Overview

overview

7

Static

static

3

2026-10-22...op.exe

windows10-2004-x64

7

2026-10-22...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 16:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_37c586715906f297ae11ab296cc137fd_elex_stealc_stop.exe
  • Size 1.2MB
  • Sample261024-t5ps1azz8m
  • SHA256 2cd6e7c7284872cd0d2e1e1c8cbe5c34d030b3648bfc14127713b101f13cab85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_37c586715906f297ae11ab296cc137fd_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_37c586715906f297ae11ab296cc137fd_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5956
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/lasvegasusa/Las Vegas USA Casino20261010102025.msi" DDC_DID=7301619 DDC_UPDATESTATUSURL=http://190.112.221.40:8080/lvcasino/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/lvcasino/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-10-22_37c586715906f297ae11ab296cc137fd_elex_stealc_stop.exe"
      2⤵
      • Use of msiexec (install) with remote resource
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5172
      • C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
        "C:\Program Files (x86)\Las Vegas USA Casino\casino.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=1740 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:6020
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --mojo-platform-channel-handle=2320 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5196
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3020
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4500
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3720
        • C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
          "C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --field-trial-handle=1724,699740798563780189,16970420341956826263,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Las Vegas USA Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
          4⤵
            PID:3280
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
            4⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fff710fc188,0x7fff710fc194,0x7fff710fc1a0
              5⤵
                PID:1964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,13706819262448685730,6442054623941978342,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
                5⤵
                • System Time Discovery
                PID:868
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,9662346311278517842,4458378265191489896,262144 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
                5⤵
                  PID:6072
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,10105888823140310943,16928063510155181872,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
                  5⤵
                    PID:3160
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,4760611068219489056,17976610057498230140,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
                    5⤵
                      PID:1872
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,4389971466232659881,6068100717185556150,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
                      5⤵
                        PID:3756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,6289312223533963426,7539580394733018311,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
                        5⤵
                          PID:1448
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,18131589713598472424,12087370737529296182,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
                          5⤵
                            PID:4476
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4476,i,6611144602220660042,12146334508772510925,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
                            5⤵
                              PID:4640
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5272,i,17250235401743190980,14584258067825082892,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
                              5⤵
                                PID:1728
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,5654928157647568780,4188964339968328342,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
                                5⤵
                                  PID:3664
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5660,i,5163452718279962162,11942194010618436919,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
                                  5⤵
                                    PID:1900
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,4947103041465288315,6143374838054616720,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
                                    5⤵
                                      PID:4164
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6401395027834328265,7727334488321177346,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
                                      5⤵
                                        PID:4432
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14108609529772084223,16706122591656806873,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                        5⤵
                                          PID:1864
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14108609529772084223,16706122591656806873,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                          5⤵
                                            PID:620
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9994049406341277736,2662459673487000065,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
                                            5⤵
                                              PID:956
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5169768394870201463,10654679021446573496,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
                                              5⤵
                                                PID:952
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,6040135171408558744,4843019753139821817,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
                                                5⤵
                                                  PID:3608
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,17895526377988514070,11270310736169698927,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
                                                  5⤵
                                                    PID:3064
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6640,i,3710823890998944373,17893458265758754110,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
                                                    5⤵
                                                      PID:4272
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6592,i,17202981731881415716,17061648228623539918,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
                                                      5⤵
                                                        PID:3392
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6532,i,6264737110843065989,1626472371433891004,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
                                                        5⤵
                                                          PID:2304
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4660,i,12073945336437286886,17371428191802733387,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
                                                          5⤵
                                                            PID:3248
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4504,i,3903935131554518175,2345689190691494460,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
                                                            5⤵
                                                              PID:5392
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7220,i,10796927072409670655,6716152236975414680,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
                                                              5⤵
                                                                PID:5496
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,6602713465211906382,10592520769758690774,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
                                                                5⤵
                                                                  PID:2480
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,2572614369701129660,12333937957355714490,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:14
                                                                  5⤵
                                                                    PID:5356
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,10094255497511654564,11555030061633827220,524288 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
                                                                    5⤵
                                                                      PID:4136
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=1268,i,4572480588253830770,5770047568483010171,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
                                                                      5⤵
                                                                        PID:6044
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4656,i,16364207145639969029,10963909037473185185,2097152 --field-trial-handle=2424,i,14973792044847216698,12343173216463833995,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:1
                                                                        5⤵
                                                                          PID:2756
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
                                                                        4⤵
                                                                          PID:952
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
                                                                          4⤵
                                                                            PID:5140
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
                                                                            4⤵
                                                                              PID:4344
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
                                                                              4⤵
                                                                                PID:5584
                                                                        • C:\Windows\system32\msiexec.exe
                                                                          C:\Windows\system32\msiexec.exe /V
                                                                          1⤵
                                                                          • Badlisted process makes network request
                                                                          • Enumerates connected drives
                                                                          • Drops file in Program Files directory
                                                                          • Drops file in Windows directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4128
                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding AD92DD0DC6346E0CDAB8EFE5625DF472 C
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Badlisted process makes network request
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6008
                                                                            • C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94358395-1DC9-4585-AA27-1DA72993C9FA}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2316
                                                                            • C:\Users\Admin\AppData\Local\Temp\{1D332A9F-2441-4259-AE05-1B1DDD1DDE3D}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{1D332A9F-2441-4259-AE05-1B1DDD1DDE3D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57365948-C926-4CDA-9408-00A5EF481513}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:1112
                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 3CB7C5C830BAD906620F860C564D9A95
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Badlisted process makes network request
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2580
                                                                            • C:\Users\Admin\AppData\Local\Temp\{F97CFBF6-72D4-4943-9690-728801628109}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{F97CFBF6-72D4-4943-9690-728801628109}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89B2C6F0-541E-499D-B6A1-C9BC1BB58B05}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2240
                                                                            • C:\Users\Admin\AppData\Local\Temp\{53C906E5-97CA-45CE-BDC9-D03454DAC3F4}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{53C906E5-97CA-45CE-BDC9-D03454DAC3F4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F4D6352-98B5-43BD-B8E2-AF771584E6A0}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:1336
                                                                            • C:\Users\Admin\AppData\Local\Temp\{421292B3-739F-4117-BE05-50C32B1A8461}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{421292B3-739F-4117-BE05-50C32B1A8461}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C45BE4D7-E31B-423E-BAA5-D9D532289912}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:2900
                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 66EE20EBE2FA058FCED8114F6C454343 E Global\MSI0000
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2968
                                                                            • C:\Users\Admin\AppData\Local\Temp\{BA25AC16-09DF-4968-A55C-5AAED661AA57}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{BA25AC16-09DF-4968-A55C-5AAED661AA57}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEF9015E-B782-4D9E-8A0F-EFD7AC2A8F3A}
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:4832
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                          1⤵
                                                                            PID:4828
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                            1⤵
                                                                              PID:5236
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                              1⤵
                                                                                PID:3276

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    e5a1b59.rbs
                                                                                    • Path C:\Config.Msi\e5a1b59.rbs
                                                                                    • Size 40KB
                                                                                    • SHA256 a44d15a68a684392f728925c86f55a895c50f1d24455a9798e7580da8963b059
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    browser_configuration.html
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\browser_configuration.html
                                                                                    • Size 3KB
                                                                                    • SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    11095e52-acfa-452c-9b58-83181fe4e61e.tmp
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cache\11095e52-acfa-452c-9b58-83181fe4e61e.tmp
                                                                                    • Size 193B
                                                                                    • SHA256 f8a8f3b4163fdd1ef1a0eef8a1961783cc1a678231039275d25c8c2531a0909b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    temp-index
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cache\Code Cache\js\index-dir\temp-index
                                                                                    • Size 48B
                                                                                    • SHA256 e26e6bd1373dc4456d675e9c24da3978772f0a909ef9651315784f5c2257b2d6
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cache\Network Persistent State
                                                                                    • Size 59B
                                                                                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    CURRENT
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cache\Session Storage\CURRENT
                                                                                    • Size 16B
                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    casino.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\casino.dll
                                                                                    • Size 4.5MB
                                                                                    • SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    casino.exe
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\casino.exe
                                                                                    • Size 20KB
                                                                                    • SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    casino.ico
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ico
                                                                                    • Size 45KB
                                                                                    • SHA256 6b56cc21c731e65c825fa4b87ba1cfde4001cc74c42eb345db2da7c728524e27
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    casino.ini
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\casino.ini
                                                                                    • Size 5KB
                                                                                    • SHA256 5e7ac57f831a003cf3fc9006ac86600f06fcd269caf3afdd86595a59a7c64b12
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cef.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cef.pak
                                                                                    • Size 1.9MB
                                                                                    • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cef_100_percent.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cef_100_percent.pak
                                                                                    • Size 262KB
                                                                                    • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cef_200_percent.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cef_200_percent.pak
                                                                                    • Size 413KB
                                                                                    • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cef_extensions.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cef_extensions.pak
                                                                                    • Size 1.2MB
                                                                                    • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cefsubproc.exe
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\cefsubproc.exe
                                                                                    • Size 328KB
                                                                                    • SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    chrome_elf.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\chrome_elf.dll
                                                                                    • Size 795KB
                                                                                    • SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    concrt140.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\concrt140.dll
                                                                                    • Size 246KB
                                                                                    • SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    d3dcompiler_47.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\d3dcompiler_47.dll
                                                                                    • Size 3.5MB
                                                                                    • SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    devtools_resources.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\devtools_resources.pak
                                                                                    • Size 1.5MB
                                                                                    • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    directsound.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\directsound.dll
                                                                                    • Size 221KB
                                                                                    • SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    extgame.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\extgame.dll
                                                                                    • Size 1.6MB
                                                                                    • SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    00readme.txt
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\00readme.txt
                                                                                    • Size 127B
                                                                                    • SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    albw.ttf
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\albw.ttf
                                                                                    • Size 165KB
                                                                                    • SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    mhb.ttf
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhb.ttf
                                                                                    • Size 3.8MB
                                                                                    • SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    mhgbb.ttf
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\fonts\mhgbb.ttf
                                                                                    • Size 1.7MB
                                                                                    • SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    icudtl.dat
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\icudtl.dat
                                                                                    • Size 10.0MB
                                                                                    • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Extgame
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame
                                                                                    • Size 99B
                                                                                    • SHA256 a670efcbb21b3d81a576874eed5c6938aafa560d2ea81f32364dd628bdf8ef4f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Extgame.ini
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Extgame.ini
                                                                                    • Size 743B
                                                                                    • SHA256 0813a9fa9720363ac7fc2916f5e41afba5fdf1fbcb390a4fdae77e4eae2995ba
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Fonts - Latin.ini
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Fonts - Latin.ini
                                                                                    • Size 605B
                                                                                    • SHA256 1b54bf4ea654beb5bb2f598ac859240175accaaecc7ab4fbf76beb92ceed68d0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Lobby
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby
                                                                                    • Size 2KB
                                                                                    • SHA256 15041407df58c9fb2240c4ab8815c786d9b8efd9f2b8864f9dfdf4329d98182d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Lobby.ini
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\installed\Lobby.ini
                                                                                    • Size 24KB
                                                                                    • SHA256 6db6a83951351c26e4854654c134ee81d54f8280e1e23d7fb3dd58da43bd354f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    lbyinst.exe
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\lbyinst.exe
                                                                                    • Size 504KB
                                                                                    • SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libEGL.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\libEGL.dll
                                                                                    • Size 305KB
                                                                                    • SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    libGLESv2.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\libGLESv2.dll
                                                                                    • Size 6.6MB
                                                                                    • SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    lobby.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.dll
                                                                                    • Size 2.7MB
                                                                                    • SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    lobby.ini
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\lobby.ini
                                                                                    • Size 6KB
                                                                                    • SHA256 baa6bc8b9c86ceec4bceee7c10b0e0ff4f84608df580bdb9a9e665fc3478c723
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    en-US.pak
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\locales\en-US.pak
                                                                                    • Size 219KB
                                                                                    • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    msvcp140.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\msvcp140.dll
                                                                                    • Size 445KB
                                                                                    • SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    msvcrt.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\msvcrt.dll
                                                                                    • Size 260KB
                                                                                    • SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    plibc32.dll
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\plibc32.dll
                                                                                    • Size 537KB
                                                                                    • SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    casino.mbt.rsc
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.mbt.rsc
                                                                                    • Size 18KB
                                                                                    • SHA256 4c90c8be26cd8ebc481c877550615172c3866f6649ed7ddbf62ccfe99d33572f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    casino.twd.rsc
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\casino.twd.rsc
                                                                                    • Size 18KB
                                                                                    • SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    chips32.chf.rsc
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\rsc\chips32.chf.rsc
                                                                                    • Size 239KB
                                                                                    • SHA256 831dac347a8193d0ab27306133cd9e7ff43f162f8686136b8ca48d7b28357a84
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    redirect.html
                                                                                    • Path C:\Program Files (x86)\Las Vegas USA Casino\temp\redirect.html
                                                                                    • Size 236B
                                                                                    • SHA256 67040de136aa34094c821d76c078682b7bfe5e9f2d9381a65209ee86571f61e0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    05063198-c37a-4d61-a6ca-49d441650c2c.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05063198-c37a-4d61-a6ca-49d441650c2c.tmp
                                                                                    • Size 34KB
                                                                                    • SHA256 cdf56905eb588d7fc3dfbaa6ac939c9e2897b792b138437f764529155c50a3fe
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    40e777e8-facd-4be8-8cef-2a5a87abfb71.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40e777e8-facd-4be8-8cef-2a5a87abfb71.tmp
                                                                                    • Size 34KB
                                                                                    • SHA256 5d010588500cb31ec2c5f4f4742d713f7d0ceae7985ee74900a1dd592b95934d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    8434885b-e780-459c-875f-2819d35a9f44.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8434885b-e780-459c-875f-2819d35a9f44.tmp
                                                                                    • Size 37KB
                                                                                    • SHA256 73da2aa0b1d3bb8f299cdcc83ad8a4bf3d90d444acc60acd2ddad58ab13f8403
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    11db8b12-48f9-4862-9804-a33747a323c2.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11db8b12-48f9-4862-9804-a33747a323c2.tmp
                                                                                    • Size 11KB
                                                                                    • SHA256 edb02cd7327f60e918b1480bb337aef13b6dbf25163d48be0ebd951e6120f43b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    63dd16cf-4bf1-4834-ab73-a20c30fe8dc5.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63dd16cf-4bf1-4834-ab73-a20c30fe8dc5.tmp
                                                                                    • Size 6B
                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    6476dd77-7754-4b38-8213-273c79aff3da.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6476dd77-7754-4b38-8213-273c79aff3da.tmp
                                                                                    • Size 29KB
                                                                                    • SHA256 7bb0538643ddd9abfebef56089609684e94e2f38c574f5907b098953a2685f04
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    temp-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                    • Size 3KB
                                                                                    • SHA256 5cda3bcb03bd1498825fde5a7288dec99090d93be2ad4867e479175b8ab7bfd7
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 3KB
                                                                                    • SHA256 1474693fbee8ac0d7861a4c6686d12f0719f2432fdaf07255014621c67a18246
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    e27e826c-3d3a-4108-a9cc-87ddb83499a3.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e27e826c-3d3a-4108-a9cc-87ddb83499a3.tmp
                                                                                    • Size 2B
                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    dasherSettingSchema.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                    • Size 854B
                                                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    10b84e03-483a-4548-a176-867fd47e8199.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\10b84e03-483a-4548-a176-867fd47e8199.tmp
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    2d4a2ddd-0c31-4978-940c-1e9c9296ae41.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d4a2ddd-0c31-4978-940c-1e9c9296ae41.tmp
                                                                                    • Size 40B
                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    sync_diagnostic.log
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                    • Size 4KB
                                                                                    • SHA256 c0c0fc66da79e4da4e758dec467c95039e31ebff0478b87f01667fdf3d9c79d7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    a0750f12-4804-4605-bf60-6d22167f28c1.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0750f12-4804-4605-bf60-6d22167f28c1.tmp
                                                                                    • Size 70KB
                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    b056431d-33cb-4edb-91cd-d72f9de0949b.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b056431d-33cb-4edb-91cd-d72f9de0949b.tmp
                                                                                    • Size 11KB
                                                                                    • SHA256 0901256724a667b474d1bde35885bd8b310b0e615a121326979419ad67f69498
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ab680512-3c14-48b4-9ea0-6fb5bab37090.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab680512-3c14-48b4-9ea0-6fb5bab37090.tmp
                                                                                    • Size 39KB
                                                                                    • SHA256 aa3f7d0e7b8b38ee0ba8737e6f797e77c493b2cd964879e004df3f5715fae7e5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    be8be26e-33f1-4869-beed-e6be592bc415.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be8be26e-33f1-4869-beed-e6be592bc415.tmp
                                                                                    • Size 38KB
                                                                                    • SHA256 fab9da560b69d96d4efc5c00e53ce5b824c29124df0191d6d4026e6a173610f9
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    e6bbbb5e-998b-4e79-b99f-c3d03675fb88.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6bbbb5e-998b-4e79-b99f-c3d03675fb88.tmp
                                                                                    • Size 40KB
                                                                                    • SHA256 7907994d50a29f8f278844a2dd01ac9f73ea075f8b931195989504213a0354c9
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                    • Size 158KB
                                                                                    • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    8ef710fc-3135-46d6-b6ec-f3908ccf7250.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ef710fc-3135-46d6-b6ec-f3908ccf7250.tmp
                                                                                    • Size 132B
                                                                                    • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    bebb4354-aad7-41b9-8bae-84c84e47ea6a.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bebb4354-aad7-41b9-8bae-84c84e47ea6a.tmp
                                                                                    • Size 13B
                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Fonts%20-%20Latin.ini~e9990b85f5cd97ad28cf2be6[1].zip
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2650NSE1\Fonts%20-%20Latin.ini~e9990b85f5cd97ad28cf2be6[1].zip
                                                                                    • Size 643B
                                                                                    • SHA256 1c2359284527f2d850eb551cb974c74a8e2ffb6b8adf1b0d825220073c3b3e8d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    package_list.ini[1].crc
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TOXJMFV\package_list.ini[1].crc
                                                                                    • Size 24B
                                                                                    • SHA256 fb8f27952943c2889156c124bf4c25913648df6134a1a28ce67e5580949547bf
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Fonts%20-%20Latin~e9d40b8cf5c497fd953db9d3[1]
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\Fonts%20-%20Latin~e9d40b8cf5c497fd953db9d3[1]
                                                                                    • Size 89B
                                                                                    • SHA256 339137603f0f8df7e1e519074516fcd1357766ba3412e33fa59d8428331a2b6f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    9d94c93c-d19c-4b81-b5f3-497e0e0f0a42.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9d94c93c-d19c-4b81-b5f3-497e0e0f0a42.tmp
                                                                                    • Size 1B
                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    MSI9CA5.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSI9CA5.tmp
                                                                                    • Size 1.3MB
                                                                                    • SHA256 77360190b94be924c7133a357280b726dc13921c11164bb988584feb55d5b63b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _is6A4C.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_is6A4C.tmp
                                                                                    • Size 1KB
                                                                                    • SHA256 fa7c24637ad513bb0115ff74abd6cb8ccc03970e4eefd5d0d4e1df1ee4a2104d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    _isE8E.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isE8E.tmp
                                                                                    • Size 287B
                                                                                    • SHA256 4f58db48f29507be1a54ee34e2820cc7e97324d0e82194559b8d5dabc15f2fa3
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    _isE9F.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isE9F.tmp
                                                                                    • Size 176KB
                                                                                    • SHA256 4e8aee7bc45c7f2882a14c01732d7c2b7c1341a63b397caace82ed452a0fcd80
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _isEAF.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isEAF.tmp
                                                                                    • Size 250KB
                                                                                    • SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _isECF.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isECF.tmp
                                                                                    • Size 50KB
                                                                                    • SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _isEF0.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isEF0.tmp
                                                                                    • Size 113KB
                                                                                    • SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _isF10.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_isF10.tmp
                                                                                    • Size 24KB
                                                                                    • SHA256 80c0e099a8190d76b7bf3781f065291bfcb8c39c53d3a3fd723d2dee4e841faa
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ac0def97-3a1b-46e8-8dfb-b6e73f7ff5a9.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ac0def97-3a1b-46e8-8dfb-b6e73f7ff5a9.tmp
                                                                                    • Size 10KB
                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    content.js
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1232_1249393082\CRX_INSTALL\content.js
                                                                                    • Size 9KB
                                                                                    • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    messages.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1232_1666892402\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                    • Size 711B
                                                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    String1033.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{1D332A9F-2441-4259-AE05-1B1DDD1DDE3D}\String1033.txt
                                                                                    • Size 172KB
                                                                                    • SHA256 6b42b7d30745e75dd004f65a005852ed15c38ba579aef09284dedffbb87696ce
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    setup.inx
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{1D332A9F-2441-4259-AE05-1B1DDD1DDE3D}\setup.inx
                                                                                    • Size 271KB
                                                                                    • SHA256 8661c52fd7ce0e09b38a7ad8c2dfae56d61bc7b8b569fb7473f1ce598a6a6484
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    0x0409.ini
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{87A5E658-D3DA-4689-835E-5B397668DA06}\0x0409.ini
                                                                                    • Size 21KB
                                                                                    • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _ISMSIDEL.INI
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{87A5E658-D3DA-4689-835E-5B397668DA06}\_ISMSIDEL.INI
                                                                                    • Size 20B
                                                                                    • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    ISBEW64.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\ISBEW64.exe
                                                                                    • Size 104KB
                                                                                    • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ISRT.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\ISRT.dll
                                                                                    • Size 258KB
                                                                                    • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    IsConfig.ini
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\IsConfig.ini
                                                                                    • Size 518B
                                                                                    • SHA256 94a529441420047f6fed8326e4f1b0563e73ac3331930c4ebd649fd451475d71
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    _isres_0x0409.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{E90F9EAF-EAC4-4BC2-904E-BCCAD9BCA2C7}\_isres_0x0409.dll
                                                                                    • Size 540KB
                                                                                    • SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    ~6A4B.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\~6A4B.tmp
                                                                                    • Size 5KB
                                                                                    • SHA256 8a5fdfb02222dcc39147c030d0fe5d3c9cc999763d4285a483812d8a7277cd6e
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    MSI1743.tmp
                                                                                    • Path C:\Windows\Installer\MSI1743.tmp
                                                                                    • Size 141KB
                                                                                    • SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    MSI81D8.tmp
                                                                                    • Path C:\Windows\Installer\MSI81D8.tmp
                                                                                    • Size 2.5MB
                                                                                    • SHA256 9d53e7e87921ae2f3b832553c9f04093be1add431cb26353de5d6a1e1e09f2e0
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    memory/620-1103-0x00000285FE5E0000-0x00000285FE821000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-480-0x0000000003800000-0x0000000003889000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-450-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-183-0x00000000039A0000-0x0000000003A29000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-177-0x0000000003800000-0x00000000038A6000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-477-0x00000000035A0000-0x0000000003646000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-146-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-519-0x0000000003360000-0x0000000003406000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-493-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/2580-178-0x0000000003800000-0x00000000038A6000-memory.dmp
                                                                                    Download

                                                                                    memory/2968-428-0x0000000003200000-0x00000000032A6000-memory.dmp
                                                                                    Download

                                                                                    memory/2968-402-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/2968-432-0x00000000033A0000-0x0000000003429000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-130-0x0000000004280000-0x0000000004309000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-124-0x0000000003D50000-0x0000000003DF6000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-126-0x0000000003D50000-0x0000000003DF6000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-93-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-41-0x0000000010000000-0x00000000101B4000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-78-0x0000000004170000-0x00000000041F9000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-73-0x0000000003FC0000-0x0000000004066000-memory.dmp
                                                                                    Download

                                                                                    memory/6008-72-0x0000000003FC0000-0x0000000004066000-memory.dmp
                                                                                    Download