2d9d38a58e52ff332b519b523cb4ea70e3060fa560b3d9cd0af2491c12aefa40

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe
Size 1.2MB
Sample260919-2d6ansyyat
SHA256 2d9d38a58e52ff332b519b523cb4ea70e3060fa560b3d9cd0af2491c12aefa40
MD5 a161ae882c60004df83c83c333712607
SHA1 640eb2b40086a9b7d3f35f76103799dffcb26f24
SHA512 a1952b9bc1b29ad39f4ee82ca10f039553ce38ec141b8df80b4571ab42daa0a21fd9f2fa5cfa6d7861fd8e430b70f7c35754a481f709b9c9a8529ebc70ea2979
SSDEEP 24576:YxNlFSIthzcjw4hfvyERsHo0VxvkTbFB7QWYy:Y7KIzyhh5Oo0wTbFVZb
TLSH
T1B5455A1376C1C03FE2B215728C6F9EB846A17D275A30451BB594FE2C2EF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4936	ISBEW64.exe
5908	ISBEW64.exe
5892	ISBEW64.exe
4864	ISBEW64.exe
1344	ISBEW64.exe
5264	ISBEW64.exe
5020	casino.exe
5316	cefsubproc.exe
5368	cefsubproc.exe
5032	cefsubproc.exe
3440	cefsubproc.exe
3304	cefsubproc.exe
4288	cefsubproc.exe

Loads dropped DLL 64 IoCs

pid	Process
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
3148	MsiExec.exe
3148	MsiExec.exe
3148	MsiExec.exe
3148	MsiExec.exe
3148	MsiExec.exe
3148	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
912	MsiExec.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5020	casino.exe
5316	cefsubproc.exe
5316	cefsubproc.exe
5316	cefsubproc.exe
5316	cefsubproc.exe
5368	cefsubproc.exe
5368	cefsubproc.exe
5368	cefsubproc.exe
5368	cefsubproc.exe
5316	cefsubproc.exe
5032	cefsubproc.exe
5032	cefsubproc.exe
5032	cefsubproc.exe
5032	cefsubproc.exe
3440	cefsubproc.exe
3440	cefsubproc.exe
3440	cefsubproc.exe
3440	cefsubproc.exe
3304	cefsubproc.exe
3304	cefsubproc.exe
3304	cefsubproc.exe
3304	cefsubproc.exe
5316	cefsubproc.exe
5316	cefsubproc.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
2648	MSIEXEC.EXE

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2648	MSIEXEC.EXE
3	4612	MsiExec.exe
6	2616	msiexec.exe
7	912	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\D:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.php.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino32.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.bd1.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.twd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\msvcrt.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.krw.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.try.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\sounds\cmn007.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\CURRENT	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\_patch\package_list.ini.crc	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_3	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.rub.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.inr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\exit.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\lobby.en.st.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\winsound.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\3b029bf3-3ffd-48b6-b824-f66cb20a7afc.tmp	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cef.pak	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.jpy.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.nzd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.zar.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.myr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\DM-FeatureGuarantee.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\directsound.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\libEGL.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.en.rsc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Visited Links	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\000001.dbtmp	casino.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cef_extensions.pak	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.try.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino32.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.ars.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.cny.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.gbp.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.mbt.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.cad.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.eur.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.usd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips.pen.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\MaxPayoutInfo.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\quicklaunchtrigger.33.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\swiftshader\libGLESv2.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\lobby.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\plibc32.dll	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.myr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\options_new.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Code Cache\wasm\index	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_0	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\data_3	cefsubproc.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.pen.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.chf.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\sounds\cmn005.wav	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\casino.ico	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cef_100_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\rsc\lobby.rsc	msiexec.exe
File created	C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\MANIFEST-000001	casino.exe
File opened for modification	C:\Program Files (x86)\Las Vegas USA Casino\cache\Cache\index	cefsubproc.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB01C.tmp	MSIEXEC.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F58.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a2f50.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AFA.tmp	msiexec.exe
File created	C:\Windows\Installer\{f1f75b50-c5af-446d-ad5b-b11d94445775}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI911B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF43799C297FAC7808.TMP	msiexec.exe
File opened for modification	C:\Windows\	casino.exe
File opened for modification	C:\Windows\Installer\MSI28B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI939C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF508F0011399D3A65.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1292F33292905171.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{f1f75b50-c5af-446d-ad5b-b11d94445775}\ARPPRODUCTICON.exe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343306745886565"	msedge.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\403D11E862CAEB749A41C189E1E04FA8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\LastUsedSource = "u;1;https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\ = "URL: Realtime Gaming Protocol"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\PackageName = "Las Vegas USA Casino20260905115826.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open\command\ = "c:\\program files (x86)\\las vegas usa casino\\casino.exe %1"	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\CLSID\ = "{152FF6CE-256D-4393-AE5F-0A5853975C6F}"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}\ProgID	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}\ProgID\ = "rtg.lasvegasusacasino爀"	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{0C70CE9A-F121-49C2-A751-452EDAC4AB54}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Version = "2584281088"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\DefaultIcon\ = "casino.exe"	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL\1 = "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open\command	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{13203B66-B358-4DA2-9C1D-1D257C1DE85D}	cefsubproc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\05b57f1ffa5cd644dab51bd149447557\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\ProductIcon = "C:\\Windows\\Installer\\{f1f75b50-c5af-446d-ad5b-b11d94445775}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\403D11E862CAEB749A41C189E1E04FA8\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\DefaultIcon	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\CLSID	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\URL\SourceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\URL Protocol	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}\ = "Las Vegas USA Casino"	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}\LocalServer32\ = "c:\\program files (x86)\\las vegas usa casino\\casino.exe %1"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\rtg.lasvegasusacasino	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.lasvegasusacasino\shell\open	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{152FF6CE-256D-4393-AE5F-0A5853975C6F}\LocalServer32	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\ProductName = "Las Vegas USA Casino"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\PackageCode = "C546AEC4B460E9147BA9395CC565033D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\05b57f1ffa5cd644dab51bd149447557\SourceList\Media\1 = "DISK1;1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2616	msiexec.exe
2616	msiexec.exe
5316	cefsubproc.exe
5316	cefsubproc.exe
5368	cefsubproc.exe
5368	cefsubproc.exe
5032	cefsubproc.exe
5032	cefsubproc.exe
3440	cefsubproc.exe
3440	cefsubproc.exe
3304	cefsubproc.exe
3304	cefsubproc.exe
4288	cefsubproc.exe
4288	cefsubproc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2648	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2648	MSIEXEC.EXE
Token: SeRestorePrivilege	2648	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2648	MSIEXEC.EXE
Token: SeSecurityPrivilege	2616	msiexec.exe
Token: SeCreateTokenPrivilege	2648	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2648	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2648	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2648	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2648	MSIEXEC.EXE
Token: SeTcbPrivilege	2648	MSIEXEC.EXE
Token: SeSecurityPrivilege	2648	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2648	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2648	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2648	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2648	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2648	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2648	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2648	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2648	MSIEXEC.EXE
Token: SeBackupPrivilege	2648	MSIEXEC.EXE
Token: SeRestorePrivilege	2648	MSIEXEC.EXE
Token: SeShutdownPrivilege	2648	MSIEXEC.EXE
Token: SeDebugPrivilege	2648	MSIEXEC.EXE
Token: SeAuditPrivilege	2648	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2648	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2648	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2648	MSIEXEC.EXE
Token: SeUndockPrivilege	2648	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2648	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2648	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2648	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2648	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2648	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2648	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2648	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2648	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2648	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2648	MSIEXEC.EXE
Token: SeTcbPrivilege	2648	MSIEXEC.EXE
Token: SeSecurityPrivilege	2648	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2648	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2648	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2648	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2648	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2648	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2648	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2648	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2648	MSIEXEC.EXE
Token: SeBackupPrivilege	2648	MSIEXEC.EXE
Token: SeRestorePrivilege	2648	MSIEXEC.EXE
Token: SeShutdownPrivilege	2648	MSIEXEC.EXE
Token: SeDebugPrivilege	2648	MSIEXEC.EXE
Token: SeAuditPrivilege	2648	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2648	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2648	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2648	MSIEXEC.EXE
Token: SeUndockPrivilege	2648	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2648	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2648	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2648	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2648	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2648	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	2648	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2648	MSIEXEC.EXE
2648	MSIEXEC.EXE
6096	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2648	MSIEXEC.EXE
2616	msiexec.exe
4612	MsiExec.exe
912	MsiExec.exe
3148	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 2648	6124	2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe	88
PID 2616 wrote to memory of 4612	2616	msiexec.exe	90
PID 4612 wrote to memory of 4936	4612	MsiExec.exe	92
PID 4612 wrote to memory of 5908	4612	MsiExec.exe	95
PID 2616 wrote to memory of 912	2616	msiexec.exe	96
PID 912 wrote to memory of 5892	912	MsiExec.exe	97
PID 2616 wrote to memory of 3148	2616	msiexec.exe	98
PID 3148 wrote to memory of 4864	3148	MsiExec.exe	99
PID 912 wrote to memory of 1344	912	MsiExec.exe	100
PID 912 wrote to memory of 5264	912	MsiExec.exe	101
PID 2648 wrote to memory of 5020	2648	MSIEXEC.EXE	103
PID 5020 wrote to memory of 5316	5020	casino.exe	104
PID 5020 wrote to memory of 5368	5020	casino.exe	105
PID 5020 wrote to memory of 5032	5020	casino.exe	106
PID 5020 wrote to memory of 3440	5020	casino.exe	107
PID 5020 wrote to memory of 3304	5020	casino.exe	108
PID 5020 wrote to memory of 4288	5020	casino.exe	109
PID 5020 wrote to memory of 6096	5020	casino.exe	110
PID 5020 wrote to memory of 5604	5020	casino.exe	111
PID 6096 wrote to memory of 4908	6096	msedge.exe	112
PID 6096 wrote to memory of 3360	6096	msedge.exe	113
PID 6096 wrote to memory of 3912	6096	msedge.exe	114
PID 6096 wrote to memory of 3912	6096	msedge.exe	114
PID 6096 wrote to memory of 3912	6096	msedge.exe	114
PID 6096 wrote to memory of 3996	6096	msedge.exe	115
PID 6096 wrote to memory of 3996	6096	msedge.exe	115
PID 6096 wrote to memory of 5976	6096	msedge.exe	118
PID 6096 wrote to memory of 1500	6096	msedge.exe	117
PID 6096 wrote to memory of 5976	6096	msedge.exe	118
PID 6096 wrote to memory of 5976	6096	msedge.exe	118
PID 6096 wrote to memory of 1500	6096	msedge.exe	117
PID 6096 wrote to memory of 1500	6096	msedge.exe	117
PID 6096 wrote to memory of 2492	6096	msedge.exe	119
PID 6096 wrote to memory of 4296	6096	msedge.exe	120
PID 6096 wrote to memory of 2492	6096	msedge.exe	119
PID 6096 wrote to memory of 2492	6096	msedge.exe	119
PID 6096 wrote to memory of 4296	6096	msedge.exe	120
PID 6096 wrote to memory of 4296	6096	msedge.exe	120
PID 6096 wrote to memory of 2532	6096	msedge.exe	121
PID 6096 wrote to memory of 2532	6096	msedge.exe	121
PID 6096 wrote to memory of 2532	6096	msedge.exe	121
PID 6096 wrote to memory of 5252	6096	msedge.exe	122
PID 6096 wrote to memory of 5252	6096	msedge.exe	122
PID 6096 wrote to memory of 5252	6096	msedge.exe	122
PID 6096 wrote to memory of 4968	6096	msedge.exe	124
PID 6096 wrote to memory of 2388	6096	msedge.exe	125
PID 6096 wrote to memory of 2388	6096	msedge.exe	125
PID 6096 wrote to memory of 2388	6096	msedge.exe	125
PID 6096 wrote to memory of 4968	6096	msedge.exe	124
PID 6096 wrote to memory of 4400	6096	msedge.exe	126
PID 6096 wrote to memory of 4400	6096	msedge.exe	126
PID 6096 wrote to memory of 1348	6096	msedge.exe	127
PID 6096 wrote to memory of 1348	6096	msedge.exe	127
PID 6096 wrote to memory of 5264	6096	msedge.exe	129
PID 6096 wrote to memory of 4780	6096	msedge.exe	130
PID 6096 wrote to memory of 4780	6096	msedge.exe	130
PID 6096 wrote to memory of 900	6096	msedge.exe	131
PID 6096 wrote to memory of 900	6096	msedge.exe	131
PID 5020 wrote to memory of 2228	5020	casino.exe	134
PID 6096 wrote to memory of 248	6096	msedge.exe	135
PID 6096 wrote to memory of 248	6096	msedge.exe	135
PID 6096 wrote to memory of 248	6096	msedge.exe	135
PID 6096 wrote to memory of 4780	6096	msedge.exe	136
PID 6096 wrote to memory of 4780	6096	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/Las Vegas USA Casino20260905115826.msi" DDC_DID=7415477 DDC_UPDATESTATUSURL=http://190.112.221.40:8080/lvcasino/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/lvcasino/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-09-19_a161ae882c60004df83c83c333712607_elex_stealc_stop.exe"
  2⤵
  - Use of msiexec (install) with remote resource
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
    "C:\Program Files (x86)\Las Vegas USA Casino\casino.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5316
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=2324 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5368
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5032
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3440
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3304
  - - C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
      "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1672,14968585566151276738,5126071047859774685,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa5120c188,0x7ffa5120c194,0x7ffa5120c1a0
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,16013751574706508083,4674022008848034967,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,6149931921838626968,5074939181455667360,262144 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
        5⤵
        
        PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,6597267879115387541,8972808520100740991,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
        5⤵
        
        PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,12435858845036519266,1696316168866361228,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6049861940698582407,3029025573615289126,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4436,i,808873825755427050,5213868436637135925,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
        5⤵
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,14304140093025343060,16509048089375710877,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
        5⤵
        
        PID:4296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,539727079068492175,1348959101286150129,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
        5⤵
        
        PID:2532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5452,i,1511625693518379885,2380806409005628955,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,9456457789256515749,13104876966282036150,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
        5⤵
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5664,i,8931876095145990217,9745378325205586924,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,15385900923923232109,17848918308525816205,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,17263056014425399275,13885121170920484125,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
        5⤵
        
        PID:1348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14275010870144242837,11422212319474352971,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14275010870144242837,11422212319474352971,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,2844727717398818489,13012003968453833566,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,10767171264064678584,4414495059771274653,524288 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
        5⤵
        
        PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6548,i,9521814817097850698,4616900677581350928,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
        5⤵
        
        PID:248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6904,i,13387050657458414134,1908037345781780587,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4484,i,3346556913510570128,8071253413064743393,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
        5⤵
        
        PID:5192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4844,i,3029088341193205330,6653504835524988878,2097152 --field-trial-handle=2296,i,6931881283122443079,13161928302970303292,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
        5⤵
        
        PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
      4⤵
      PID:1232

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F10F9FD8C03CCF494D34D2DD3A648AB C
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\{A206003E-A84B-4978-96A5-0030728A2DD1}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{A206003E-A84B-4978-96A5-0030728A2DD1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A6E7D3D2-8020-4566-8976-EC91F5E8EBD5}
    3⤵
    - Executes dropped EXE
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\{DAFE41D8-2F42-416B-9EBA-08F67FC8EE8A}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{DAFE41D8-2F42-416B-9EBA-08F67FC8EE8A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5200D6C-60AF-45CD-B36D-14FD134BB004}
    3⤵
    - Executes dropped EXE
    PID:5908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC526025894A9077789320B0DD4556BC
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\{F2EA0520-5FD5-4208-87C8-9E9D380F8303}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{F2EA0520-5FD5-4208-87C8-9E9D380F8303}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33BF601C-550D-498D-BC1C-645F218BAEE6}
    3⤵
    - Executes dropped EXE
    PID:5892
- - C:\Users\Admin\AppData\Local\Temp\{EA7DF5A1-263B-4BFA-84B4-A8D62548BAD3}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{EA7DF5A1-263B-4BFA-84B4-A8D62548BAD3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A57A22DA-139A-4F17-90C3-DFA4407DBE2C}
    3⤵
    - Executes dropped EXE
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\{F18997CE-9690-4050-8490-AF0466557790}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{F18997CE-9690-4050-8490-AF0466557790}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AD6D9B4A-8AA8-44A6-A4A6-45D03AAF60D9}
    3⤵
    - Executes dropped EXE
    PID:5264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E331860ABEE59A4D1BE833A5A7493A5D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Users\Admin\AppData\Local\Temp\{83D46070-04BF-486D-8011-5FD6DD6DA1CD}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{83D46070-04BF-486D-8011-5FD6DD6DA1CD}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85E76E42-18B8-4B5A-A0EE-2E3CF52B7DAF}
    3⤵
    - Executes dropped EXE
    PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2f4f.rbs

Path C:\Config.Msi\e5a2f4f.rbs
Size 40KB
SHA256 74649fdca93a318a902cb308bfa7ebb3922ad50baeb7f74849a89d020807cd64
MD5 c946542b4851eccd60b8719dd99c5d28
SHA1 2080f2dec8c721c7c7dc8ef6b35316d66c52da28
SHA512 dac5fb485c895e6738eae906fcd34827408ccb0ece4d734147aa6a29bec94d385d1a99fbff1537d1ff822ddcdb6b8bb224d090a01de50a763993cb82a8207677
SSDEEP 768:2Dddt+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+t+tF:ma3
TLSH
T1B003E2434640CBD3E68B5778FBAB1E043B32CCD9A394424756DC4779C8C2B951AFAB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_configuration.html

Path C:\Program Files (x86)\Las Vegas USA Casino\browser_configuration.html
Size 3KB
SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
MD5 0d6ad6c487e8e290d0589d340ba5db48
SHA1 9072cf3e65596b0310d614527a48bb6463f91481
SHA512 76c3b0ee5e9e7dda9a74dd7dfd4c69ad7776b10b02a8fb1345d5ec1f4507bf5087da706c7754792b7e846c4cd652281a5bbb56135fe3bff1fba1575d5606d2e9
TLSH
T1AF81ACB9A89174137733627BB7DBA09CFB7209176144C162788DE21A2FF444185ABFF8
MD5 SHA1 SHA512 TLSH

Submit Download

casino.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.dll
Size 4.5MB
SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
MD5 4118fbad8ec0bb9a3b21c911d76d52fd
SHA1 fcee086f7327f719a1e40320b213c5b3ba03c314
SHA512 95aab12fafa5cc81841a82a6d2d3be336cd92a7fbef3ea87628a917337946d39d446f55bd7f3ffc47af13295ec9959890c4165bea63a6ac1fc8d13bcadf49589
SSDEEP 49152:r3AlgM/VBWpdU/T5goEPyUoBNVbEINKA6mvP8OBubWwg/fJQz/6w0fSsuRr3m3eo:r3AlgM/VBWe5glol/YA6ECz/6w0fVvN
TLSH
T183265D307702C13AEAEE10B69D7DEA4E5408BBA01B6404EBA3D81B5F7B745D33A32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
Size 20KB
SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
MD5 61805738e66d9407cfba9b86136ee7df
SHA1 8de7b1de940ece408e238ed25d22f2032477e9cd
SHA512 1aba4a80e9adac8395dbf1db77efec9c269a16ccccbea54da92bc12a8a1f3e3132afbde21055f5f6fc1a32141bc71f58dba9ba0c5a2a155e935782689982a7c1
SSDEEP 384:b1LsT61EYFJeNC8QFJ4QOOmabJUoNwOj7S:b6T68NC84CdOjbmoWOj7
TLSH
T18E92730BAFF706E2CF93913A1C2191E76D3F64A0CE4C6537CA9439E9C434B36A42569D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.ico

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ico
Size 45KB
SHA256 6b56cc21c731e65c825fa4b87ba1cfde4001cc74c42eb345db2da7c728524e27
MD5 d402d827c495227aac04187628b28117
SHA1 8bd26c129141a8cb36fb776865bb6ee24f5db830
SHA512 79e4006103c4b60335c710ad84583450c5c78207c753ef2a001469ab6b905e4eed0ff5994b3e3da7745f08e759b633f7d4d4dee8fad89c688f010eedff5fafba
SSDEEP 768:hEb0ZZSZhN9vML9dgO9Krj8/IpYV2XHXKOOO8ftSe:hEMZw9vML9dm38/EHKOOO8ftS
TLSH
T1C1238049B21F38CDF619B7B1452F693BC3E95EA98051825A133F353C19B3230678E9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ini
Size 5KB
SHA256 5e7ac57f831a003cf3fc9006ac86600f06fcd269caf3afdd86595a59a7c64b12
MD5 1a3914f451811cb0fb6c2da20f94ea55
SHA1 bba44ab7b7504640e50c436fb7713a24966ad886
SHA512 c407328b075eb2e511aaf604a1ce8cb0179607d943826d38f493d05522e67d00236a678223472a5e17836316c8e8f6caa64b5100e78d05ec3c5730ad31689436
SSDEEP 96:VSc9FKw1k23TA3To3Tpw3TynYGzcDyRQlXt5mBo:VSc9FKw1LjAjojmjynYNDyRQld5mBo
TLSH
T1E4C1A8AE4131EA3139719C5574A47B4C2C5B74F3C801CF04AD35B31E4AAD6E9A1B57F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef.pak
Size 1.9MB
SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
MD5 dd85c83433f8417b4b7fefebb135b2ad
SHA1 a2ffcfddaa22218319ba1964226d6b676791bfe3
SHA512 cb3ac426807f4a1a55d48e9ccd459c465ed779c487811799899130d8e775960d64a87a8c10f5c8635799c23ef1f63bf6f2a05d87217c221d75806ce385542770
SSDEEP 49152:xuO6GF+4e3xlU2R4ipYMuOqnveEyjD8d16/pT:vFfehlU2R4TbOkvujkcB
TLSH
T1B1952310EDD56E66D7EAE779B4A4A1225D7A948349A0BC0CF0CF420FCBBD55A10B833D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_100_percent.pak
Size 262KB
SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
MD5 9db96c13fa9c1c0ee63145665783798e
SHA1 560c075aa1378f4b42f17618374a53f520c0344b
SHA512 7e3d3f6072623b3186e50f11ad3696179c6d4e70c866ff969c12c6146b2a5dfcbdbdc331e1df32e203c98d347f53fda53f8ef9bd85dd41a0fa87bb4d6b6bb7bc
SSDEEP 6144:lNk7S+yq1H1yFepjbzwVyTYFhwEx5c1YC7x10fSucY7OP2ITQ:lNcXjxYF2kgf1d/dQ
TLSH
T1CE44F1F3B3B4BC7ED69B0A3371510A77D43A423A06530309C28689756E5AB94EDDE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_200_percent.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_200_percent.pak
Size 413KB
SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
MD5 4e5334990bb928aabd5a70bb894d085c
SHA1 97412161b8aa498c7285df8c5025b16985515a57
SHA512 323fe198f2c618aa2e16b45bd2bbc12745b1512abd1e87942b5ce6293d6090c228746a468745de826ca18c57cb49a1ac3b50c98dfe0aec0e9d155d7c6c8eb8a3
SSDEEP 6144:jk7S+yq1H1yFepjpDQYaR+9bGHgs4jTlvFhwIz73QYV85u/oFYvwoytKi6obByPF:jcXjGfIegs4jTZF2sg5u/oFFpxLlFYb
TLSH
T1319402E6F3F8AC79D9930E33511209B3D977153506A7030AC28B9C397D56B9889CE39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\cef_extensions.pak
Size 1.2MB
SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
MD5 589da360b8c57889db5fc8d541fd149b
SHA1 0527e2413154145a35a67084d7e8dad5b0f5bea0
SHA512 7d5f3e3c825725e2a6bdbf1f0d58831a976aee9fd944f1d9c9bb91cddd3287728e7535f91a721b57927d2e3f5db2df4afc11ce18338fb5c33a12b2bf6de43c02
SSDEEP 24576:U6rcKQtJb9RLONDAG13xdT0b+e/mp2IsWvRBr2k+CGFH3GrH/orJm22O+EcRc7Pb:UhxR6N0G1hdAKe/rIsWZBakZGpKHgryE
TLSH
T10B552330BA9C643FE0E0E7B0D9B850726A2C491729D5696CB29F825DDF8931903F197F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cefsubproc.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
Size 328KB
SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
MD5 3da07b7bcbef647a5452435cff33e82e
SHA1 cc16d8bf23da8c96787ac4d0da9cd19d527e0802
SHA512 c98036cc203fcc10f449d7d0641f40fd53f7be05e98aae9244959f175069eb0f76a226b9bb4a9bf56ec0686ebe3c77845b70da4f0fffbc53f58d2f96f4e64a50
SSDEEP 6144:vOZ6jwP9gN3lblEyT0V34vjRFDxBQ3fS:GZ6A9wxP0VEzQPS
TLSH
T181643B703B15C13BDE6110F25D7ADABF505CA2090BA178C767C82BAEDE716D22B3191B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\chrome_elf.dll
Size 795KB
SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
MD5 b89e3241fb538533a3a19977e3dcab8f
SHA1 23060547c1dca7ceb0f190e3022b48eb568f8bfc
SHA512 07e15425adac13ba840afce1be804f7519b905dfbf54c78569219523c453f51415d3de4f5abb6980f6388a31b6b52fd18177250300c6b7a412447534e0da3d8f
SSDEEP 24576:XjjcLs8g0U/cAbbwjOVZ9wjZrDsCfTpQei:XjmLg0U7SOVZQGCbKei
TLSH
T1E605AF02B580D035D4661530912CE739AB3DE6194F248FDBD3C88CAA9FB15D16B3A7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\concrt140.dll
Size 246KB
SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
MD5 3da20013485a5651b687711bf859d8b9
SHA1 6c4071f22f5f5c6b14b8019ad8becc2d2dd7a14f
SHA512 ffa88023f5c54674944f7ef2062027c76251e451c0ee42a6b4594ec503fe09e7118e73993c1bfc49f3e0497f42a980e53f4e6a70e11d3db55afda2c4e505c03c
SSDEEP 6144:HdynmUAZcA2pxuarMEc+vA54+0omeCrB/04LU+KS1yQZS0IuVx8i5S12z/VsTB:6pLnxB/0AncuVx8cz
TLSH
T19A345CE1344048F7F76F07328528D7BA94BEA68027EB81D71B6CA64D1E646C1EE33593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\d3dcompiler_47.dll
Size 3.5MB
SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
MD5 f76b1d2cd95385b21e61874761ddb53a
SHA1 e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA512 8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP 49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai
TLSH
T184069E20FB058176D8CB01B2A59D7BB6A47C9B31473440C361B4AE99FD712E32F39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devtools_resources.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\devtools_resources.pak
Size 1.5MB
SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
MD5 c3ac46f4cd5b964a270f1f2758f8e773
SHA1 c7f888725085c5b5069374639e557db1f1cef922
SHA512 07d7653a28b4dea51361befcc1c88b01a7c43ca25197cf300c314a8650d69acab936bb060e963041ac14bca31d1730268d53ca013676fb32f5201a97c4ab877d
SSDEEP 49152:UWTnZD7WUC15ShDmDddtZ3gyzzYLxVi0UiHkNOs1:HnZD7PjgDlZAniWHRs1
TLSH
T1AA752302B15A2690F012BC3B540EA93453F7CAE57294A5B1D68E2A773CFF81BB587770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

directsound.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\directsound.dll
Size 221KB
SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
MD5 0f7b6cb21b4e93caf046230c1a091a36
SHA1 9e9c761485a7594de547d527d9f1bfacfa702bf9
SHA512 4b2b12444a6f53cbd15549b9a971adc83fcaddd52de282b24dac4b628f1628e6cff696770d41b8fdfcda4db0c998485312e5389b3353c9383a800420448bcc0b
SSDEEP 3072:Y/X6+rZBE596vtGPY9eP4tdIsfn2SnDvq8rS/0cve8bMLAfKobRIYTh28c//dwBh:Yf6+rZB+92KPuLAbGk5UymR0l
TLSH
T18F248D017A9180BED5F60270D1AF749BE825172C17189CFB139C18F8D5A8DD7BEBAB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extgame.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\extgame.dll
Size 1.6MB
SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
MD5 4006f992b454b8a1f3ec7c440f0fbfd4
SHA1 a4ad2dcf1ebf04b4ec5e6586365c5ce8aa2ab2cc
SHA512 40915659c81a3faf3f5e167368f91fb989e0654cc1d2fd79c4fe13bd6a525b549814026fc7053c94f813ffd6fe6c115302bfd55071a59f1190cc7a893ced106f
SSDEEP 24576:OsJraxp5TNZpLduGOIij+0jeZsDZhozg/3fXj1vJxguA/l9fGH3if1Vs:OKaxHD0CeK0/3f58/l9k30js
TLSH
T123754B717706C575DCCE12B59E28EE4F505CEA981BB004EBB2CC1B5EA8B51E32E31A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00readme.txt

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\00readme.txt
Size 127B
SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
MD5 c75060e5255f8a3a07938a55c5b3d20b
SHA1 d786597681bc820488cd10f9d5263227ef5c09dd
SHA512 d53f2b4efa0ab9f682073d22656957471f42f2931db96fd2290a5125c1e8ec0054b9df1bcf1803fa7c26260cc38f8626a808c1fcfbc1d820b82eb9653d3f6c30
TLSH
T1C9B0920BF25AA075186D004B0546E1B33B7819EEA2D2841B628286DA020233BAB54D19
MD5 SHA1 SHA512 TLSH

Submit Download

albw.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\albw.ttf
Size 165KB
SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
MD5 510a06a2a3192f5b99f26c3323a50a96
SHA1 2f0ed7a97b31e15c6baf14f86dcdb74d1dda6da5
SHA512 ca8f6230fbae73648fc19690ea5307ff3f368119cf7aa13f5b2c214b30c83c772924bc4f41cb0986238be3f28b9266ffcf209ba8b0c785ce18970b78cccce31c
SSDEEP 3072:huU7GC2Q0wZ485NdsDSPneJL2iVsweQaU/HfiUqydCPMR4O:gQ0wZ485NdsDS/ecimwhlqodR4O
TLSH
T1BBF38D4FE252FD37E2A0613DD528ABBB1613BC1D536AC69AE58D0A6F84CEF204F14750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhb.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhb.ttf
Size 3.8MB
SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
MD5 ee060a995ae4fbd7f722646017560c99
SHA1 f6fc6770744a288aefd502b6e8280646b96da010
SHA512 b3f969311a21db77dc60cd9362cbeea422c4a6d3fb09b22190e65b62282288e0f93709659ed4387a2fbc104eb9edc83a04c1e972bbe6900682a72ae4ae58aec2
SSDEEP 98304:6unGP1IakNGkNbvK5ujgl7MK6oed9XnfU:6unfaVkNbSoUt56o29PU
TLSH
T14A069ED3CBDE9A1E11317C7D8500F09FB1C2C132072686965FAA2F3E540BE9A8AD7579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhgbb.ttf

Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhgbb.ttf
Size 1.7MB
SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
MD5 824ba12e66960b01a30d52f7a30aacc2
SHA1 3e6f232a6aa6c11a0b13736c9308288000dafb2d
SHA512 abb8bb0153eb37e98b22c7b781d67faf7163b7701d180e4194d095d1914a3f8a593af2dc4f9cf58565d1ac9e00d7d980813118044e408477de24c93a7e43bfcd
SSDEEP 24576:zDvEYRHarD0NDay+AeveonSvltx0awmH757Xuh44N+seJEKuCMDSWgX5zMz0hJmU:3cvDGHBnKkH75m4Lseg+zU0T4pfU
TLSH
T1DF85BFD3CB9E9A5A91317CBC4900F05BB1C2C03247119AD71F7A2F3A540AEDA4BE7679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\Las Vegas USA Casino\icudtl.dat
Size 10.0MB
SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
MD5 bc7064ba87454ff6ae541132d6678c94
SHA1 ad0f0a5c7aa60e113706971f10b523c57e5ef075
SHA512 6899cb7ec0595e938f9efd6798b5646f5e4ca18ab257b57b8995e1dd2d152c1f7d355222ccf66e9a445997672f877cb0d137598020a0fd75b45743058dcb5445
SSDEEP 196608:a+wSv9AAQQ5EliXUxR0rHf93WhlA6tv1r:OKlQQuliXUxR0rHf93WhlA6tv1r
TLSH
T154B61742B2EB4DC1F9FBAE71D9F463639526BC05AE31815906042F3B5C773E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extgame

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame
Size 99B
SHA256 10c0f7136acfc7d53e888946dd9cbb5c37985b1a2663c5fac4f7ae7d6fc8426b
MD5 81891ae9cc87dad5fa4d40a9786f1b9c
SHA1 655c37bd100b96cbf263527b6e0bfe6261bc5ed6
SHA512 78c87eeced3c019c00e70d9e11f3da6dd30a120bd158626b50325bf19f15cf2fced6c0c713f4f6cee97bfb09894390d7bc59c06e38ae57a9bf8d0ae7407e5e12
TLSH
T13EB0118A02CB8320C8BC3AB20200330B02A8EB80228C0303022200202CEABC20B0202B
MD5 SHA1 SHA512 TLSH

Submit Download

Extgame.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame.ini
Size 743B
SHA256 885a92d105718d0bd6f19189548b2c8dca3838322497b66bace6dc92ecfb184f
MD5 906462d63bfa43cc0d99fa3d7901ac41
SHA1 bdffb2d74f45de8d2cde0159a99c1ab1783edf4c
SHA512 657600be924875c621f70479273d718b1c2c9018871a859f527766f54337d9436267b980deb5c235a3a82913d89d973bf3394be90c9f05c88a97674ba92a559d
TLSH
T194019C0312E98F5585BCD985B6523C8B126F9B52100EB01803F5B47A75D12B98BDB53A
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Fonts - Latin.ini
Size 605B
SHA256 1b54bf4ea654beb5bb2f598ac859240175accaaecc7ab4fbf76beb92ceed68d0
MD5 6d04d8fc8787d26820b1f6e85ede9030
SHA1 503972da0fe2f44fe76973381497c8a35252a9bd
SHA512 9b983a4968abb1b0fca95e627c72c9c59537f9d267eb7c073ed991f1a7f3ea0c7a88115ebec9d69e0ea8f304006d1a58dd7c142b8bb423109fc2c8c436082f79
TLSH
T1CEF0A20302FCAF19114598C1F1D35937E925D8D5A422790A5EA0B8EF05C516D42EFB38
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini~e9990b85f5cd97ad28cf2be6.zip

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Fonts - Latin.ini~e9990b85f5cd97ad28cf2be6.zip
Size 643B
SHA256 1c2359284527f2d850eb551cb974c74a8e2ffb6b8adf1b0d825220073c3b3e8d
MD5 5dcdec3a549ef2b7bb1c13283076fd50
SHA1 f80efac31f97d9e09875a615005b64336ced4d27
SHA512 6f76710085601176faca722434af68ad81744d40ce56da1eb5c032875d42305abd33fd9b83bf45fbc707b187211f0412ba1bd0855a932df74cda8ebc70c7a26c
TLSH
T19BF06241A067EE2BD4C7703133CD0964E7380028E2E98FC2D28200EB9D913B2B3BAC40
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby
Size 2KB
SHA256 3f9bcc074a0fe98a6fd617b57b983f186bd0284886313126da3af21401841dca
MD5 46664f623f8822b5be3a7e5ad5a047e3
SHA1 f2d78c50c52dd2c7a9eed4aa164ab53d9cdac6e6
SHA512 bfcffa1e4b6b4a1cd531ae88d21f98cb28e7e25a05f4903c6543691253c518af37589c953db967624ee06fba4f36effaa6abe633c5c49e21086d9de5a0620d4f
TLSH
T1F351E373B9046E96BC08933F52AAB2B74E934D983C7A3535D9620150047FDC360AFB8A
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby.ini
Size 24KB
SHA256 97af53d240382804349286b230e81c1e4f41e653351688bc7f6d4fc75096bf12
MD5 bd2763cdaa383e2a498bb3843768990a
SHA1 50b055178c06189635195205d7b3950e9972ad2c
SHA512 a85e1702a4e233d96a3a7f34bdcac5c0b8da2946d6bbd9aa97c40315962eb4f0098106362c4d9728fdb6f55d833043e62613f973d4cb1e9bf9f011cf77b0f6db
SSDEEP 384:AKfQf806dPeExlHdeEeA9a4mGfsFKrmSYSaF1DsZii:qsM/Sa4fsFKrDaFJsZb
TLSH
T1B8B2FF2360CE1D262B10C57CB5E07C5B3677E9022837740996AAB38E67A17FF45DF4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbyinst.exe

Path C:\Program Files (x86)\Las Vegas USA Casino\lbyinst.exe
Size 504KB
SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
MD5 108cbf5d33ee178c900bec4056ce4891
SHA1 349e2e116f409f07ef0a8d1a41a42078c05f57e2
SHA512 d602626485c7b75ace34272a498c389df11d2d804547821ae5a9dd4e876ec8a36c2c0afa51084a8a8d2672a6103732999349ac111f12c5c000f7001d4f838810
SSDEEP 12288:7mUzrXwirssr+eA/sREmfw5viGqcxuJs7/vg/DCr8NBBXboO9:Lwiwsr+eA/sdIg/DCr8NLX
TLSH
T1D0B47D10BA80D032D67324B14AFEC5BE195C79314B1905DB77C80A7A9FA48F17E36A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\libEGL.dll
Size 305KB
SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
MD5 d333565fded30d59c53db71fc4f58068
SHA1 3d258ac779383248a538c7f85ae3b834605898e4
SHA512 9273431f417b4e37fe7255cddf5da855c582818b52207f160b84b6886079c77937ab853b281a772ff508b8522aab1288fab700e1c4dda17cc371f656968735e4
SSDEEP 6144:etJvzntGgCdDbvqb21v+bl5azaijx5dGKWjDKPvUCffBWoDcd3UMzgiz0B:eHvzntBCdO+2bl5azzsKWjDKPsYIoDcq
TLSH
T10A649E01B940C036D19E01347628E77D4E3EBE615FA1C9CBD7984ABD4FB16C09A39B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\libGLESv2.dll
Size 6.6MB
SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
MD5 fa78b488cf076522e1d0ab94a5f25f2a
SHA1 af11302aac45724c53f347de2f64a51fd301aeda
SHA512 a10127d72fe9ad09f30b1e6f84a0adc74c8d2003a5c0b68f59a0f9afff3765f2ff6d8ea0dfc4e618fff2d8d452e3ceca3fad59ba547eeba9ae4072d9e354a059
SSDEEP 98304:jBDaKvhQV6lJ5Z1TQjwWinEPRQMSffPqKQV2RP9lcKVL/ymJhGFO:jBD/v5Z1TQ1inEPWMSffPXRDwgG
TLSH
T1FC669E01B180816AD40B52745B2EB72DAF789B571D60CB47EB9CBCA8BFF1690264734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.dll
Size 2.7MB
SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
MD5 949d0b0a8defcaff5fd3cc3253aca141
SHA1 4481f1cb3cf1d31a6be9a8d15abc701d67925618
SHA512 bad91f5048aba49d532c8f57bf42dc18bf0542d27d3946ab0fd325c6b17665c61ea47c6322634886f38ae82e56e925b0777a6d5e3385ab9f62250aa1826c65ad
SSDEEP 49152:0Ta8iZ+hgOz/YvQOl5qtAN0AvIJuzKRLVrqqV5yu76lBdH+cH5ths8sz0tK/uQxT:0Ta8iZ+90vBuAvIJuzKRLVrqqV5yu76t
TLSH
T1DBD52A30B215C13AD99F01B9A96DDB4E5029BE741F6454D3B2C85E3F697B0E32E31A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.ini

Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.ini
Size 6KB
SHA256 baa6bc8b9c86ceec4bceee7c10b0e0ff4f84608df580bdb9a9e665fc3478c723
MD5 2471a5b80a9d944a07269bf36058149a
SHA1 e437d07e920f4c6264feea002b73ef32c8e4be06
SHA512 60695598bae6bc8f63d5584aab0302b076cd43ab7be309511e9a46928c33f470d072db9db4bd2d997e0efcf3901170ec7f1803afd0d2755d3f0f250ab215c380
SSDEEP 96:iut1L2aHJNP9MS7TRsq1aVW1W6WQWOWaWY2/EcuguUUt74QUUG4QUU4yQuvQrRpy:iYL2aHrPWS7TR8W1W6WQWOWaW3spy
TLSH
T14BD10B1D930A963A878B5B13EC5BB0696BF941C3D4026102B85F05C9FBDBE525ABF307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\Las Vegas USA Casino\locales\en-US.pak
Size 219KB
SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
MD5 89a808057821042f7cb0b0200dd944d6
SHA1 6ad54a17fb954aed628920682dbe79cc192177ba
SHA512 45564bcdcb6e9062d861c7eee2aad5b262242f49ccf3b75c0a49f6cf84cd4f903318d53353efe84fc4737d5658384e045a8c9c66b7601cfd6579df271ff35513
SSDEEP 6144:st49es49j2ttM89ehSmCWfaYhf5Hx+AwL:sGeXifMWmCo5HkAwL
TLSH
T158245E0FF788223A069352627F0962B2FB35D05CA36126563CAD811C3377B69D2777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\msvcp140.dll
Size 445KB
SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
MD5 448b345bcac7ec3729f291229c942060
SHA1 5813e35f62f3c670d02cf18dfa0dca523108660e
SHA512 72d01d35716ad9e1fde5941854b811765479c73a7a3cdc9e3fefcd3a6aecf68657354599b5cd18e67c8b1a61a3d5756ae83b13963c08e7bb638e415236c9d136
SSDEEP 12288:xltXrXT8sqcLNvDbiv7TlkWBElGuIMyYehUgiW6QR7t5s03Ooc8dHkC2esrMnUv:xfXrXTXLNvDb0TlkWBElqYd03Ooc8dH4
TLSH
T195A42832BB4609B2E59913B971C9472297F9FC210361E3C39BDAF0292F656C17733A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\msvcrt.dll
Size 260KB
SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
MD5 0b9c183d1565b48fa6e5d1d3d4b86bcc
SHA1 69697324c1e7ad80215fb07ecf6d786e378c568f
SHA512 c836a4789270b216f8505074ce34b11d0b509e14b25133f3aab8db55ba5451e150b6633c4392cc83c1007f64da1c824596ff4a77aab5f7d340be4f631b2935f8
SSDEEP 6144:yncoHbacxB5pdVEweKMph18/VhTORAeFMWiFaNF7R5LWCC0uOpL:yncIbac33dVfnM2/Vg/5Bhum
TLSH
T15744BE6239C1CCBAD1E241B80D973F3E8BBE99614032DD83DBE45ED41F20992A75B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plibc32.dll

Path C:\Program Files (x86)\Las Vegas USA Casino\plibc32.dll
Size 537KB
SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
MD5 0be09294cc2e30c10496717434f56135
SHA1 8bf0a2f558f58d671d30bfd7430dc20c1ddc77cd
SHA512 4250ced1b4d0c72a236fff658faa7d92939620add56224c2d44661c945c5e60aed8a02e97549a3c98b1d868fea07688eeca2308e725f8bfd202aebd9539c4b29
SSDEEP 12288:VqPpwewCY83HElJMcED2T0euWHsPu0IWtY+GKw7qSBj+:VGpICV3Y0iT0eu8sWspy+
TLSH
T124C47E10F201927BEDE701B7DEFE257F692D6710032919D792C828999B6A6F37E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.usd.rsc

Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.usd.rsc
Size 18KB
SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
MD5 a194baeac2b922b5c0c84e457567f244
SHA1 d9bcf55a740e71c65e932de518eea3f2e973139b
SHA512 6cf16d2dc12e09ffb5fa692c67126b1d45b6116c9b1f6eb1d28c8b2cbdf814b9320b5e260150af7f113dfd90dfdd5faf40b3f9459d9a691651241a23c8ad5dc5
SSDEEP 384:pfUZAq+GDYTNNVGu3WZOF8WM7A4eNEfUZAq+GDYTNNVGu3WZOF8WM7A4eN7+:pOH+GDYT3335lN4euOH+GDYT3335lN4B
TLSH
T143829D0F8A23B0D43AF6B8AE84D7C4CA6928D75649D8403F3F144F8D92E27E850F517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chips32.eur.rsc

Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.eur.rsc
Size 239KB
SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
MD5 d46a07ebec5608c61687617d4fda3034
SHA1 657d58e434b38ae2e3492d0ebf572e3a3430d52e
SHA512 02604d3f9e3cc0665b508a4253d38170e7b034a463a4f1cdcb6b8b09a6ea38e00f0f7d20507811987cfb233d992327d539d02b12a2804d64a02c1bdafb6e49cf
SSDEEP 3072:ykqtJXvilrCSxeqN39UNKqPLqWFVtXBurr5jK1y6u+7nAkL:ykkK9CSfNU7tfxurtK1yYMkL
TLSH
T11934D0AF9AB0909FF99E75310DCE0202E76933BC8A673338A4C169DE4456E0B7F550B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redirect.html

Path C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
Size 236B
SHA256 3eea035624f3025a4ff987ec22d9d88d66583db86c5e4c3cd3b78efc5ec7b196
MD5 31b6b6784e0ff810aea692f45639741c
SHA1 da985a365876f5630ffb856beb889d71b963ea05
SHA512 5630c18052871804304ca3de907ec19bb10aad42450f670d70969d06a41e0662e558fbdf52533e4209095ce9e16d00e9767213748e124874c7001e5e73470c65
TLSH
T11DD023FF90D45C452771617465D273C804B354054AD658B6D1E4D63F565D312EEC70B1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3e3cea387476f1f9e241b406755619fb890e50271bbcc84ddd5c7864185113fc
MD5 8e9fb529dafffc7dcb7a9b88814c3795
SHA1 bfac7104c0a994ce219022cf8349cfa59277c646
SHA512 c1dd3d0689c3abd6680dac2f508dc7223db2f3ac46cf791e7d40aadbf29903016b515c3e0fea1a57318246b5b74b058a4657d62376f56ee5986a9b8c3e41b9ee
TLSH
T1A941C788C24D0026FFB98570C0D8E2B73B3165B2EBFB9D0634A6D4BE974B711292D15B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb42b2f0a10c090dd1774298cdc599b7f962a9079c31671e08a12148ea137226
MD5 020e5cd81df1af90372acae9b83fdfbb
SHA1 8df9778916ceeab7a2deefd3dbd087312c94a46c
SHA512 6cc5d82144c7b243c93f17c13ad6f0cdc15f35e43ba6da77287578a59db31f66a217841101cb8ed8504fa8067bcac0010cb0a6ebb1956ad62ab61720f099a0de
SSDEEP 192:sxRwRNC4/fAskhZ7QzqzoA8p42b/g6+WNIYDF9GMIgVZJ:sxRwu4/fAskv25/5IiR
TLSH
T18732A615AD28A93B5CD7D21DBB65BF53D3F91023A0945E58A6FC8A2C08EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cdd26da40f749b6aeec193c0f5dfaa7b40c14a2cad4a7307feccab24d65b14c
MD5 6d7bceb60b4c1d55b7eaacb22e80087d
SHA1 2dea1c67fcef3c9d5e6d0f455a72b467aa5d4b77
SHA512 9476de72c7f5ba967c31a3d33839e2513aafe4e26e6c2b6a9973d24acbfb0c467f724800fff12d3f49d75f269270188ff0bdc72d6f08afff00f982aaaf26fdab
SSDEEP 192:sxRLRNC4/fAsIhZ7QhqzoA8p432/g6+WNIYDF9GMIgD7ZJ:sxRLu4/fAsIvsX/5Iij
TLSH
T19632A715AD28A93B5CD7D21DBB65BF53D3F91033A0945E58A6FC8B2C08EB6DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9a2e616766ac691c5d9a2d3574d65d791b9d7849ef4eb40f5e5e00768b7184d3
MD5 cbee296a20bc0c2d5321bdb21e70f2b8
SHA1 d7ba05b0d763d1d051b3beca1b5eea70bc21becb
SHA512 14b0b6948072bdf1cdc3bb97c22bfd78e53856a9e10948d8e3798256d9eadf9fecd7a611f5637d0e45c5e5ee7828ca18c9c95fa429a41c870d98c7b62342d9a6
SSDEEP 768:SzYbgR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVoLMw8WSProGHuM:SzYbgHEbxUWgasfA6u1jaHgwtScGuM
TLSH
T1DFD2D97B640CCB7F4F804ADDEC1A7A9E6D6802CB96D8C98047FE941D02C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c554983e4ce7b270b2c10efd35925b633437544ee93e405ff9d3bad6843d1685
MD5 e1602c1f6c4d3068cae8bfccbe8432be
SHA1 519781881976b676fe6a35df9ef42de05e5a129b
SHA512 3826ba9b8037a591e73388d75c097e33d83306b089a11f85a22196e36130928cd1120421ef2bed8e12312cb5773127e4a9bca690baadaea27a4299e6a47cf6cc
SSDEEP 48:K0Py7PxRxKbJE5ISfKK9/11KxvaY89/FyLz2Xz9Vlmb1YNISzmK9j1Rmx72YAhtj:KsgYKxOo60AK1OqhCKSQSu
TLSH
T12491241172BB425438FE749CA2B48B5E464231B33055E72BBBBD10659F6EE045CFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 089e646f4da87490946a29c531db2db679710c88965f76a04e1efd0f9affc5ef
MD5 b36ace728110cf476cfa00401fe5b04a
SHA1 977dfb0d3a7686ce0de4b98bf944fd1f776f0ef9
SHA512 56cf4ad2aedc29e850f6aa9b92ba549c439d17c076d9d058c4a2d1dcf0e612831275136ce5a1db76726073fbd75b0d6219e019fd3fe088d30a3896cc56bd0506
SSDEEP 768:z/UxvxjgC+k3PWEybNbz5OeRFZD1fTos7RzR/+Pu:GZj3+k3PxbY1fT/R1Ku
TLSH
T12C03CF3AF8D86D338CF6E244724A764BBFF055B395C91A9809ED2F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aa596844c622ea4bb02fa6023c479221fcc616ade328d29f2cf8ffd3cdb53818
MD5 88b0fbea739c2e260ea45b745cd5ed38
SHA1 55cea6c24320f8e6cc60aa04fe81f68d4471390c
SHA512 6dfcd7fb0da615ac2da04ec45813c19286f50f443323105d7307a71b4735811fcfd39c931d69910707a5c904b045d81689fef50dd0df503ea76c32e0ff50ee98
SSDEEP 768:Sd3+rvqJybNbzohzOeRFZD1fTos7RjrMgry:Sd3+rwz6Y1fT/R3Mgry
TLSH
T1A2F2AE35BCA49D734CF6D385B2467B837FF455A389C9094895D89F1E08C7BAD130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d70fa8fa7c846d5727b91f252a087af1c32d07cc70a5880eeeef4553007ca416
MD5 3012f6eb65d9eb3b20dd0cf70ad1ec78
SHA1 2e1354f998a05ff059c4cef884d0c53f3eca2415
SHA512 d2f8cac1332cc20ee3e665ed4529044370d86078bdafd971157b40dd230334b4755b99b64586d3013e80ea1fc875cd97715efcd458b076d796aeeaf942d50648
SSDEEP 768:k/UxvxjgC+k3ZKAybNbzohdOeRFZD1fTos7Rjr/+PZ:RZj3+k3ZdzQY1fT/R3KZ
TLSH
T18803BF39F8A89D338CF6E244B24A7787AFF415B389C91D9849D95F0E098779D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

package_list.ini[1].crc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8999WJP3\package_list.ini[1].crc
Size 24B
SHA256 8830b915d334abd93775e4c458402ec608a9a3c58f6da43e9324bf5fdb7ea1e1
MD5 705f36e0d7aa042633ab40ee71ad1e96
SHA1 85ac21536a59bb988329b963f83dc0f6f47ecae1
SHA512 9dffd49d18c9b3256de3fcc69c7bb2646d164a5c3cabbe7d6a0fa58bfbe4cdf9fe60d13558d75760f6f0638464d0e386260e3184d314e4be54d737c87aa83d14
MD5 SHA1 SHA512

Submit Download

Fonts%20-%20Latin~e9d40b8cf5c497fd953db9d3[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TBF0LEZS\Fonts%20-%20Latin~e9d40b8cf5c497fd953db9d3[1]
Size 89B
SHA256 339137603f0f8df7e1e519074516fcd1357766ba3412e33fa59d8428331a2b6f
MD5 9f403d6958410b57fb7d37a3b675dfd2
SHA1 b9ff5279ed9f1a5a46a8ca0121e1ba8d5364a829
SHA512 4edb0a408669861e70734f9839d61c62ca58dd757c16f0726a2ffdba88118a4c5c46b4dbebd1860ef8ada861b1f6ba9d0a8922b91640042be1b5163eb099e0b7
TLSH
T1DAB0220223220028C0003C320AB2C3B30F3EC00CC0A8838200020030CCAC2000FA2B00
MD5 SHA1 SHA512 TLSH

Submit Download

MSICA2D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICA2D.tmp
Size 1.3MB
SHA256 4fdc16bc2474d2e84c297953d47ba710e8517b059005f75782c516bad9b78c71
MD5 cfadaab7110b85035cac9aa747ca8aa2
SHA1 7a3e56f60430e6634f1990eec6846de78f257552
SHA512 5f0bf7f3aa1e149baddffb45e66aaa75eb02ab0ddee8abb6e0e41d935b3d2ecee63aec8e0dc64f2669013c196a0f73e1e17feefd41f852a1803b18ebbd53c4e1
SSDEEP 24576:pZtTJNSLh+Lmk2GX4gDFQnet86s8n4ffdcd3+bIZlfhUZPYGkQgJ:pZtTJghSjKettDnRckvJUqGkQgJ
TLSH
T146551241F7C3C9A1C44D0535985B63FA4FB06C4AAE23A39B77993B2EBE72385BB40154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is2973.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is2973.tmp
Size 286B
SHA256 ba987f1e7eae22291a023fe19256095122ea284354a9bcc30f12042b9a5d40dd
MD5 02b1283ad1a49e41f92304b627687d44
SHA1 f0d045dfff81e8d0b2fd162fd45e78571f10fcaf
SHA512 214d2902a6b1d4ee4568f296ccc02ee22af9d065acd1ff004f06d2e535ee694a1395f3da4ef057fa719793123215f74bcc4db78bbe18df3531f0eae22cbad161
TLSH
T13CD0EBC8706D0B08F4668271C7CC04E406F0BC3A162A73AD02C079044400D6A3323E38
MD5 SHA1 SHA512 TLSH

Submit Download

_is2993.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is2993.tmp
Size 176KB
SHA256 43d9c8f2412012da74832249c54e179cbdf93bb075b85650e9f93937051ec7db
MD5 f4b1fa282c1ca7420df7068e47b69c0e
SHA1 0af872d1b6c8745530cf4cdacadc4364775e50cd
SHA512 df908aec077b6dcca3fd9eb2aa330c540a34e0843f034cf944dd10a2b76d63ca7afabcb1d272d0a4cd2f9b1eb45719c6dc246b3be9b09d90ba4c0130aecf53a4
SSDEEP 3072:0KGhuKr8IO2tV1uylt4c2UlwJ997Bi8WJjkpFi5wWvYMh0FQ3LG1R49:HsuKrGNj1V7vW1YijpKa3eR49
TLSH
T1E30423D87ED454FC0F6C9986C0E22B119F06C7E9D6A02A1A83F677469FD1B73C80A749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is29A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is29A3.tmp
Size 250KB
SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
MD5 7e3602d08b22debf43e6258b02696f95
SHA1 8748ed67facb6377df485d00e10882ab6b7a6528
SHA512 3cecc3934f4b62482dbb7309a0f708b29d0b80539a9311bcd325cb62fab3a8e560079d0a4e3f23745486b41ef6ae365064d3353487baa9f9e7630bbb156811cb
SSDEEP 6144:oIBXRBD/TYBYIqR8qJWDW9z4+xbOSc22vts3VlP2U4tS9s1:h/GZDWG+xba22vUtTk
TLSH
T13F4423E09E1F910DEA611D4F6BDF46BCC27C3EBF69202C12E513E983166416D817AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is29B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is29B4.tmp
Size 50KB
SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
MD5 d718690b4d422351afaad30fb5005958
SHA1 f2405024c9f0c8b8ec8680d36b76f2a2fe1eff50
SHA512 6c4d324c654649df9b6b427f3fd90eb28a6121f84574a78e87db2c8b9421da19c84da6a94fb0814d46f023c4d395e010bd5c6974c82c911e154e413c910c6dd3
SSDEEP 1536:orrmXs49qNUA7gwZwi4wVZ4gq0UnOsf1raUXlI:orSVqtzdGhn1f1plI
TLSH
T1FF3302C9A43975DD5886AEA7828E33D1F18B408C71D4EF4B93FC2562904ADE744F2CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is29C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is29C5.tmp
Size 113KB
SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
MD5 b744f334a4db8788a3eeb1430cf48d98
SHA1 3778f36a74afc672b2d85e2caac61f6981b5a9ae
SHA512 596c086bcaa0ccc0f6d4ae65bf49ff8120650d6c8c7766d265be564520398b9ab29795bba46d6936d036b44166f8e8ee4f4363399299225c494c9e29f28f2358
SSDEEP 3072:vEEw9tYANVpotzJ54OFxPmkwhaavfdf2Uog+6neZt:8pHdNMtzJ5TFYkqaavfdf2+RU
TLSH
T1DBB312C86BE37A1599192FF0EC2623DFD11C428AB8362AF5462C47EA55F114FB07BD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is29D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is29D5.tmp
Size 24KB
SHA256 078f6a23484ebed7946effadb51ca0e2320554a467e30b9243f2b038f6f15295
MD5 7f29ff99e9c956fa6a42f972da217cd4
SHA1 61fcbcb433f4a6a5e7bd8ba7a106e1614f1e2e23
SHA512 aa19e8dd535ccb322665760acda23ac158b2ed2023806faa5713dfb21f0a8cb715e70f0730f0ff886b587e9580a249783f13d908c0b0c942ddd06b9942f1fd63
SSDEEP 768:3olCJwzBAYtDm52A8iYHhtlsNpJi3VejuQHGJ:IdrEg3DFejOJ
TLSH
T1B0B2E19ED7B24D83856984C8503B7307A69E2F1F6F56139B0B4B3E63B8D48633D90287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is990F.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is990F.tmp
Size 1KB
SHA256 b89eb993caae5618f0a2549b1d66561cda37c86266fbb766762f686d89e6219c
MD5 64251fe86b41f8dc92a3ed82e5a3bcd2
SHA1 10825cabc2c6596487d5b498c65d2965b3503ff5
SHA512 c903a05616a472540f2468c610fb9482407bf7a798b27ee5b259992b014ee98c555b8a90549c4a41118f1dc8638cd48aeb44cdce12aa99d23aee79ab961e37a1
TLSH
T12C312943DEE62446D8056789A75D018BF58F92C0A26628714CFCCD490D787A9968FCB7
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6096_1894818773\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{3785BD4A-9C76-449B-99D5-A29051A1EB73}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{3785BD4A-9C76-449B-99D5-A29051A1EB73}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

ISBEW64.exe

Path C:\Users\Admin\AppData\Local\Temp\{A206003E-A84B-4978-96A5-0030728A2DD1}\ISBEW64.exe
Size 104KB
SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
MD5 b83d2774cdaf5016cd8765a630fa1150
SHA1 50b7f86488926c6b06322af6a5176e4c7786058d
SHA512 90fd6c47d658491acfd54a1cb7d76bb01c3e6f58b4df4466998411d73e497a305dac13798182448289052f836c92958ca42b69bb14549d51aea4a0f92e665727
SSDEEP 1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
TLSH
T1D8A3295B77A4A0F5D026D27AC9929A85EBB2BC601F6103CF2721A39E1F337D15D3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.dll

Path C:\Users\Admin\AppData\Local\Temp\{A206003E-A84B-4978-96A5-0030728A2DD1}\ISRT.dll
Size 258KB
SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
MD5 3795427182d2dc8ce5609a342bc65313
SHA1 0e53a85d991526a9191d3b0f3007363b3649faf0
SHA512 6c3669b38b67ee37d99f452ad6b0f58102fd0db952e9f146b8e0ec409ce5bc61052d4cdb23c2eed4183b18baf529c86ac95bae420a90908d58d5f4399b0e1b76
SSDEEP 6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
TLSH
T15F4423A3BD494D2DF8864F3A37BE12B4543C3D367E605C13A021D9934FA076811BAB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isres_0x0409.dll

Path C:\Users\Admin\AppData\Local\Temp\{A206003E-A84B-4978-96A5-0030728A2DD1}\_isres_0x0409.dll
Size 540KB
SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
MD5 25f79c8f92b15d20d57142d27b43d45b
SHA1 4f9f50ee529ebd0b9e5f81958dfd33a5c3c912bf
SHA512 c989c69be10a560dc725c4433c48c6099da892b0ba21f90e5f9f4a68ce8c3cb630a9ea548da9781d6862d2c3408273987764e351598e614dbd6c76a90ea9e0c3
SSDEEP 6144:hhs4d9dcOaOdXGJ3hskkkkknffCp5CrRKlua8AHqPK8:7s4d9dfaOdWxq1qv
TLSH
T1E0C47000E6E5810EF2FEAB7498B21BA54EB23C519B3486FFBA95711D1471AD09C31F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\{DAFE41D8-2F42-416B-9EBA-08F67FC8EE8A}\IsConfig.ini
Size 518B
SHA256 2eabee26c71bbad0f0efb0ea36c1d5381b64ecd20ebd4f1999255ecc9cb797be
MD5 7f22f83b30788cc4ed52cbd931fb8cbd
SHA1 3fbaabfae3cc53247f216963e3184d218db8616d
SHA512 4b273821e07b85ffe8911d6e06a4dca8d51a1619a272422bf42ca8863ed28d02d08ba1de1b25ab0a598d2b388e46072f7b2dcc52c210b7756fbb1543149c25cc
TLSH
T1A7F0B49B3119F2BA642B9DAB993F01FACA793844075381455631AFC85EB023F02CEA08
MD5 SHA1 SHA512 TLSH

Submit Download

String1033.txt

Path C:\Users\Admin\AppData\Local\Temp\{DAFE41D8-2F42-416B-9EBA-08F67FC8EE8A}\String1033.txt
Size 172KB
SHA256 3006a59097077018878e6eb4b0afb5e56bcb37965e91cb366d165e9d342aaef3
MD5 852f1c923127e6484c5c03e9a7062f7e
SHA1 2daadd0049b6bb8ed8b6ab6b1adf9282aa5ecd72
SHA512 da221e7cfc0c7a06299565754d6b2dac951a546aad221d672356df61388ccf56bef214137de5e8b97c22fed13558c89555e0e8e54f2c6f86d5822c0e80eeb652
SSDEEP 1536:xuOLR6/K41VBrChTHB8WdK2hWA/z+wKZU6rPsHnQvvOuyMJice1VOL27pr:xJLu1UTh8uW9toeC
TLSH
T1AE047C56B7F90218F6F3BF95AEB550649E36BDE6A83DD21E1180100F0AF1E4099B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\{DAFE41D8-2F42-416B-9EBA-08F67FC8EE8A}\setup.inx
Size 271KB
SHA256 f254f723c28966f4327d37a5cb7b2d90a6ba05629485da35af1d66e6751a1b4b
MD5 fd7613d3d1e90a4427a5906b9d18841d
SHA1 62f253ec3c1a49d1b9659a41b69cb47b0b6b61e4
SHA512 d8b58b16d84dea5c3e9a90d525896e95bee3063c4ac139b4acb52966daf608cea2cd262695a3a5e1d1c85d8a905a0d2206b262c6ef6f3b156cc02e88aa7c3061
SSDEEP 3072:jWFzV61s2ENzP53up64FxygQhkvVaklSa3JJxE6xycLQ7BEjOFPbCwnGziqWGFgg:jcp61VFteIEeycQE6ZCwnzqWkD1qUv
TLSH
T11E44AFAC8D960F8EB7288AEAF8271CD035C1EC4DE1B545D7A3A2C5D08F794F941DD09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~98FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\~98FC.tmp
Size 5KB
SHA256 ea2632626267dbec4cb70943383edee30f1a370bbb6496468ed921e44d0c5a8e
MD5 1f66ff5fa8f586dbad86024b7cac018d
SHA1 a56c3e335bcae8ac1bdb3ac926b88d2d65c84a70
SHA512 0ee4e29b0e57f610d7b1121af99accb1f6c6236bf4728c4d3d104a076341af4a304ef32108a5c7950c93d74231ae05e7d90af0ce347cc30981522d4c4a0174d5
SSDEEP 96:rEhkMDxOslsT5Emqn0ON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYO7:YhJxOsls1WXcuQaEZhdxoIWRGcQbPr/v
TLSH
T17CC1BD172BF6111EF6F35B49DAF1043797267C11282CCA1C55E1435A28F2E828A27BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2AFA.tmp

Path C:\Windows\Installer\MSI2AFA.tmp
Size 141KB
SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
MD5 cf4b14337e2a58317d69079644b980ee
SHA1 de92fac8b7b49286b1be44885db3043a9806fdb8
SHA512 b9a135220b3ff77bbecf1bf3593fd326229b8ae47c7db0ad5ead1887be03eca533992e09cd57c771fa20616ddd8b72b2eee0a5b05d8a63df64bd4ec4992fd637
SSDEEP 1536:2v7QNZRrFws8gty+zEHX3TqYWaYprUTzFeMxRkgWGcRiBwc3y2NgnVCUv:2v7QNZRxws8g9GgRpr6bmGNuc3yQav
TLSH
T113E38E51B9928071E68D167D2879AB39AB3F9AE5CF208EC78324CD9C6D307D19D39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB01C.tmp

Path C:\Windows\Installer\MSIB01C.tmp
Size 2.5MB
SHA256 fa60bd473c72cbd4d297375b4d20c77c2f943055b88663229165620d3c40f0d1
MD5 9e39498aa0cdffef045ad61d003557c5
SHA1 2ee1f47ed1b4c58d913814f1af78418bec549538
SHA512 e5f45c1fd876021f6c26d828e42fb6ac70b413c595b9c093252ee32e95ade0042de6b1d5d32b29a2e23e89afdaedd603b65319ac71aa826e556d67bd82d5ff87
SSDEEP 49152:iP643xZw0YyiIRZfH1q7qtkoShSdLet0Dn7fBWkU+GkQB:W3xzYyi0ZfH1+Mkh46tcnTJvGkQB
TLSH
T16FC5E081B6E281E7F06601302D5677366BFAAC51AE11834B731B7B5C2E333907A697CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-476-0x00000000032A0000-0x0000000003346000-memory.dmp

Download

memory/912-145-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/912-183-0x0000000003720000-0x00000000037C6000-memory.dmp

Download

memory/912-180-0x0000000003880000-0x0000000003909000-memory.dmp

Download

memory/912-449-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/912-492-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/912-184-0x0000000003720000-0x00000000037C6000-memory.dmp

Download

memory/912-479-0x0000000003720000-0x00000000037A9000-memory.dmp

Download

memory/912-519-0x00000000032B0000-0x0000000003356000-memory.dmp

Download

memory/3148-428-0x0000000003630000-0x00000000036D6000-memory.dmp

Download

memory/3148-431-0x0000000003820000-0x00000000038A9000-memory.dmp

Download

memory/3148-401-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4612-123-0x0000000004190000-0x0000000004236000-memory.dmp

Download

memory/4612-124-0x0000000004190000-0x0000000004236000-memory.dmp

Download

memory/4612-76-0x0000000004400000-0x0000000004489000-memory.dmp

Download

memory/4612-79-0x0000000004290000-0x0000000004336000-memory.dmp

Download

memory/4612-99-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4612-41-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4612-129-0x0000000004580000-0x0000000004609000-memory.dmp

Download