Overview

overview

7

Static

static

3

2026-10-22...op.exe

windows10-2004-x64

7

2026-10-22...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 17:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_320a46f0d8131a4446a8a011734bae3b_elex_stealc_stop.exe
  • Size 1.2MB
  • Sample261024-vww2dsbs5t
  • SHA256 7557e09697ae10fd690031fbce197eb2d3028af01cfe8b32dabad3d658e3d404
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 46 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_320a46f0d8131a4446a8a011734bae3b_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_320a46f0d8131a4446a8a011734bae3b_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/uptownaces/Uptown Aces20261014070027.msi" DDC_DID=13069422 DDC_UPDATESTATUSURL=http://190.4.90.2:8080/desert/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.90.2:8080/desert/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=downloadid CUSTOMVALUE02=13069422 SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-10-22_320a46f0d8131a4446a8a011734bae3b_elex_stealc_stop.exe"
      2⤵
      • Use of msiexec (install) with remote resource
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Program Files (x86)\Uptown Aces\casino.exe
        "C:\Program Files (x86)\Uptown Aces\casino.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=gpu-process --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --mojo-platform-channel-handle=1736 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:3012
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --mojo-platform-channel-handle=2296 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Modifies trusted root certificate store through registry
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:5008
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1704
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5884
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3600
        • C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
          "C:\Program Files (x86)\Uptown Aces\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --field-trial-handle=1724,5743255402217450497,10472273324873307336,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Uptown Aces\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5160
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5592
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9E57812D19A0E50ACB826D227002AD35 C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52960A73-6434-409E-BEE4-03C1DD51F928}
        3⤵
        • Executes dropped EXE
        PID:5876
      • C:\Users\Admin\AppData\Local\Temp\{399CD0D9-857A-4DD0-B1B6-AE60B37B2C2E}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{399CD0D9-857A-4DD0-B1B6-AE60B37B2C2E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF7CAA96-702F-4EDF-86A4-9B5B0E27257D}
        3⤵
        • Executes dropped EXE
        PID:5944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CBF15856F5B000547845E4CEE86553A6
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Users\Admin\AppData\Local\Temp\{CA60168D-FB7E-4949-BB24-64EA3F5C5AF9}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{CA60168D-FB7E-4949-BB24-64EA3F5C5AF9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1BC2738-3C4E-4A79-90DC-B18B1FC25324}
        3⤵
        • Executes dropped EXE
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\{149500F9-B172-40C5-9619-4507786386E8}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{149500F9-B172-40C5-9619-4507786386E8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2883A10F-B8BF-411A-8866-9576B69A90D7}
        3⤵
        • Executes dropped EXE
        PID:5188
      • C:\Users\Admin\AppData\Local\Temp\{6155891B-0905-4535-86CC-474E2EECCA07}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{6155891B-0905-4535-86CC-474E2EECCA07}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11E72E59-18E6-43BE-9B71-CD279D791601}
        3⤵
        • Executes dropped EXE
        PID:2576
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7324430A9CE35D6F97B3297B7691A6B6 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6016
      • C:\Users\Admin\AppData\Local\Temp\{323AE815-0941-4A91-AD34-C7C73F4B7BB4}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{323AE815-0941-4A91-AD34-C7C73F4B7BB4}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B8536450-DB78-4D1C-88FF-A46F57E3E62D}
        3⤵
        • Executes dropped EXE
        PID:1772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e59e3af.rbs
        • Path C:\Config.Msi\e59e3af.rbs
        • Size 38KB
        • SHA256 00fa54a0a14c77a70a018a9bc240dffa8d84ccd89bb20ad81abf8f314a02e7a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        browser_configuration.html
        • Path C:\Program Files (x86)\Uptown Aces\browser_configuration.html
        • Size 3KB
        • SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        62bbf7f9-aa7c-4930-9a64-45eb5cb41f9a.tmp
        • Path C:\Program Files (x86)\Uptown Aces\cache\62bbf7f9-aa7c-4930-9a64-45eb5cb41f9a.tmp
        • Size 187B
        • SHA256 42a2d236ff0bdb6a017e0e743edfb6eea10fb0d1f03e09082cd331d549c7cfd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index
        • Path C:\Program Files (x86)\Uptown Aces\cache\Code Cache\wasm\index-dir\the-real-index
        • Size 48B
        • SHA256 c880ff5af72ec7053268704c29229a7cacc7f05c5460f8ae259451c25b1734ec
        • MD5 SHA1 SHA512
        Submit Download

        Network Persistent State
        • Path C:\Program Files (x86)\Uptown Aces\cache\Network Persistent State
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Program Files (x86)\Uptown Aces\cache\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        casino.dll
        • Path C:\Program Files (x86)\Uptown Aces\casino.dll
        • Size 4.5MB
        • SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.exe
        • Path C:\Program Files (x86)\Uptown Aces\casino.exe
        • Size 20KB
        • SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ico
        • Path C:\Program Files (x86)\Uptown Aces\casino.ico
        • Size 23KB
        • SHA256 119ed270918603272e8429643588c0a0eef39f207f9b8e72d57ed69ab5f7e2b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ini
        • Path C:\Program Files (x86)\Uptown Aces\casino.ini
        • Size 5KB
        • SHA256 935ec764061800e6ee1b66ce30fbc0c3b96b45915d2fcf5062ed94c585cf181d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef.pak
        • Path C:\Program Files (x86)\Uptown Aces\cef.pak
        • Size 1.9MB
        • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_100_percent.pak
        • Path C:\Program Files (x86)\Uptown Aces\cef_100_percent.pak
        • Size 262KB
        • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_200_percent.pak
        • Path C:\Program Files (x86)\Uptown Aces\cef_200_percent.pak
        • Size 413KB
        • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_extensions.pak
        • Path C:\Program Files (x86)\Uptown Aces\cef_extensions.pak
        • Size 1.2MB
        • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cefsubproc.exe
        • Path C:\Program Files (x86)\Uptown Aces\cefsubproc.exe
        • Size 328KB
        • SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_elf.dll
        • Path C:\Program Files (x86)\Uptown Aces\chrome_elf.dll
        • Size 795KB
        • SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        concrt140.dll
        • Path C:\Program Files (x86)\Uptown Aces\concrt140.dll
        • Size 246KB
        • SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Program Files (x86)\Uptown Aces\d3dcompiler_47.dll
        • Size 3.5MB
        • SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devtools_resources.pak
        • Path C:\Program Files (x86)\Uptown Aces\devtools_resources.pak
        • Size 1.5MB
        • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directsound.dll
        • Path C:\Program Files (x86)\Uptown Aces\directsound.dll
        • Size 221KB
        • SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extgame.dll
        • Path C:\Program Files (x86)\Uptown Aces\extgame.dll
        • Size 1.6MB
        • SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        00readme.txt
        • Path C:\Program Files (x86)\Uptown Aces\fonts\00readme.txt
        • Size 127B
        • SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        albw.ttf
        • Path C:\Program Files (x86)\Uptown Aces\fonts\albw.ttf
        • Size 165KB
        • SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhb.ttf
        • Path C:\Program Files (x86)\Uptown Aces\fonts\mhb.ttf
        • Size 3.8MB
        • SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhgbb.ttf
        • Path C:\Program Files (x86)\Uptown Aces\fonts\mhgbb.ttf
        • Size 1.7MB
        • SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files (x86)\Uptown Aces\icudtl.dat
        • Size 10.0MB
        • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Extgame
        • Path C:\Program Files (x86)\Uptown Aces\installed\Extgame
        • Size 99B
        • SHA256 69a4295a020a91428f50b94a212286df0eae9840e4ee2a227384a4fc9084508f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Extgame.ini
        • Path C:\Program Files (x86)\Uptown Aces\installed\Extgame.ini
        • Size 733B
        • SHA256 22b91b85e941ba707a461ff8bc8e5eabe15109738966189ecbd799a315b534bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts - Latin.ini
        • Path C:\Program Files (x86)\Uptown Aces\installed\Fonts - Latin.ini
        • Size 603B
        • SHA256 79866cba45925eef08fd00ce6fdc33ce8a72d14ab011edf994f815901c44be5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby
        • Path C:\Program Files (x86)\Uptown Aces\installed\Lobby
        • Size 2KB
        • SHA256 a48cbc292621a3d07dffbf365d74f956773d0bd85fa68835223d62ffdc3b1f36
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby.ini
        • Path C:\Program Files (x86)\Uptown Aces\installed\Lobby.ini
        • Size 24KB
        • SHA256 764d1c3e45ac253fb2808645d71fe26af29b962671e9e20ad70688d79136f9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lbyinst.exe
        • Path C:\Program Files (x86)\Uptown Aces\lbyinst.exe
        • Size 504KB
        • SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Program Files (x86)\Uptown Aces\libEGL.dll
        • Size 305KB
        • SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Program Files (x86)\Uptown Aces\libGLESv2.dll
        • Size 6.6MB
        • SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.dll
        • Path C:\Program Files (x86)\Uptown Aces\lobby.dll
        • Size 2.7MB
        • SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.ini
        • Path C:\Program Files (x86)\Uptown Aces\lobby.ini
        • Size 3KB
        • SHA256 eb5b3b3ac4d416874c2728a643f0f19e7627c4ca20be943cd9e7441614ce2408
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        en-US.pak
        • Path C:\Program Files (x86)\Uptown Aces\locales\en-US.pak
        • Size 219KB
        • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\Uptown Aces\msvcp140.dll
        • Size 445KB
        • SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcrt.dll
        • Path C:\Program Files (x86)\Uptown Aces\msvcrt.dll
        • Size 260KB
        • SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plibc32.dll
        • Path C:\Program Files (x86)\Uptown Aces\plibc32.dll
        • Size 537KB
        • SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.mbt.rsc
        • Path C:\Program Files (x86)\Uptown Aces\rsc\casino.mbt.rsc
        • Size 18KB
        • SHA256 4c90c8be26cd8ebc481c877550615172c3866f6649ed7ddbf62ccfe99d33572f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.twd.rsc
        • Path C:\Program Files (x86)\Uptown Aces\rsc\casino.twd.rsc
        • Size 18KB
        • SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.chf.rsc
        • Path C:\Program Files (x86)\Uptown Aces\rsc\chips32.chf.rsc
        • Size 239KB
        • SHA256 831dac347a8193d0ab27306133cd9e7ff43f162f8686136b8ca48d7b28357a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package_list.ini[1].crc
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KPC5UXGI\package_list.ini[1].crc
        • Size 28B
        • SHA256 55e95dee00f2a573839d83669775563e3f535c60a401b786d972a0b82682b02e
        • MD5 SHA1 SHA512
        Submit Download

        Fonts%20-%20Latin.ini~e9d30b83f5cd97bc8e4d4069[1].zip
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T91QIA4C\Fonts%20-%20Latin.ini~e9d30b83f5cd97bc8e4d4069[1].zip
        • Size 629B
        • SHA256 1e13328f5ba4d6f73f97034367163591efdbfe5ea8eb46942c071f78274fc4ac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts%20-%20Latin~e9d10b9ff5c597ffdae6064fcfcf[1]
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6IN4COU\Fonts%20-%20Latin~e9d10b9ff5c597ffdae6064fcfcf[1]
        • Size 89B
        • SHA256 433e61878ba3426255c3f87d93bc97129935328b0c9a8136ab5f011d220f44d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI7B23.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI7B23.tmp
        • Size 1.3MB
        • SHA256 aae56004e371571e31abdf3b4e1d26460da94ed547cc3981899738348747d4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is4995.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is4995.tmp
        • Size 1KB
        • SHA256 65bd24ce59c63303871df9086646723748d9e8507bfe0888a1d9ab88cdc3e315
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isD619.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD619.tmp
        • Size 286B
        • SHA256 b1176ce13faf4a260fe8220ba06dffd7e2e52a4fb449f6922dfb2c057e52a795
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isD629.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD629.tmp
        • Size 176KB
        • SHA256 7beb250bd5edce6d5910953d5efa5c9575d9cb7a211ed5b72aff3cb592f023d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isD63A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD63A.tmp
        • Size 250KB
        • SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isD716.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD716.tmp
        • Size 50KB
        • SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isD726.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD726.tmp
        • Size 113KB
        • SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isD737.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_isD737.tmp
        • Size 24KB
        • SHA256 3ebed8271091b16d45706c226cc6571d0f9f1ff878b028af165a71310e80a43d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISBEW64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\ISBEW64.exe
        • Size 104KB
        • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISRT.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\ISRT.dll
        • Size 258KB
        • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IsConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\IsConfig.ini
        • Size 518B
        • SHA256 84db47515851711af5941c2c138c835f3e4d8494a1463d5a9e9e192a7e262011
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _isres_0x0409.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{00EF6A6B-E414-45A3-B1A6-68A3ADDD6DFE}\_isres_0x0409.dll
        • Size 540KB
        • SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        String1033.txt
        • Path C:\Users\Admin\AppData\Local\Temp\{399CD0D9-857A-4DD0-B1B6-AE60B37B2C2E}\String1033.txt
        • Size 172KB
        • SHA256 17b6ca40146fc2b05dee9af684fa78670c153641fe81a7f5906b964b0c97bb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.inx
        • Path C:\Users\Admin\AppData\Local\Temp\{399CD0D9-857A-4DD0-B1B6-AE60B37B2C2E}\setup.inx
        • Size 271KB
        • SHA256 600ca60b5c2414d71d6c3126aec4ce57d91daa2e3ee28f0b2c5bcee69861e6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{7D48DB83-2DCE-4A58-AE9C-61768159971B}\0x0409.ini
        • Size 21KB
        • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{7D48DB83-2DCE-4A58-AE9C-61768159971B}\_ISMSIDEL.INI
        • Size 20B
        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
        • MD5 SHA1 SHA512
        Submit Download

        ~4994.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~4994.tmp
        • Size 5KB
        • SHA256 8a39ea0ad30fbf0cb0c2aad66b521029e76b54bcf798b6e4ebe45915ea4cc71b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI60F2.tmp
        • Path C:\Windows\Installer\MSI60F2.tmp
        • Size 2.5MB
        • SHA256 d7da182518d0b2670aed451e110e51316c54fc5a3a5c2c9cc7bbf55aa1e81c39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIDF99.tmp
        • Path C:\Windows\Installer\MSIDF99.tmp
        • Size 141KB
        • SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1064-518-0x0000000002970000-0x0000000002A16000-memory.dmp
        Download

        memory/1064-145-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1064-181-0x0000000002FD0000-0x0000000003059000-memory.dmp
        Download

        memory/1064-532-0x0000000002960000-0x0000000002963000-memory.dmp
        Download

        memory/1064-448-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1064-475-0x0000000002960000-0x0000000002A06000-memory.dmp
        Download

        memory/1064-478-0x0000000002E70000-0x0000000002EF9000-memory.dmp
        Download

        memory/1064-491-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1064-176-0x0000000002E70000-0x0000000002F16000-memory.dmp
        Download

        memory/2844-77-0x0000000004820000-0x00000000048A9000-memory.dmp
        Download

        memory/2844-71-0x0000000004610000-0x00000000046B6000-memory.dmp
        Download

        memory/2844-41-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/2844-96-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/2844-124-0x0000000004370000-0x0000000004416000-memory.dmp
        Download

        memory/2844-123-0x0000000004370000-0x0000000004416000-memory.dmp
        Download

        memory/2844-129-0x0000000004940000-0x00000000049C9000-memory.dmp
        Download

        memory/6016-400-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/6016-426-0x0000000003810000-0x00000000038B6000-memory.dmp
        Download

        memory/6016-430-0x0000000003970000-0x00000000039F9000-memory.dmp
        Download