z1TQ1inEPWMSffPXRDwgG
TLSH
T1FC669E01B180816AD40B52745B2EB72DAF789B571D60CB47EB9CBCA8BFF1690264734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.dll
Size 2.7MB
SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
MD5 949d0b0a8defcaff5fd3cc3253aca141
SHA1 4481f1cb3cf1d31a6be9a8d15abc701d67925618
SHA512 bad91f5048aba49d532c8f57bf42dc18bf0542d27d3946ab0fd325c6b17665c61ea47c6322634886f38ae82e56e925b0777a6d5e3385ab9f62250aa1826c65ad
SSDEEP 49152:0Ta8iZ+hgOz/YvQOl5qtAN0AvIJuzKRLVrqqV5yu76lBdH+cH5ths8sz0tK/uQxT:0Ta8iZ+90vBuAvIJuzKRLVrqqV5yu76t
TLSH
T1DBD52A30B215C13AD99F01B9A96DDB4E5029BE741F6454D3B2C85E3F697B0E32E31A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.ini
Size 6KB
SHA256 baa6bc8b9c86ceec4bceee7c10b0e0ff4f84608df580bdb9a9e665fc3478c723
MD5 2471a5b80a9d944a07269bf36058149a
SHA1 e437d07e920f4c6264feea002b73ef32c8e4be06
SHA512 60695598bae6bc8f63d5584aab0302b076cd43ab7be309511e9a46928c33f470d072db9db4bd2d997e0efcf3901170ec7f1803afd0d2755d3f0f250ab215c380
SSDEEP 96:iut1L2aHJNP9MS7TRsq1aVW1W6WQWOWaWY2/EcuguUUt74QUUG4QUU4yQuvQrRpy:iYL2aHrPWS7TR8W1W6WQWOWaW3spy
TLSH
T14BD10B1D930A963A878B5B13EC5BB0696BF941C3D4026102B85F05C9FBDBE525ABF307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\locales\en-US.pak
Size 219KB
SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
MD5 89a808057821042f7cb0b0200dd944d6
SHA1 6ad54a17fb954aed628920682dbe79cc192177ba
SHA512 45564bcdcb6e9062d861c7eee2aad5b262242f49ccf3b75c0a49f6cf84cd4f903318d53353efe84fc4737d5658384e045a8c9c66b7601cfd6579df271ff35513
SSDEEP 6144:st49es49j2ttM89ehSmCWfaYhf5Hx+AwL:sGeXifMWmCo5HkAwL
TLSH
T158245E0FF788223A069352627F0962B2FB35D05CA36126563CAD811C3377B69D2777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\msvcp140.dll
Size 445KB
SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
MD5 448b345bcac7ec3729f291229c942060
SHA1 5813e35f62f3c670d02cf18dfa0dca523108660e
SHA512 72d01d35716ad9e1fde5941854b811765479c73a7a3cdc9e3fefcd3a6aecf68657354599b5cd18e67c8b1a61a3d5756ae83b13963c08e7bb638e415236c9d136
SSDEEP 12288:xltXrXT8sqcLNvDbiv7TlkWBElGuIMyYehUgiW6QR7t5s03Ooc8dHkC2esrMnUv:xfXrXTXLNvDb0TlkWBElqYd03Ooc8dH4
TLSH
T195A42832BB4609B2E59913B971C9472297F9FC210361E3C39BDAF0292F656C17733A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\msvcrt.dll
Size 260KB
SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
MD5 0b9c183d1565b48fa6e5d1d3d4b86bcc
SHA1 69697324c1e7ad80215fb07ecf6d786e378c568f
SHA512 c836a4789270b216f8505074ce34b11d0b509e14b25133f3aab8db55ba5451e150b6633c4392cc83c1007f64da1c824596ff4a77aab5f7d340be4f631b2935f8
SSDEEP 6144:yncoHbacxB5pdVEweKMph18/VhTORAeFMWiFaNF7R5LWCC0uOpL:yncIbac33dVfnM2/Vg/5Bhum
TLSH
T15744BE6239C1CCBAD1E241B80D973F3E8BBE99614032DD83DBE45ED41F20992A75B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plibc32.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\plibc32.dll
Size 537KB
SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
MD5 0be09294cc2e30c10496717434f56135
SHA1 8bf0a2f558f58d671d30bfd7430dc20c1ddc77cd
SHA512 4250ced1b4d0c72a236fff658faa7d92939620add56224c2d44661c945c5e60aed8a02e97549a3c98b1d868fea07688eeca2308e725f8bfd202aebd9539c4b29
SSDEEP 12288:VqPpwewCY83HElJMcED2T0euWHsPu0IWtY+GKw7qSBj+:VGpICV3Y0iT0eu8sWspy+
TLSH
T124C47E10F201927BEDE701B7DEFE257F692D6710032919D792C828999B6A6F37E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.usd.rsc

Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.usd.rsc
Size 18KB
SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
MD5 a194baeac2b922b5c0c84e457567f244
SHA1 d9bcf55a740e71c65e932de518eea3f2e973139b
SHA512 6cf16d2dc12e09ffb5fa692c67126b1d45b6116c9b1f6eb1d28c8b2cbdf814b9320b5e260150af7f113dfd90dfdd5faf40b3f9459d9a691651241a23c8ad5dc5
SSDEEP 384:pfUZAq+GDYTNNVGu3WZOF8WM7A4eNEfUZAq+GDYTNNVGu3WZOF8WM7A4eN7+:pOH+GDYT3335lN4euOH+GDYT3335lN4B
TLSH
T143829D0F8A23B0D43AF6B8AE84D7C4CA6928D75649D8403F3F144F8D92E27E850F517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chips32.eur.rsc

Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.eur.rsc
Size 239KB
SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
MD5 d46a07ebec5608c61687617d4fda3034
SHA1 657d58e434b38ae2e3492d0ebf572e3a3430d52e
SHA512 02604d3f9e3cc0665b508a4253d38170e7b034a463a4f1cdcb6b8b09a6ea38e00f0f7d20507811987cfb233d992327d539d02b12a2804d64a02c1bdafb6e49cf
SSDEEP 3072:ykqtJXvilrCSxeqN39UNKqPLqWFVtXBurr5jK1y6u+7nAkL:ykkK9CSfNU7tfxurtK1yYMkL
TLSH
T11934D0AF9AB0909FF99E75310DCE0202E76933BC8A673338A4C169DE4456E0B7F550B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redirect.html

Path C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
Size 236B
SHA256 3eea035624f3025a4ff987ec22d9d88d66583db86c5e4c3cd3b78efc5ec7b196
MD5 31b6b6784e0ff810aea692f45639741c
SHA1 da985a365876f5630ffb856beb889d71b963ea05
SHA512 5630c18052871804304ca3de907ec19bb10aad42450f670d70969d06a41e0662e558fbdf52533e4209095ce9e16d00e9767213748e124874c7001e5e73470c65
TLSH
T11DD023FF90D45C452771617465D273C804B354054AD658B6D1E4D63F565D312EEC70B1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f3f5bf00548fc8cf496bab8daadbe072c0eac5ffa629238a1ef59d4d77b343ce
MD5 3068741d013a6f6a5ae76804bf7fc63a
SHA1 ec3ceddbc45bcd8f388e2c8dea0dcbb71d439cc9
SHA512 123ee2f0a0f4c48fa45d26884cf4dbc06eb80858b53d10ed86b7c375871a7529b5bad06e55295f59ab4d5b7381c312e5898117f4d5ba31d0366656093cefc2ce
TLSH
T10CF0F4B9DD21AC3B18FD1B3960950B46F760236B2A459C4B3B3E820C8FB063B858582C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a2b9afdd36db2c83aaadb43f7c7b59ea4b7f437cd9dda240d282450bc366b24d
MD5 a7cf277711e5998001df74ebff5418cc
SHA1 26a5e634264ab62d1a5a128eebd55358ae57fc9c
SHA512 6325f85de396d8a9a5980ea7b22b33d57b9db97b2e5793f83791e0dd124396b3856d9398a9a597e93b01c994ca40a1d00cfab9b79972cfac06f5354895c9a0f4
SSDEEP 192:sxZkRJjG/frsyaQZLjf8czodpH3THW6+WNGYoW2Sz+RIgjteJ:sxZkPG/frs7OP0/jHbGJSzajtq
TLSH
T1B542C615AD28A93B5CC7D219FB557F52E3F9103390950E84AAFC8B2C19EBADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c692ccbf58b41a51a1ba014ffd681e7ac21855b0c33588cad6a7360aa4b63b75
MD5 690511d6f49df2a3f08440ae0a2ef580
SHA1 eb58a29b190cb55fd5675bdab82c3c0ae135a30b
SHA512 09e4830903370823be070f2eabf77959ba2ad091e217d74920cf89e6cadd91c809c5f42b18de83194fc3d7a979314f37e809a4ec50a3006b573cd501fbb602c4
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jai1qpLd4jjog
TLSH
T121E2E97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 0f84d2551b6ddbc3f4bc5522e4bbd916a23245be2ac60dd647a1a48b1f2d38c8
MD5 1855ba8a0fa44ed678124dc5818ea457
SHA1 f109f7516553739e665a6cdc3527d6d9ee690898
SHA512 35828c82a9e2c20055a93e064bbeda9f542a5f42d6ef812c7587aa789bb0cdb426e5632f5ec0df91a594de837f032a4bcbb5dad58ac0b6a89b7aa3735d9b5fa8
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgG:ST/2dXOJhJlpfnpp3tNXVrN3mFDMJg
TLSH
T106B22E1571BB425039FE291891B58B2E468231B33159E62F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 736e5a2cd7ff08fa61ef34a568dcd2b12765058f2299cdf0ff477015330bb201
MD5 d83b00d34f4c3f322b974492b83eddfb
SHA1 b396166e2df0d5dead3f41a117ad241f400bf0ee
SHA512 57557fbb0c0e83da8e934d3bed7e529795df3b0beb567df423f7ec6ac453f1573276dcb79aec4475f9e1be753a612f17b2cdadbefac4eb370bf6bc5bf6e9aab3
SSDEEP 384:nWiFiZcI63sNB8TUNTUlIm2aKMiJ4wzWfLBCUz5o+RY9Fhsa+VY68gL/7IzVoA:9FQ63AwgcAHEBCUy+RY9FhhgGP
TLSH
T10AC24A36EC98D9ABECFA4FD5AB4A7A03DEF41163959C9AC4DAD85D1C008359D0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 44027388d11b5b497241c21f4c8ec9cbf27d0ab545ea435559100431963b9ede
MD5 b233e2284cdba507b3cb6538a3a993eb
SHA1 9fcf24b09630f22e821a1bdb536f5364ea10f0bf
SHA512 248838afd3716bdf4062cd517f8238797e98b41c745dd01e8f8851a58c917a7b7fdd4111b598a9d6e03b6a1999b0dbf35819cd908715ccfc0796c25baaf4d715
SSDEEP 384:n1iFiZcI63sNC8TUNTUlI42aKMwRYuwzWfLBCUz5o+RYoFu7iOjsa+VY68gL/7I4:8FQ63vwgGQ0EBCUy+RYoF+iOjhg9P
TLSH
T1BAC23936EC58DAABECEA4FD5A74A7A03DEE41163949C9AC8CAD85D1C00C759D1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 525b8fb3f69176689b547829c24ad39b395fae97bcbc1f864cee2e2eb94ffb23
MD5 10e27289f4025e5c0e2c13fdfdaa5bdb
SHA1 0e519bbbb99c396f82a139b8b78f6f556ed655da
SHA512 a59afe4524b306deb3c1a69ea184f25b28cc5e1afbcbca2498d33fb4530b6a2c4a9e1990c6f4be84116a62db3bea67c6b2a5c4678df2f9935b0ba4d1b99e26d1
TLSH
T13041169CAAED1148B377AE5AABF6A96D483BBD332E06D45D00110E4E0A33B40D971737
MD5 SHA1 SHA512 TLSH

Submit Download

package_list.ini[1].crc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\package_list.ini[1].crc
Size 24B
SHA256 8830b915d334abd93775e4c458402ec608a9a3c58f6da43e9324bf5fdb7ea1e1
MD5 705f36e0d7aa042633ab40ee71ad1e96
SHA1 85ac21536a59bb988329b963f83dc0f6f47ecae1
SHA512 9dffd49d18c9b3256de3fcc69c7bb2646d164a5c3cabbe7d6a0fa58bfbe4cdf9fe60d13558d75760f6f0638464d0e386260e3184d314e4be54d737c87aa83d14
MD5 SHA1 SHA512

Submit Download

MSI8A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8A2.tmp
Size 1.3MB
SHA256 4fdc16bc2474d2e84c297953d47ba710e8517b059005f75782c516bad9b78c71
MD5 cfadaab7110b85035cac9aa747ca8aa2
SHA1 7a3e56f60430e6634f1990eec6846de78f257552
SHA512 5f0bf7f3aa1e149baddffb45e66aaa75eb02ab0ddee8abb6e0e41d935b3d2ecee63aec8e0dc64f2669013c196a0f73e1e17feefd41f852a1803b18ebbd53c4e1
SSDEEP 24576:pZtTJNSLh+Lmk2GX4gDFQnet86s8n4ffdcd3+bIZlfhUZPYGkQgJ:pZtTJghSjKettDnRckvJUqGkQgJ
TLSH
T146551241F7C3C9A1C44D0535985B63FA4FB06C4AAE23A39B77993B2EBE72385BB40154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is6E70.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6E70.tmp
Size 286B
SHA256 ba987f1e7eae22291a023fe19256095122ea284354a9bcc30f12042b9a5d40dd
MD5 02b1283ad1a49e41f92304b627687d44
SHA1 f0d045dfff81e8d0b2fd162fd45e78571f10fcaf
SHA512 214d2902a6b1d4ee4568f296ccc02ee22af9d065acd1ff004f06d2e535ee694a1395f3da4ef057fa719793123215f74bcc4db78bbe18df3531f0eae22cbad161
TLSH
T13CD0EBC8706D0B08F4668271C7CC04E406F0BC3A162A73AD02C079044400D6A3323E38
MD5 SHA1 SHA512 TLSH

Submit Download

_is6E90.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6E90.tmp
Size 176KB
SHA256 43d9c8f2412012da74832249c54e179cbdf93bb075b85650e9f93937051ec7db
MD5 f4b1fa282c1ca7420df7068e47b69c0e
SHA1 0af872d1b6c8745530cf4cdacadc4364775e50cd
SHA512 df908aec077b6dcca3fd9eb2aa330c540a34e0843f034cf944dd10a2b76d63ca7afabcb1d272d0a4cd2f9b1eb45719c6dc246b3be9b09d90ba4c0130aecf53a4
SSDEEP 3072:0KGhuKr8IO2tV1uylt4c2UlwJ997Bi8WJjkpFi5wWvYMh0FQ3LG1R49:HsuKrGNj1V7vW1YijpKa3eR49
TLSH
T1E30423D87ED454FC0F6C9986C0E22B119F06C7E9D6A02A1A83F677469FD1B73C80A749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is6EC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6EC0.tmp
Size 250KB
SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
MD5 7e3602d08b22debf43e6258b02696f95
SHA1 8748ed67facb6377df485d00e10882ab6b7a6528
SHA512 3cecc3934f4b62482dbb7309a0f708b29d0b80539a9311bcd325cb62fab3a8e560079d0a4e3f23745486b41ef6ae365064d3353487baa9f9e7630bbb156811cb
SSDEEP 6144:oIBXRBD/TYBYIqR8qJWDW9z4+xbOSc22vts3VlP2U4tS9s1:h/GZDWG+xba22vUtTk
TLSH
T13F4423E09E1F910DEA611D4F6BDF46BCC27C3EBF69202C12E513E983166416D817AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is6EFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6EFF.tmp
Size 50KB
SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
MD5 d718690b4d422351afaad30fb5005958
SHA1 f2405024c9f0c8b8ec8680d36b76f2a2fe1eff50
SHA512 6c4d324c654649df9b6b427f3fd90eb28a6121f84574a78e87db2c8b9421da19c84da6a94fb0814d46f023c4d395e010bd5c6974c82c911e154e413c910c6dd3
SSDEEP 1536:orrmXs49qNUA7gwZwi4wVZ4gq0UnOsf1raUXlI:orSVqtzdGhn1f1plI
TLSH
T1FF3302C9A43975DD5886AEA7828E33D1F18B408C71D4EF4B93FC2562904ADE744F2CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is6F00.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6F00.tmp
Size 113KB
SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
MD5 b744f334a4db8788a3eeb1430cf48d98
SHA1 3778f36a74afc672b2d85e2caac61f6981b5a9ae
SHA512 596c086bcaa0ccc0f6d4ae65bf49ff8120650d6c8c7766d265be564520398b9ab29795bba46d6936d036b44166f8e8ee4f4363399299225c494c9e29f28f2358
SSDEEP 3072:vEEw9tYANVpotzJ54OFxPmkwhaavfdf2Uog+6neZt:8pHdNMtzJ5TFYkqaavfdf2+RU
TLSH
T1DBB312C86BE37A1599192FF0EC2623DFD11C428AB8362AF5462C47EA55F114FB07BD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is6F40.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is6F40.tmp
Size 24KB
SHA256 078f6a23484ebed7946effadb51ca0e2320554a467e30b9243f2b038f6f15295
MD5 7f29ff99e9c956fa6a42f972da217cd4
SHA1 61fcbcb433f4a6a5e7bd8ba7a106e1614f1e2e23
SHA512 aa19e8dd535ccb322665760acda23ac158b2ed2023806faa5713dfb21f0a8cb715e70f0730f0ff886b587e9580a249783f13d908c0b0c942ddd06b9942f1fd63
SSDEEP 768:3olCJwzBAYtDm52A8iYHhtlsNpJi3VejuQHGJ:IdrEg3DFejOJ
TLSH
T1B0B2E19ED7B24D83856984C8503B7307A69E2F1F6F56139B0B4B3E63B8D48633D90287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isD9E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isD9E5.tmp
Size 1KB
SHA256 b89eb993caae5618f0a2549b1d66561cda37c86266fbb766762f686d89e6219c
MD5 64251fe86b41f8dc92a3ed82e5a3bcd2
SHA1 10825cabc2c6596487d5b498c65d2965b3503ff5
SHA512 c903a05616a472540f2468c610fb9482407bf7a798b27ee5b259992b014ee98c555b8a90549c4a41118f1dc8638cd48aeb44cdce12aa99d23aee79ab961e37a1
TLSH
T12C312943DEE62446D8056789A75D018BF58F92C0A26628714CFCCD490D787A9968FCB7
MD5 SHA1 SHA512 TLSH

Submit Download

ISBEW64.exe

Path C:\Users\Admin\AppData\Local\Temp\{C2D6A31C-04AB-4D2C-80C0-F6C5BC0DDD33}\ISBEW64.exe
Size 104KB
SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
MD5 b83d2774cdaf5016cd8765a630fa1150
SHA1 50b7f86488926c6b06322af6a5176e4c7786058d
SHA512 90fd6c47d658491acfd54a1cb7d76bb01c3e6f58b4df4466998411d73e497a305dac13798182448289052f836c92958ca42b69bb14549d51aea4a0f92e665727
SSDEEP 1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
TLSH
T1D8A3295B77A4A0F5D026D27AC9929A85EBB2BC601F6103CF2721A39E1F337D15D3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.dll

Path C:\Users\Admin\AppData\Local\Temp\{C2D6A31C-04AB-4D2C-80C0-F6C5BC0DDD33}\ISRT.dll
Size 258KB
SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
MD5 3795427182d2dc8ce5609a342bc65313
SHA1 0e53a85d991526a9191d3b0f3007363b3649faf0
SHA512 6c3669b38b67ee37d99f452ad6b0f58102fd0db952e9f146b8e0ec409ce5bc61052d4cdb23c2eed4183b18baf529c86ac95bae420a90908d58d5f4399b0e1b76
SSDEEP 6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
TLSH
T15F4423A3BD494D2DF8864F3A37BE12B4543C3D367E605C13A021D9934FA076811BAB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isres_0x0409.dll

Path C:\Users\Admin\AppData\Local\Temp\{C2D6A31C-04AB-4D2C-80C0-F6C5BC0DDD33}\_isres_0x0409.dll
Size 540KB
SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
MD5 25f79c8f92b15d20d57142d27b43d45b
SHA1 4f9f50ee529ebd0b9e5f81958dfd33a5c3c912bf
SHA512 c989c69be10a560dc725c4433c48c6099da892b0ba21f90e5f9f4a68ce8c3cb630a9ea548da9781d6862d2c3408273987764e351598e614dbd6c76a90ea9e0c3
SSDEEP 6144:hhs4d9dcOaOdXGJ3hskkkkknffCp5CrRKlua8AHqPK8:7s4d9dfaOdWxq1qv
TLSH
T1E0C47000E6E5810EF2FEAB7498B21BA54EB23C519B3486FFBA95711D1471AD09C31F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{EB7EDC58-3F29-4F3F-8C25-04BB77459187}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{EB7EDC58-3F29-4F3F-8C25-04BB77459187}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

IsConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\{FB69A2D7-3793-49EC-9BEF-3184C60B4EBF}\IsConfig.ini
Size 518B
SHA256 2eabee26c71bbad0f0efb0ea36c1d5381b64ecd20ebd4f1999255ecc9cb797be
MD5 7f22f83b30788cc4ed52cbd931fb8cbd
SHA1 3fbaabfae3cc53247f216963e3184d218db8616d
SHA512 4b273821e07b85ffe8911d6e06a4dca8d51a1619a272422bf42ca8863ed28d02d08ba1de1b25ab0a598d2b388e46072f7b2dcc52c210b7756fbb1543149c25cc
TLSH
T1A7F0B49B3119F2BA642B9DAB993F01FACA793844075381455631AFC85EB023F02CEA08
MD5 SHA1 SHA512 TLSH

Submit Download

String1033.txt

Path C:\Users\Admin\AppData\Local\Temp\{FB69A2D7-3793-49EC-9BEF-3184C60B4EBF}\String1033.txt
Size 172KB
SHA256 3006a59097077018878e6eb4b0afb5e56bcb37965e91cb366d165e9d342aaef3
MD5 852f1c923127e6484c5c03e9a7062f7e
SHA1 2daadd0049b6bb8ed8b6ab6b1adf9282aa5ecd72
SHA512 da221e7cfc0c7a06299565754d6b2dac951a546aad221d672356df61388ccf56bef214137de5e8b97c22fed13558c89555e0e8e54f2c6f86d5822c0e80eeb652
SSDEEP 1536:xuOLR6/K41VBrChTHB8WdK2hWA/z+wKZU6rPsHnQvvOuyMJice1VOL27pr:xJLu1UTh8uW9toeC
TLSH
T1AE047C56B7F90218F6F3BF95AEB550649E36BDE6A83DD21E1180100F0AF1E4099B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\{FB69A2D7-3793-49EC-9BEF-3184C60B4EBF}\setup.inx
Size 271KB
SHA256 f254f723c28966f4327d37a5cb7b2d90a6ba05629485da35af1d66e6751a1b4b
MD5 fd7613d3d1e90a4427a5906b9d18841d
SHA1 62f253ec3c1a49d1b9659a41b69cb47b0b6b61e4
SHA512 d8b58b16d84dea5c3e9a90d525896e95bee3063c4ac139b4acb52966daf608cea2cd262695a3a5e1d1c85d8a905a0d2206b262c6ef6f3b156cc02e88aa7c3061
SSDEEP 3072:jWFzV61s2ENzP53up64FxygQhkvVaklSa3JJxE6xycLQ7BEjOFPbCwnGziqWGFgg:jcp61VFteIEeycQE6ZCwnzqWkD1qUv
TLSH
T11E44AFAC8D960F8EB7288AEAF8271CD035C1EC4DE1B545D7A3A2C5D08F794F941DD09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~D9D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\~D9D3.tmp
Size 5KB
SHA256 ea2632626267dbec4cb70943383edee30f1a370bbb6496468ed921e44d0c5a8e
MD5 1f66ff5fa8f586dbad86024b7cac018d
SHA1 a56c3e335bcae8ac1bdb3ac926b88d2d65c84a70
SHA512 0ee4e29b0e57f610d7b1121af99accb1f6c6236bf4728c4d3d104a076341af4a304ef32108a5c7950c93d74231ae05e7d90af0ce347cc30981522d4c4a0174d5
SSDEEP 96:rEhkMDxOslsT5Emqn0ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYO7:YhJxOsls1WXcuQaEZhdxoIWRGcQbPr/v
TLSH
T17CC1BD172BF6111EF6F35B49DAF1043797267C11282CCA1C55E1435A28F2E828A27BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7249.tmp

Path C:\Windows\Installer\MSI7249.tmp
Size 141KB
SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
MD5 cf4b14337e2a58317d69079644b980ee
SHA1 de92fac8b7b49286b1be44885db3043a9806fdb8
SHA512 b9a135220b3ff77bbecf1bf3593fd326229b8ae47c7db0ad5ead1887be03eca533992e09cd57c771fa20616ddd8b72b2eee0a5b05d8a63df64bd4ec4992fd637
SSDEEP 1536:2v7QNZRrFws8gty+zEHX3TqYWaYprUTzFeMxRkgWGcRiBwc3y2NgnVCUv:2v7QNZRxws8g9GgRpr6bmGNuc3yQav
TLSH
T113E38E51B9928071E68D167D2879AB39AB3F9AE5CF208EC78324CD9C6D307D19D39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF076.tmp

Path C:\Windows\Installer\MSIF076.tmp
Size 2.5MB
SHA256 fa60bd473c72cbd4d297375b4d20c77c2f943055b88663229165620d3c40f0d1
MD5 9e39498aa0cdffef045ad61d003557c5
SHA1 2ee1f47ed1b4c58d913814f1af78418bec549538
SHA512 e5f45c1fd876021f6c26d828e42fb6ac70b413c595b9c093252ee32e95ade0042de6b1d5d32b29a2e23e89afdaedd603b65319ac71aa826e556d67bd82d5ff87
SSDEEP 49152:iP643xZw0YyiIRZfH1q7qtkoShSdLet0Dn7fBWkU+GkQB:W3xzYyi0ZfH1+Mkh46tcnTJvGkQB
TLSH
T16FC5E081B6E281E7F06601302D5677366BFAAC51AE11834B731B7B5C2E333907A697CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-798-0x000002040F2E0000-0x00000204102E0000-memory.dmp

Download

memory/1144-172-0x00000000035E0000-0x0000000003686000-memory.dmp

Download

memory/1144-511-0x0000000003270000-0x0000000003316000-memory.dmp

Download

memory/1144-443-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1144-472-0x0000000003770000-0x00000000037F9000-memory.dmp

Download

memory/1144-514-0x0000000003780000-0x0000000003809000-memory.dmp

Download

memory/1144-142-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1144-485-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1144-177-0x0000000003710000-0x0000000003799000-memory.dmp

Download

memory/1144-469-0x00000000032A0000-0x0000000003346000-memory.dmp

Download

memory/1884-70-0x0000000003FC0000-0x0000000004066000-memory.dmp

Download

memory/1884-69-0x0000000003FC0000-0x0000000004066000-memory.dmp

Download

memory/1884-90-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1884-39-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1884-121-0x00000000041C0000-0x0000000004266000-memory.dmp

Download

memory/1884-126-0x0000000004270000-0x00000000042F9000-memory.dmp

Download

memory/1884-120-0x00000000041C0000-0x0000000004266000-memory.dmp

Download

memory/1884-75-0x00000000040F0000-0x0000000004179000-memory.dmp

Download

memory/2544-422-0x0000000002AF0000-0x0000000002B96000-memory.dmp

Download

memory/2544-425-0x0000000002BE0000-0x0000000002C69000-memory.dmp

Download

memory/2544-396-0x0000000010000000-0x00000000101B4000-memory.dmp

Download