Overview

overview

7

Static

static

3

2026-08-10...op.exe

windows10-2004-x64

7

2026-08-10...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_137fafc670418f8d78aa0b8ba6ff39fc_elex_stealc_stop.exe
  • Size 1.2MB
  • Sample260811-aee2bsxsa1
  • SHA256 6080e586484cb5fdd30139d008b39d96730df9cdbb2bdb235d5f918700255400
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_137fafc670418f8d78aa0b8ba6ff39fc_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_137fafc670418f8d78aa0b8ba6ff39fc_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/sunpalace/Sun Palace Casino20260710084637.msi" DDC_DID=1754041 DDC_UPDATESTATUSURL=http://190.112.221.40:8080/sunpalace/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/sunpalace/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-08-10_137fafc670418f8d78aa0b8ba6ff39fc_elex_stealc_stop.exe"
      2⤵
      • Use of msiexec (install) with remote resource
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Program Files (x86)\Sun Palace Casino\casino.exe
        "C:\Program Files (x86)\Sun Palace Casino\casino.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --mojo-platform-channel-handle=1756 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:4876
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --mojo-platform-channel-handle=2344 /prefetch:8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5380
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1320
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2392
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3712
        • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
          "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1748,1799030639115632499,18031826391845057076,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2228
        • C:\Program Files (x86)\Sun Palace Casino\temp\lbyinst.exe
          "C:\Program Files (x86)\Sun Palace Casino\temp\lbyinst.exe" 0000070c EN C:\Program Files (x86)\Sun Palace Casino\_patch\Lobby\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Program Files (x86)\Sun Palace Casino\casino.exe
            "C:\Program Files (x86)\Sun Palace Casino\casino.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4580
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --mojo-platform-channel-handle=1772 /prefetch:2
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              PID:2780
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --mojo-platform-channel-handle=2236 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3224
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4228
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4964
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3756
            • C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
              "C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --field-trial-handle=1760,11517323662918052434,6858088468197015110,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Sun Palace Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3012
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3A8A1B435BBFCD7EAC8B117F935068F7 C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4916
      • C:\Users\Admin\AppData\Local\Temp\{FB024182-7DB2-4191-A22F-38D1754B6738}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{FB024182-7DB2-4191-A22F-38D1754B6738}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA872F15-7E89-4842-A492-CD7E58CE3E11}
        3⤵
        • Executes dropped EXE
        PID:696
      • C:\Users\Admin\AppData\Local\Temp\{AF627CBB-1B07-4488-98C9-D48FACDCA56A}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{AF627CBB-1B07-4488-98C9-D48FACDCA56A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8B6F9BF-7912-4FB5-8D45-D37549FBAFF4}
        3⤵
        • Executes dropped EXE
        PID:2632
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CA8DE8CFC2C838D9034CFCAFDD442188
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Users\Admin\AppData\Local\Temp\{E7158D4E-7AF8-4E44-8D3A-CBD8ADAFAF1A}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{E7158D4E-7AF8-4E44-8D3A-CBD8ADAFAF1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C29DD1C8-C749-4C94-AE2E-047A081CC032}
        3⤵
        • Executes dropped EXE
        PID:5360
      • C:\Users\Admin\AppData\Local\Temp\{647D459E-E8ED-474D-83DA-F20DF55A676F}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{647D459E-E8ED-474D-83DA-F20DF55A676F}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE8DBD18-AD99-46B2-A8F4-DA1D3913550C}
        3⤵
        • Executes dropped EXE
        PID:5356
      • C:\Users\Admin\AppData\Local\Temp\{567C7D20-2B66-4106-9758-8720535D4317}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{567C7D20-2B66-4106-9758-8720535D4317}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F67A8264-94ED-48E9-95AF-9484EA986551}
        3⤵
        • Executes dropped EXE
        PID:568
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6867545EB2C48C95C4BC0E6E1AC8C2CC E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5928
      • C:\Users\Admin\AppData\Local\Temp\{A60C0D0E-8FC1-4A97-B86D-4E1DBD620250}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{A60C0D0E-8FC1-4A97-B86D-4E1DBD620250}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A37A114-FC05-4B17-966A-9BC575A8E2CB}
        3⤵
        • Executes dropped EXE
        PID:5748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a0987.rbs
        • Path C:\Config.Msi\e5a0987.rbs
        • Size 39KB
        • SHA256 429b1b16b52c9e272e9c09c39bad4bdd64251d3c49da0fa3d3ef4188e36f64d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Fonts - Latin
        • Path C:\Program Files (x86)\Sun Palace Casino\_patch\Fonts - Latin\installed\Fonts - Latin
        • Size 89B
        • SHA256 433e61878ba3426255c3f87d93bc97129935328b0c9a8136ab5f011d220f44d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby
        • Path C:\Program Files (x86)\Sun Palace Casino\_patch\Lobby\installed\Lobby
        • Size 2KB
        • SHA256 f7eeda41422e20a8eebc6ed7ee193152e152bf808b39402b68fe02bc2051e940
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        package_list.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\_patch\package_list.ini
        • Size 134KB
        • SHA256 e867cb175d9119ce777695d28cd9252da5adbad96607826b05dde4b037011cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package_list.ini.crc
        • Path C:\Program Files (x86)\Sun Palace Casino\_patch\package_list.ini.crc
        • Size 24B
        • SHA256 f7500e2cfa75debf4648766e6aa32a2736aecb9e4f87c4303528a3a1de8e3742
        • MD5 SHA1 SHA512
        Submit Download

        package_list.ini.zip
        • Path C:\Program Files (x86)\Sun Palace Casino\_patch\package_list.ini.zip
        • Size 19KB
        • SHA256 79d29d2c9ba9c3d351a81174c0f6d467586e74725fa6174bb9d8a85fd4bf732b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        browser_configuration.html
        • Path C:\Program Files (x86)\Sun Palace Casino\browser_configuration.html
        • Size 3KB
        • SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Code Cache\js\index-dir\the-real-index
        • Size 504B
        • SHA256 ec763a9805c9c23de22b455581c22881d43e2adbf88436c990d7911474042d34
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        the-real-index~RFe5b74fe.TMP
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Code Cache\js\index-dir\the-real-index~RFe5b74fe.TMP
        • Size 48B
        • SHA256 52619a5dcf3ff41fa351cd75d16f47c6bdf00066bda72c71d28dbd1cf545bae8
        • MD5 SHA1 SHA512
        Submit Download

        Network Persistent State
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Network Persistent State
        • Size 111B
        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Network Persistent State~RFe5af752.TMP
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Network Persistent State~RFe5af752.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CURRENT
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Session Storage\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path C:\Program Files (x86)\Sun Palace Casino\cache\Session Storage\MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        casino.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\casino.dll
        • Size 4.5MB
        • SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.exe
        • Path C:\Program Files (x86)\Sun Palace Casino\casino.exe
        • Size 20KB
        • SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ico
        • Path C:\Program Files (x86)\Sun Palace Casino\casino.ico
        • Size 53KB
        • SHA256 f1eb5b1acd40f43ad07b80564117cbe9a8bc2a942f4cf7b9b94a418b9eccc4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\casino.ini
        • Size 5KB
        • SHA256 fef61020ce5eee0f436a3b70998be28b4b9bb30607f760c8c3e5bcc264041c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\cef.pak
        • Size 1.9MB
        • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_100_percent.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\cef_100_percent.pak
        • Size 262KB
        • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_200_percent.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\cef_200_percent.pak
        • Size 413KB
        • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_extensions.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\cef_extensions.pak
        • Size 1.2MB
        • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cefsubproc.exe
        • Path C:\Program Files (x86)\Sun Palace Casino\cefsubproc.exe
        • Size 328KB
        • SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_elf.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\chrome_elf.dll
        • Size 795KB
        • SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        concrt140.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\concrt140.dll
        • Size 246KB
        • SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        console.log
        • Path C:\Program Files (x86)\Sun Palace Casino\console.log
        • Size 8KB
        • SHA256 c66894dab1e3bb99091f4522249a93aefc217d59e5c2098b30230aa31ae7c9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\d3dcompiler_47.dll
        • Size 3.5MB
        • SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devtools_resources.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\devtools_resources.pak
        • Size 1.5MB
        • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directsound.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\directsound.dll
        • Size 221KB
        • SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extgame.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\extgame.dll
        • Size 1.6MB
        • SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        00readme.txt
        • Path C:\Program Files (x86)\Sun Palace Casino\fonts\00readme.txt
        • Size 127B
        • SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        albw.ttf
        • Path C:\Program Files (x86)\Sun Palace Casino\fonts\albw.ttf
        • Size 165KB
        • SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhb.ttf
        • Path C:\Program Files (x86)\Sun Palace Casino\fonts\mhb.ttf
        • Size 3.8MB
        • SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mhgbb.ttf
        • Path C:\Program Files (x86)\Sun Palace Casino\fonts\mhgbb.ttf
        • Size 1.7MB
        • SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files (x86)\Sun Palace Casino\icudtl.dat
        • Size 10.0MB
        • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Extgame
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Extgame
        • Size 99B
        • SHA256 5c2539b6696d682ea2da5ce8f2756cd203c2d8af2a1979878ae6b51f7f8c7c51
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Extgame.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Extgame.ini
        • Size 746B
        • SHA256 3f4c588c4c1b410c52ad1c7484a3da7cc64cd4a9ebbead4ee6b5c64cb4dad9c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts - Latin.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Fonts - Latin.ini
        • Size 608B
        • SHA256 870717a7d48ccee4ba35bd5d768d73296f2a21f83431ea028e5515b9c524b78f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Fonts - Latin.ini~e9d10b82f5da97b843b6efab0ec0.zip
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Fonts - Latin.ini~e9d10b82f5da97b843b6efab0ec0.zip
        • Size 639B
        • SHA256 22373d02ca5652a442eef1efe3f714b4d24486d724c5a779e6e52312765e74ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Lobby
        • Size 2KB
        • SHA256 5f9f8d8b5031d63a4d359bbf6779a6525d368375470e25304cd67641cb895031
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lobby.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Lobby.ini
        • Size 24KB
        • SHA256 954ab1542337c348f3d338a7ceb7d213909add5d746b465fbd7b415045af816c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lobby.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Lobby.ini
        • Size 24KB
        • SHA256 887c8ef460f5a26ab201ee942041badd45eea8af9c81384bb6f7aff2f7a5861b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lobby.ini~e9880b91f5db97ad47a0d971.zip
        • Path C:\Program Files (x86)\Sun Palace Casino\installed\Lobby.ini~e9880b91f5db97ad47a0d971.zip
        • Size 7KB
        • SHA256 cbddc509b6b3b4306a075d0566a3a9ae0eece614a9823e69c75fdff7bb10a326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lbyinst.exe
        • Path C:\Program Files (x86)\Sun Palace Casino\lbyinst.exe
        • Size 504KB
        • SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\libEGL.dll
        • Size 305KB
        • SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\libGLESv2.dll
        • Size 6.6MB
        • SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\lobby.dll
        • Size 2.7MB
        • SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.ini
        • Path C:\Program Files (x86)\Sun Palace Casino\lobby.ini
        • Size 5KB
        • SHA256 8b393944f6ff0e6d0661255ecc3c57a498f66c8205079282c62f040580abc70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Program Files (x86)\Sun Palace Casino\locales\en-US.pak
        • Size 219KB
        • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\msvcp140.dll
        • Size 445KB
        • SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcrt.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\msvcrt.dll
        • Size 260KB
        • SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plibc32.dll
        • Path C:\Program Files (x86)\Sun Palace Casino\plibc32.dll
        • Size 537KB
        • SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        casino.usd.rsc
        • Path C:\Program Files (x86)\Sun Palace Casino\rsc\casino.usd.rsc
        • Size 18KB
        • SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chips32.eur.rsc
        • Path C:\Program Files (x86)\Sun Palace Casino\rsc\chips32.eur.rsc
        • Size 239KB
        • SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVKU0K2R\lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc
        • Size 16KB
        • SHA256 5a7b338a6f0bc51b4d9ae109a83e7b398f85444449db0faecde03cc117fb5926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIA3C9.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIA3C9.tmp
        • Size 1.3MB
        • SHA256 98a3886f5246b894ecd83f096218ce031488b7f6617b203d4d2b8c101b0d4cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is32E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is32E.tmp
        • Size 286B
        • SHA256 a13a32178857834fdab2c10ebb191a1c3cbfcff73b4b2bdc3474ed3994112f17
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _is33E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is33E.tmp
        • Size 176KB
        • SHA256 7e8c6b23677073a6934835a7f16e338c4f812896182defd1196d4b0ed3c1348c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is34F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is34F.tmp
        • Size 250KB
        • SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is360.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is360.tmp
        • Size 50KB
        • SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is380.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is380.tmp
        • Size 113KB
        • SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is390.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is390.tmp
        • Size 24KB
        • SHA256 b810e1ebe4422b3fa214b4c1765525311f5f5d78e675d771c777c3ef935c8355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is723D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is723D.tmp
        • Size 1KB
        • SHA256 a5c9b1b5e55055e689284758717b48c04a5c64f296c5c12b42894491276fc689
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{4EEE15FA-B153-47E5-B07F-7A4AB6367528}\0x0409.ini
        • Size 21KB
        • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{4EEE15FA-B153-47E5-B07F-7A4AB6367528}\_ISMSIDEL.INI
        • Size 20B
        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
        • MD5 SHA1 SHA512
        Submit Download

        IsConfig.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{AF627CBB-1B07-4488-98C9-D48FACDCA56A}\IsConfig.ini
        • Size 518B
        • SHA256 e2841653a03007799b86c6bdae370b9f50bac23fdf24a79ae96844434f11bb48
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        String1033.txt
        • Path C:\Users\Admin\AppData\Local\Temp\{AF627CBB-1B07-4488-98C9-D48FACDCA56A}\String1033.txt
        • Size 172KB
        • SHA256 c165956b937e61166481525cc5f059889ba6d1613742b7b73ca93626dd1dab3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.inx
        • Path C:\Users\Admin\AppData\Local\Temp\{AF627CBB-1B07-4488-98C9-D48FACDCA56A}\setup.inx
        • Size 271KB
        • SHA256 8325dfdac6026101222e9979d4f8dbeb4100bd904822fdf1f03b5eb232124b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISBEW64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{FB024182-7DB2-4191-A22F-38D1754B6738}\ISBEW64.exe
        • Size 104KB
        • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISRT.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{FB024182-7DB2-4191-A22F-38D1754B6738}\ISRT.dll
        • Size 258KB
        • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isres_0x0409.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{FB024182-7DB2-4191-A22F-38D1754B6738}\_isres_0x0409.dll
        • Size 540KB
        • SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~722B.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~722B.tmp
        • Size 5KB
        • SHA256 8beb26e2361016a1c188c6ff5b6dcc5474208154ee2d21b567eb81effec0212e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI5AF.tmp
        • Path C:\Windows\Installer\MSI5AF.tmp
        • Size 141KB
        • SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI89C8.tmp
        • Path C:\Windows\Installer\MSI89C8.tmp
        • Size 2.5MB
        • SHA256 e05ca8f7544f177147012200f7024204aecddd52f0cb3c3fdacf13c3e09526e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1528-478-0x00000000037C0000-0x0000000003866000-memory.dmp
        Download

        memory/1528-482-0x0000000003A20000-0x0000000003AA9000-memory.dmp
        Download

        memory/1528-495-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1528-523-0x0000000003570000-0x0000000003616000-memory.dmp
        Download

        memory/1528-522-0x0000000003570000-0x0000000003616000-memory.dmp
        Download

        memory/1528-537-0x0000000003570000-0x0000000003573000-memory.dmp
        Download

        memory/1528-479-0x00000000037C0000-0x0000000003866000-memory.dmp
        Download

        memory/1528-451-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1528-146-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1528-177-0x0000000003A20000-0x0000000003AC6000-memory.dmp
        Download

        memory/1528-178-0x0000000003A20000-0x0000000003AC6000-memory.dmp
        Download

        memory/1528-183-0x0000000003B80000-0x0000000003C09000-memory.dmp
        Download

        memory/4916-78-0x0000000004500000-0x0000000004589000-memory.dmp
        Download

        memory/4916-97-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/4916-124-0x0000000004090000-0x0000000004136000-memory.dmp
        Download

        memory/4916-125-0x0000000004090000-0x0000000004136000-memory.dmp
        Download

        memory/4916-71-0x0000000004360000-0x0000000004406000-memory.dmp
        Download

        memory/4916-72-0x0000000004360000-0x0000000004406000-memory.dmp
        Download

        memory/4916-130-0x0000000004620000-0x00000000046A9000-memory.dmp
        Download

        memory/4916-41-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/5928-433-0x0000000003470000-0x00000000034F9000-memory.dmp
        Download

        memory/5928-429-0x00000000031E0000-0x0000000003286000-memory.dmp
        Download

        memory/5928-430-0x00000000031E0000-0x0000000003286000-memory.dmp
        Download

        memory/5928-402-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download