d8364560a46eea096d416838b1dffb7130a5a38350ce5eaa4b4b126095f5e460

Analysis

max time kernel
97s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe
Size 1.2MB
Sample260814-mz5hyaaj7x
SHA256 d8364560a46eea096d416838b1dffb7130a5a38350ce5eaa4b4b126095f5e460
MD5 0d3ba7deace4f85f1f05e242edf47479
SHA1 db29b516017a7854f2b23815dbe069341dad2736
SHA512 eb89ddb352318ab3ff8f67bdfb18f24948d4c0e1b00025ed870d562706dad6825c664b5ec88a3140ad0009024fe10658a1b0e7e3361634ad0d87bd44235d3b33
SSDEEP 24576:4xNlFSIthzcjw4hfvyERsHo0VxvkTbFx7QWU9:47KIzyhh5Oo0wTbFlZg
TLSH
T17A455A1376C1C03FE2B215728C6F9EB846A17C275A30455BB594FE2C2EF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
4336	ISBEW64.exe
1624	ISBEW64.exe
4416	ISBEW64.exe
2932	ISBEW64.exe
4828	ISBEW64.exe
4752	ISBEW64.exe
1816	casino.exe
1156	cefsubproc.exe
5388	cefsubproc.exe

Loads dropped DLL 51 IoCs

pid	Process
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1520	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1508	MsiExec.exe
1816	casino.exe
1816	casino.exe
1816	casino.exe
1816	casino.exe
1816	casino.exe
1816	casino.exe
1816	casino.exe
1156	cefsubproc.exe
1156	cefsubproc.exe
1156	cefsubproc.exe
1156	cefsubproc.exe
1156	cefsubproc.exe
1816	casino.exe
5388	cefsubproc.exe
1156	cefsubproc.exe
5388	cefsubproc.exe
5388	cefsubproc.exe
5388	cefsubproc.exe
1156	cefsubproc.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
620	MSIEXEC.EXE

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	620	MSIEXEC.EXE
6	1520	MsiExec.exe
16	3740	msiexec.exe
29	1508	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\D:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Silver Sands Casino\locales\en-US.pak	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.chf.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\installed\Lobby.ini	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\lobby.ini	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\action_button.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.krw.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.brl.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.pen.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\cef_100_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.gbp.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\tables32.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\_patch\package_list.ini	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\libEGL.dll	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.cny.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.usd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.krw.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\extgame.en.st.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\options_new.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.usd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.pln.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\history.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\icudtl.dat	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\installed\Lobby	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.ars.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.try.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.twd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\sounds\cmn003.wav	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\casino.ini	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.zar.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\exit.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\sounds\cmn000.wav	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\libcef.dll	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.cad.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\quicklaunchtrigger.34.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\sounds\cmn004.wav	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\libGLESv2.dll	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\tbslot.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\swf_Download\casino-rsc.swf	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\_patch\package_list.ini.crc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino32.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.jpy.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\swiftshader\libEGL.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Silver Sands Casino\cefdebug.log	cefsubproc.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\cards32.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.gbp.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\sounds\cmn002.wav	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\cef_200_percent.pak	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.mbt.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.rub.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino32.en.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.inr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.mbt.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.php.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\cef.pak	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\casino.bd1.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.idr.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\chips.twd.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\rsc\MaxPayoutInfo.rsc	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Silver Sands Casino\winsound.dll	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE96C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF0C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4F5.tmp	MSIEXEC.EXE
File opened for modification	C:\Windows\Installer\MSIA1BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA711.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF910B235286201449.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34AC789EB77F6626.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF402C6CE32151B565.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{3d09ae41-f289-4cd5-9f0e-c8d4cb084359}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e5aa8e5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5C8.tmp	msiexec.exe
File created	C:\Windows\Installer\{3d09ae41-f289-4cd5-9f0e-c8d4cb084359}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE21.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cefsubproc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f00000000020000000000106600000001000020000000e3836e0c44ee96003cebedc4432406de0c90ba0c75c84d90853877124d8db56d000000000e80000000020000200000003e2da5866b867029c018264f03d8385073f43925be957e825eb054155efdd50e5000000052ea5ec5fab653d6921cd18fe41a953d378293cae9d953639c5c6598679387eb80433c9bc6a63387077d35e3572da9639e6e45585646d41ce6546258a53ca51e444edfb014ff3c757a68c1504562324d40000000660a235348b34d9b2aad2df77436630b6fe750b6a58ca0291cce78a2bd9140b3ba600b170f51801e6ec13b3580808114665624765cfeba97a4386713a84af341	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f000000000200000000001066000000010000200000009aadd3f0ec67b5c004eb48108fb48aa5496dab428621b5c533c562f8b09b8b8f000000000e8000000002000020000000f885d1000dd653f7d67c3162e3ab2ed570d99c7411478b9b5fad24e2fc5909bb500000009664a2359b4536b62ed7cb97635ea9e5b900467509dc2c5a267d12f0304b5944ef67346a75c35f9efc4eb4d9fef8e645c7c309a617eff2956c625d7ca0948a53d3e3f8f9c12bb4ba0c7d73e3d8c405e440000000bcafe59c36eb2f2c9f4c8746f4dacf6327e2b276b84851fed80405663f377166fbeca0b1b3d07fd2eaf735a0c74a8bbd9c75f8c705cd19f40e8ccdcaca51b618	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f00000000020000000000106600000001000020000000c634676ad930981db74ba6e9e9aeddef5c4b4c16dcf08450275b7f52b9ae0f64000000000e80000000020000200000004d17f8d417e475063c40e578daf3307947a8b693cd79f560b32b35e001bca79b100000009510b705dd0df0a16793cb6ba49bb083400000003fc4016a70c7d00012eb9de5ce38f2594c14db7f0d7f215c8a9be417048648b874579778691a2811d787d5a3650fea9308a1d38876650647688016ab192b94c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2573747891"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271899"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4972D0A-97CE-11F1-A4DC-5A8B93556056} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "anc515k"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\casino.exe = "7000"	casino.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = d18fa36ef00fdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f00000000020000000000106600000001000020000000ee330a2f028f7176d25326d844558fbb3f376bbe182fe01417c75a2a83b058d8000000000e8000000002000020000000421c787760c373777be6b53522401bf7ac5c74b836ba1f5d32f896d8e96195d010000000086f796c67e725021e8e9700381bd0c8400000000743a297b4d10f97b78cda0650cd76cc826e6373c52e3990b095963ca3912da2e3f6581f1240061dc76d8a4174f0534fe2e684ebd29ea709ccdab0a55fc3348c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f00000000020000000000106600000001000020000000b1e36d60d114b192344275372db3de664d33859bc93e4c79ab9e412271a9ae22000000000e80000000020000200000008178ae6c9d5be3f210bee61596ee978bae61f1dee8ad79236f8a37c290dce245100000007a1947c5f255f84fc2087bf0ea428241400000006b79177d41074d64f05f887af2deb3d4c1ce8f00b92449dc5973690da471205f6e749ad7a83777c1e066d004be6d19b42e700f494211852388e1ab40bda4d043	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = d18fa36ef00fdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000064bab954491d0647976a30d71c7faa6f00000000020000000000106600000001000020000000c6009c3b02411e85de639455e9c8c38ac4704aa14286d50e0b81eabc5f3c3236000000000e80000000020000200000006fef407c99e1ff4c9c3fda6cbd9543f47a983191258084d39c6a081a62744746500000003f80c1c290c8ab19827e7be68236b30bb69008301b88848e9d88b8e7f00765ede54c524008062e25269919fdc518e4cfc7f6e5c24f8325260db26b03697ea35c117bb158aafab81e0c6385d53c69eb3a400000003d9d8eac8fb53e3a19500cb81b31c037e1802f5202d8dba5fbe62df25f558db2a2fc15f799ba62c4416524df806606a733a7e494904860d9dae5f9d99aec66cf	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2571520447"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "5"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = d18fa36ef00fdd01	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\PackageName = "Silver Sands Casino20260711124749.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\URL\1 = "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/silversands/"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\rtg.silversands	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\shell	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}\ProgID	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\LastUsedSource = "u;1;https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/silversands/"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}\ = "Silver Sands Casino\uff00"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\ProductIcon = "C:\\Windows\\Installer\\{3d09ae41-f289-4cd5-9f0e-c8d4cb084359}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\CLSID	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\CLSID\ = "{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}"	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}\LocalServer32\ = "c:\\program files (x86)\\silver sands casino\\casino.exe %1"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14ea90d3982f5dc4f9e08c4dbc803495	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14ea90d3982f5dc4f9e08c4dbc803495\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FC6C186A71FA6884AB32ACFA7FA0AFCC\14ea90d3982f5dc4f9e08c4dbc803495	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\URL Protocol	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\DefaultIcon	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\shell\open\command	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\Version = "2584150016"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\shell\open	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\shell\open\command\ = "c:\\program files (x86)\\silver sands casino\\casino.exe %1"	casino.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}\LocalServer32	casino.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D6EE1DD5-E18B-4E7B-BA4B-24555FB12280}\ProgID\ = "rtg.silversands"	casino.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{40CB9FF5-B25C-4E8A-A3DB-F5180228D6D8}	cefsubproc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\ProductName = "Silver Sands Casino"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\PackageCode = "16B031C127D6F6C4790EF51D6A755FD2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\URL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\DefaultIcon\ = "casino.exe"	casino.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FC6C186A71FA6884AB32ACFA7FA0AFCC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14ea90d3982f5dc4f9e08c4dbc803495\SourceList\URL\SourceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtg.silversands\ = "URL: Realtime Gaming Protocol"	casino.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3740	msiexec.exe
3740	msiexec.exe
1156	cefsubproc.exe
1156	cefsubproc.exe
5388	cefsubproc.exe
5388	cefsubproc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	620	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	620	MSIEXEC.EXE
Token: SeRestorePrivilege	620	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	620	MSIEXEC.EXE
Token: SeSecurityPrivilege	3740	msiexec.exe
Token: SeCreateTokenPrivilege	620	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	620	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	620	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	620	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	620	MSIEXEC.EXE
Token: SeTcbPrivilege	620	MSIEXEC.EXE
Token: SeSecurityPrivilege	620	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	620	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	620	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	620	MSIEXEC.EXE
Token: SeSystemtimePrivilege	620	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	620	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	620	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	620	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	620	MSIEXEC.EXE
Token: SeBackupPrivilege	620	MSIEXEC.EXE
Token: SeRestorePrivilege	620	MSIEXEC.EXE
Token: SeShutdownPrivilege	620	MSIEXEC.EXE
Token: SeDebugPrivilege	620	MSIEXEC.EXE
Token: SeAuditPrivilege	620	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	620	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	620	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	620	MSIEXEC.EXE
Token: SeUndockPrivilege	620	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	620	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	620	MSIEXEC.EXE
Token: SeManageVolumePrivilege	620	MSIEXEC.EXE
Token: SeImpersonatePrivilege	620	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	620	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	620	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	620	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	620	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	620	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	620	MSIEXEC.EXE
Token: SeTcbPrivilege	620	MSIEXEC.EXE
Token: SeSecurityPrivilege	620	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	620	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	620	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	620	MSIEXEC.EXE
Token: SeSystemtimePrivilege	620	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	620	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	620	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	620	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	620	MSIEXEC.EXE
Token: SeBackupPrivilege	620	MSIEXEC.EXE
Token: SeRestorePrivilege	620	MSIEXEC.EXE
Token: SeShutdownPrivilege	620	MSIEXEC.EXE
Token: SeDebugPrivilege	620	MSIEXEC.EXE
Token: SeAuditPrivilege	620	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	620	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	620	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	620	MSIEXEC.EXE
Token: SeUndockPrivilege	620	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	620	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	620	MSIEXEC.EXE
Token: SeManageVolumePrivilege	620	MSIEXEC.EXE
Token: SeImpersonatePrivilege	620	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	620	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	620	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
620	MSIEXEC.EXE
960	iexplore.exe
620	MSIEXEC.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
620	MSIEXEC.EXE
3740	msiexec.exe
1520	MsiExec.exe
960	iexplore.exe
960	iexplore.exe
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
1508	MsiExec.exe
4184	MsiExec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 620	3800	2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe	89
PID 3740 wrote to memory of 1520	3740	msiexec.exe	91
PID 1520 wrote to memory of 4336	1520	MsiExec.exe	92
PID 960 wrote to memory of 1548	960	iexplore.exe	97
PID 1520 wrote to memory of 1624	1520	MsiExec.exe	98
PID 3740 wrote to memory of 1508	3740	msiexec.exe	99
PID 1508 wrote to memory of 4416	1508	MsiExec.exe	100
PID 3740 wrote to memory of 4184	3740	msiexec.exe	101
PID 4184 wrote to memory of 2932	4184	MsiExec.exe	102
PID 1508 wrote to memory of 4828	1508	MsiExec.exe	103
PID 1508 wrote to memory of 4752	1508	MsiExec.exe	104
PID 620 wrote to memory of 1816	620	MSIEXEC.EXE	106
PID 1816 wrote to memory of 1156	1816	casino.exe	107
PID 1816 wrote to memory of 5388	1816	casino.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "https://gmgall.cfcontentdnfls.eu/prodorigin/origin_cdn/content/client/pkgs/silversands/Silver Sands Casino20260711124749.msi" DDC_DID=2674802 DDC_DOWNLOAD_AFFID=16227 DDC_UPDATESTATUSURL=http://66.212.239.27:8080/silver/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://66.212.239.27:8080/silver/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-08-14_0d3ba7deace4f85f1f05e242edf47479_elex_stealc_stop.exe"
  2⤵
  - Use of msiexec (install) with remote resource
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Program Files (x86)\Silver Sands Casino\casino.exe
    "C:\Program Files (x86)\Silver Sands Casino\casino.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --mojo-platform-channel-handle=1740 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1156
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --mojo-platform-channel-handle=2260 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5388
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2532 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
      "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1728,2543655344606715515,12206822514792036024,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Silver Sands Casino\temp\lbyinst.exe
      "C:\Program Files (x86)\Silver Sands Casino\temp\lbyinst.exe" 00000718 EN C:\Program Files (x86)\Silver Sands Casino\_patch\Lobby\
      4⤵
      PID:5896
    - - C:\Program Files (x86)\Silver Sands Casino\casino.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\casino.exe"
        5⤵
        
        PID:5068
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=gpu-process --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --mojo-platform-channel-handle=1812 /prefetch:2
        6⤵
        
        PID:5276
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --mojo-platform-channel-handle=2300 /prefetch:8
        6⤵
        
        PID:1072
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2464 /prefetch:1
        6⤵
        
        PID:1356
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1
        6⤵
        
        PID:5688
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
        6⤵
        
        PID:4404
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
        
        "C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --field-trial-handle=1800,11548808304191831549,10656578103937932169,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files (x86)\Silver Sands Casino\cefdebug.log" --log-severity=error --disable-extensions --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        6⤵
        
        PID:3472

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8FE628EF383E80D1AAA06250D577C5D8 C
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\{6037153F-1D40-49E8-8A9D-5D2428D35BC9}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{6037153F-1D40-49E8-8A9D-5D2428D35BC9}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DC87E57-77C2-40D2-83F8-EC4E7F767CB7}
    3⤵
    - Executes dropped EXE
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\{BC36DF2B-5A67-459A-8BA3-0AFEAA180804}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{BC36DF2B-5A67-459A-8BA3-0AFEAA180804}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AED74E08-9CA3-48E1-A335-DE797C908C1E}
    3⤵
    - Executes dropped EXE
    PID:1624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87585EF465996680692E2FC11A5E7C43
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\{8C3C843E-A863-480C-BDCC-0DEAA170FC67}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8C3C843E-A863-480C-BDCC-0DEAA170FC67}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB400D81-87DD-4FF7-BF1D-37DCD5CE1B03}
    3⤵
    - Executes dropped EXE
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\{E279B120-C112-4535-BCF9-75F1B3716F15}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{E279B120-C112-4535-BCF9-75F1B3716F15}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CDB915B-AD30-4097-8F73-D3E50EFB1824}
    3⤵
    - Executes dropped EXE
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\{9B515C3D-BB39-4F32-868B-34FEB84EB4DF}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{9B515C3D-BB39-4F32-868B-34FEB84EB4DF}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{20A99986-CA53-464B-80C4-5999AE04F643}
    3⤵
    - Executes dropped EXE
    PID:4752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 036A5DE50CF2D965AF0F84D611369C13 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Users\Admin\AppData\Local\Temp\{6B8D4697-9E94-4999-9556-406CCAD8CF6A}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{6B8D4697-9E94-4999-9556-406CCAD8CF6A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E30E01F3-A715-43CE-9224-C3DC377C807B}
    3⤵
    - Executes dropped EXE
    PID:2932

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aa8e4.rbs

Path C:\Config.Msi\e5aa8e4.rbs
Size 39KB
SHA256 cdf4346462bc191b0a3ae9383638c531230fc9f89702f2cb806b628bc8c72970
MD5 cfedbde3b2eb3fb4d3a2e598d9621134
SHA1 271ba82a1860e6604dcbf058d219e2e78c625d70
SHA512 ad02d84da3527a66a57cd75f1ac8012369b391bb2c4434136cf7307ecbe92bb52c0b21f15ff24d012ac64c2832d0d34916aa6cec3c7126426dca41c4e948c640
SSDEEP 768:0wnMRCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdCtdC3:V7LWn
TLSH
T1C803DE854B00C7E6E1866F78FBFA0E183B31CCB8A3D00113669E8665C5D3B955BF8E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fonts - Latin

Path C:\Program Files (x86)\Silver Sands Casino\_patch\Fonts - Latin\installed\Fonts - Latin
Size 89B
SHA256 2d0cfb2885df05dfbf4fcd4fbd038d5cdd7cf1f383c248304f943cc1dab2b133
MD5 a65b8a6f571081343973a34189eec0a5
SHA1 7d653026d6bdfa7d983bb245ecd92480f80d4e70
SHA512 d9295f652ba98ed0e1b1a6632f746c6b6c7ec7c4da1aa676efe8be0f3bdda6064bc9377f1883680ce048a2c01396feaccaef79c94040e0658ff990a737122417
TLSH
T1A9B022220BA20028C0003C330AF0C3B32F3EC00CC0A8838200000030CCAC2000F82B00
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby

Path C:\Program Files (x86)\Silver Sands Casino\_patch\Lobby\installed\Lobby
Size 2KB
SHA256 3dc1f2ac70fc5c78c76f0e81b64eaf69c510c704dd05ac1b50cd9da0748ff9a6
MD5 22791d464ad3e2d4be2fcebd6b134507
SHA1 6f980dd5b44d8bf3da2a8ea4cc7e13b97c5b546f
SHA512 a2bbeef2c263dd57b89e9fb4eb811a1a326b694e03f6319f5cabe9996e33221fe2edbc3cc12f90e60f3a3bcbb5f7eb700b63f502a1fd9dd5733108d39090cdba
TLSH
T11D51D373B904AEA2BC08937E52AEB1B74E934D983C763575D9724150047F9C360AFB8A
MD5 SHA1 SHA512 TLSH

Submit Download

package_list.ini

Path C:\Program Files (x86)\Silver Sands Casino\_patch\package_list.ini
Size 133KB
SHA256 2e2bbd3571e8df8020c9093370911b571a569c21feb3792340acf22644f6b1cd
MD5 71e29e12fff386b3a7849b8e83dba673
SHA1 7f3b1c85c84ccae300f99b14ffe8cf743228788f
SHA512 b24df37f36833cecdd0c3570d9359a42c2c8418c513531ab6bf388f68c32969acfd0eda01ea711911ce073f55a2ba7ae9b3d298fd4d448558224c6380830d1b5
SSDEEP 1536:PdcG5hAdNKaI9hCTJatVTB0RRngtLxXPfNi:VcG5hAaz9h1tVtCRngBTi
TLSH
T1A7D3C333D3B4AB5779316D9A70E21E2F0E75A312D840AD88A2E2F6F74B9D4C8035B574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package_list.ini.crc

Path C:\Program Files (x86)\Silver Sands Casino\_patch\package_list.ini.crc
Size 28B
SHA256 29a06147987890d0d2ed1463001c7601caceee7d9465dc29293461170f7eab7f
MD5 47bd670c63ff68451e0125ce3a18ce9a
SHA1 17d401f1d53dbde2ec81661942b024d71a6ee8c6
SHA512 11acb50ca40051ae29f8f2121647e8b26c45483411d36bd60a7aa37a50d2135fb04cbb50729e095b50dc005a2e1dc5e33565d4a876910b70b6e8945361736920
MD5 SHA1 SHA512

Submit Download

package_list.ini.zip

Path C:\Program Files (x86)\Silver Sands Casino\_patch\package_list.ini.zip
Size 19KB
SHA256 419e6d3b0d80c3ae3986466a1b7fd632ca5041ce7a204c983a752063294456b9
MD5 eb5ba3dd21ed7d627dc91594ff5fd78e
SHA1 e5d5ecf52a59b07d27ee735a8d62ff5ea7e99876
SHA512 fe82e15443124eab32cd7530c83ac08efea793c7d151fdd540fca2f554f5450c3693c8c05e05f70f059c28444f0661ed41d3c97ba43849da44317cf0ecb9e3c6
SSDEEP 384:99lQ4WhS1UWZQbhUNoatGfSDR3H8RLXwl6yrDN/uN58z1QobWFnRPb:xGdWZvVH8REQoNTyoW5N
TLSH
T11B92E0F8BB88D549F0C64D99AB9C31B532C77B70EA5A5397C83758011620A022F9BEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_configuration.html

Path C:\Program Files (x86)\Silver Sands Casino\browser_configuration.html
Size 3KB
SHA256 cf07b4bd97989bd8cc67848eced7de5c9a1f67af15de7fabf914d7717ac12010
MD5 0d6ad6c487e8e290d0589d340ba5db48
SHA1 9072cf3e65596b0310d614527a48bb6463f91481
SHA512 76c3b0ee5e9e7dda9a74dd7dfd4c69ad7776b10b02a8fb1345d5ec1f4507bf5087da706c7754792b7e846c4cd652281a5bbb56135fe3bff1fba1575d5606d2e9
TLSH
T1AF81ACB9A89174137733627BB7DBA09CFB7209176144C162788DE21A2FF444185ABFF8
MD5 SHA1 SHA512 TLSH

Submit Download

f_000030

Path C:\Program Files (x86)\Silver Sands Casino\cache\Cache\f_000030
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\Silver Sands Casino\cache\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 acebac726f71feb1e698cbfb4bf6bddaa4abde76007c012060fe7d0ee46372d3
MD5 bd949839e5b263e724b0efc84baf5902
SHA1 e26297579d153b8c2cc6a8fe921f8167bf27f287
SHA512 85051432898dd91479074d7fbf718904e2fe9e012f50dbf135470bdade28650785c5e742199ffcac6326291a153d98866590b5c6c8776a36ccb6fb53a391413a
TLSH
T17F11C7256A8AD050CF00523AD0DA0D8A33780E8F02438F5347BB4D73E1DBBC2AA23365
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bd84b.TMP

Path C:\Program Files (x86)\Silver Sands Casino\cache\Code Cache\js\index-dir\the-real-index~RFe5bd84b.TMP
Size 48B
SHA256 57c89c69c593cf2d779ee01f21621e44d45bbbd8154687ce86a4bb6b0a1e4e69
MD5 ef433e09a20920df71567d0ff7c88058
SHA1 498051622177f55ec763b9b55aa1b871f44e92d1
SHA512 3138142dea1266f7c5ad54313051064b2ded05ff9faca17bec9f250a0ce4eca6608e144be6a3548f44cb9b3f342d1a573190f745543635c2e676b90dfee4362d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Program Files (x86)\Silver Sands Casino\cache\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\Silver Sands Casino\cache\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Program Files (x86)\Silver Sands Casino\cache\TransportSecurity
Size 2KB
SHA256 cf09c0fe0b625367d6ede522a5251ce6817bc127dd8d2abe9595f6d287bc4d6c
MD5 57a28352519ca45f85d4d8014789d999
SHA1 628294e3a5d7996e668177e82c87d9d7bfa16de3
SHA512 d285ba621715ce3e294dc91f8868aa040d91ff392182d8b545d3b5647e22bd423d6cefeeab895d87e5107f8d9de76588c02ee804072fac518635b8f8bcff30d1
TLSH
T18D41F79BD1BC5C6B61B9B83B1B586A42F026A33B11419CB6F67FC09C1F7096316058B7
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5bce68.TMP

Path C:\Program Files (x86)\Silver Sands Casino\cache\TransportSecurity~RFe5bce68.TMP
Size 2KB
SHA256 71b2cfd4c95e59ce2c8e0b5686b60a11cadc208c8809bd768aac0423a4f2be7f
MD5 bb235f793cdb4debd7d25ec1cfaf1637
SHA1 ef2aa8259d2c0819109032207d1d094ede58a862
SHA512 a4e6518f85901ad3cc94f73c87b5b7e1d4c7f94fe9c4f6ac6b283f1b92f35f02316f3b73694c4ea92b42133f1b432dfe9ee51e593b2adae4567fab520d2579b4
TLSH
T14E41F49BD1BC9C6B60B9B83B1F586A42F026A33B114198B6F77FC19C1F7096316058B7
MD5 SHA1 SHA512 TLSH

Submit Download

casino.dll

Path C:\Program Files (x86)\Silver Sands Casino\casino.dll
Size 4.5MB
SHA256 5b955a3ece721bd0f4f39f74591b874dc2e4a4528c8f45838567cc02a5a90d5e
MD5 4118fbad8ec0bb9a3b21c911d76d52fd
SHA1 fcee086f7327f719a1e40320b213c5b3ba03c314
SHA512 95aab12fafa5cc81841a82a6d2d3be336cd92a7fbef3ea87628a917337946d39d446f55bd7f3ffc47af13295ec9959890c4165bea63a6ac1fc8d13bcadf49589
SSDEEP 49152:r3AlgM/VBWpdU/T5goEPyUoBNVbEINKA6mvP8OBubWwg/fJQz/6w0fSsuRr3m3eo:r3AlgM/VBWe5glol/YA6ECz/6w0fVvN
TLSH
T183265D307702C13AEAEE10B69D7DEA4E5408BBA01B6404EBA3D81B5F7B745D33A32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.exe

Path C:\Program Files (x86)\Silver Sands Casino\casino.exe
Size 20KB
SHA256 d6ac634a5d11105770e6478b4ff65bf4d73e2d738d9229398a25820b814badac
MD5 61805738e66d9407cfba9b86136ee7df
SHA1 8de7b1de940ece408e238ed25d22f2032477e9cd
SHA512 1aba4a80e9adac8395dbf1db77efec9c269a16ccccbea54da92bc12a8a1f3e3132afbde21055f5f6fc1a32141bc71f58dba9ba0c5a2a155e935782689982a7c1
SSDEEP 384:b1LsT61EYFJeNC8QFJ4QOOmabJUoNwOj7S:b6T68NC84CdOjbmoWOj7
TLSH
T18E92730BAFF706E2CF93913A1C2191E76D3F64A0CE4C6537CA9439E9C434B36A42569D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.ico

Path C:\Program Files (x86)\Silver Sands Casino\casino.ico
Size 766B
SHA256 536777ef85e18ffb31bcadb16cd0e9c90996fabfc3c4de8696000013a0d22954
MD5 431f5096d43f8fa313aa139ae45399c2
SHA1 0b42bbf8d8345e06632cfca2246169df5afdf43f
SHA512 29cdac719dfa34d05c48fcd1e4088b5a9e6e544005253e84d239ff793d6c44fda3f634a4c1eb86e56d091762cc8add9af05934b01bcb49fdf20bc613748b4854
TLSH
T19C01C031971A612ED74113748983C7E045795C08771B1ED02D85FF5F2AF02F568045A2
MD5 SHA1 SHA512 TLSH

Submit Download

casino.ini

Path C:\Program Files (x86)\Silver Sands Casino\casino.ini
Size 5KB
SHA256 d6ba4dd3edd52be257cd70cd4720ca07a490d5b5c3860240ea6b11077ee39f85
MD5 042a3c81c7226a7bdf0cd39101c5825f
SHA1 8e88551efb7f606dd2f0f011297abbd247a86c51
SHA512 83a96fb3a508c1393b74eb25fec46aa82e7d9d8e770dd1252750b3ef9be7ac1bab4fccbfb140b1e8eaaf20c3bdffc11b48063b4b7d10f43d738900eb59bfaeb3
SSDEEP 96:Q2Sc9KCc4OGOwRu23Tk3TE3Tzw3TyAM8MVAMBHMbzIJaRQxkMjOt5mBo:Q2Sc9KKOwRBjkjEjMjyAM8MVAMBHMYJ+
TLSH
T1B5C194BD4221E93438719DEAB4E4B75D5C1E70B6C8019E04A938722E07DE1E960B5BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef.pak

Path C:\Program Files (x86)\Silver Sands Casino\cef.pak
Size 1.9MB
SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
MD5 dd85c83433f8417b4b7fefebb135b2ad
SHA1 a2ffcfddaa22218319ba1964226d6b676791bfe3
SHA512 cb3ac426807f4a1a55d48e9ccd459c465ed779c487811799899130d8e775960d64a87a8c10f5c8635799c23ef1f63bf6f2a05d87217c221d75806ce385542770
SSDEEP 49152:xuO6GF+4e3xlU2R4ipYMuOqnveEyjD8d16/pT:vFfehlU2R4TbOkvujkcB
TLSH
T1B1952310EDD56E66D7EAE779B4A4A1225D7A948349A0BC0CF0CF420FCBBD55A10B833D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Program Files (x86)\Silver Sands Casino\cef_100_percent.pak
Size 262KB
SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
MD5 9db96c13fa9c1c0ee63145665783798e
SHA1 560c075aa1378f4b42f17618374a53f520c0344b
SHA512 7e3d3f6072623b3186e50f11ad3696179c6d4e70c866ff969c12c6146b2a5dfcbdbdc331e1df32e203c98d347f53fda53f8ef9bd85dd41a0fa87bb4d6b6bb7bc
SSDEEP 6144:lNk7S+yq1H1yFepjbzwVyTYFhwEx5c1YC7x10fSucY7OP2ITQ:lNcXjxYF2kgf1d/dQ
TLSH
T1CE44F1F3B3B4BC7ED69B0A3371510A77D43A423A06530309C28689756E5AB94EDDE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_200_percent.pak

Path C:\Program Files (x86)\Silver Sands Casino\cef_200_percent.pak
Size 413KB
SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
MD5 4e5334990bb928aabd5a70bb894d085c
SHA1 97412161b8aa498c7285df8c5025b16985515a57
SHA512 323fe198f2c618aa2e16b45bd2bbc12745b1512abd1e87942b5ce6293d6090c228746a468745de826ca18c57cb49a1ac3b50c98dfe0aec0e9d155d7c6c8eb8a3
SSDEEP 6144:jk7S+yq1H1yFepjpDQYaR+9bGHgs4jTlvFhwIz73QYV85u/oFYvwoytKi6obByPF:jcXjGfIegs4jTZF2sg5u/oFFpxLlFYb
TLSH
T1319402E6F3F8AC79D9930E33511209B3D977153506A7030AC28B9C397D56B9889CE39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Program Files (x86)\Silver Sands Casino\cef_extensions.pak
Size 1.2MB
SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
MD5 589da360b8c57889db5fc8d541fd149b
SHA1 0527e2413154145a35a67084d7e8dad5b0f5bea0
SHA512 7d5f3e3c825725e2a6bdbf1f0d58831a976aee9fd944f1d9c9bb91cddd3287728e7535f91a721b57927d2e3f5db2df4afc11ce18338fb5c33a12b2bf6de43c02
SSDEEP 24576:U6rcKQtJb9RLONDAG13xdT0b+e/mp2IsWvRBr2k+CGFH3GrH/orJm22O+EcRc7Pb:UhxR6N0G1hdAKe/rIsWZBakZGpKHgryE
TLSH
T10B552330BA9C643FE0E0E7B0D9B850726A2C491729D5696CB29F825DDF8931903F197F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cefsubproc.exe

Path C:\Program Files (x86)\Silver Sands Casino\cefsubproc.exe
Size 328KB
SHA256 8a5ef089d1f99e8146ad1bf423e2251c817079f64327510d57586095e3477d85
MD5 3da07b7bcbef647a5452435cff33e82e
SHA1 cc16d8bf23da8c96787ac4d0da9cd19d527e0802
SHA512 c98036cc203fcc10f449d7d0641f40fd53f7be05e98aae9244959f175069eb0f76a226b9bb4a9bf56ec0686ebe3c77845b70da4f0fffbc53f58d2f96f4e64a50
SSDEEP 6144:vOZ6jwP9gN3lblEyT0V34vjRFDxBQ3fS:GZ6A9wxP0VEzQPS
TLSH
T181643B703B15C13BDE6110F25D7ADABF505CA2090BA178C767C82BAEDE716D22B3191B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files (x86)\Silver Sands Casino\chrome_elf.dll
Size 795KB
SHA256 859030f1f1659ccd59cb0a5bc133d9ed3a78be018e40658713183aa18346ff9d
MD5 b89e3241fb538533a3a19977e3dcab8f
SHA1 23060547c1dca7ceb0f190e3022b48eb568f8bfc
SHA512 07e15425adac13ba840afce1be804f7519b905dfbf54c78569219523c453f51415d3de4f5abb6980f6388a31b6b52fd18177250300c6b7a412447534e0da3d8f
SSDEEP 24576:XjjcLs8g0U/cAbbwjOVZ9wjZrDsCfTpQei:XjmLg0U7SOVZQGCbKei
TLSH
T1E605AF02B580D035D4661530912CE739AB3DE6194F248FDBD3C88CAA9FB15D16B3A7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Program Files (x86)\Silver Sands Casino\concrt140.dll
Size 246KB
SHA256 fb9772945dedba1c28fb523244dfc3a849eb9ebfe70b166687db03e196d5cd1e
MD5 3da20013485a5651b687711bf859d8b9
SHA1 6c4071f22f5f5c6b14b8019ad8becc2d2dd7a14f
SHA512 ffa88023f5c54674944f7ef2062027c76251e451c0ee42a6b4594ec503fe09e7118e73993c1bfc49f3e0497f42a980e53f4e6a70e11d3db55afda2c4e505c03c
SSDEEP 6144:HdynmUAZcA2pxuarMEc+vA54+0omeCrB/04LU+KS1yQZS0IuVx8i5S12z/VsTB:6pLnxB/0AncuVx8cz
TLSH
T19A345CE1344048F7F76F07328528D7BA94BEA68027EB81D71B6CA64D1E646C1EE33593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

console.log

Path C:\Program Files (x86)\Silver Sands Casino\console.log
Size 2KB
SHA256 06582704df01c84d38d61ca59748c729e12cb3e16edd6cd8be9d0817f0857ccf
MD5 378419108c87572e136385cd4180e647
SHA1 5e441c299fa5f2ccd75fc447625b8edaa0006251
SHA512 2883e03216f340237c539943589190371aa6bd72c006e33b869bc0902b513a392b6829fabd4c4a9b8f1348738285e9e32fda2873fcbf390feab2451a61786188
TLSH
T12951B1794F6CE83F9F84D78825917181EE78A2D69947A0F9F72451D23BA038E50CE32D
MD5 SHA1 SHA512 TLSH

Submit Download

console.log

Path C:\Program Files (x86)\Silver Sands Casino\console.log
Size 6KB
SHA256 1e0b42853da4d64c5b7321473d1a4312c4ac19f74e1437e6700afa1ee92852d4
MD5 54834436ac13a1b3c12b688eec14dc43
SHA1 ddf1306ea742038baa4ff7c5e70ce1990048deff
SHA512 e649b19e4313501ad57f0585bad1a1a9a6d7985bc348f13ac8ae4f80aff3ae048f19bbef81793f85b57f96e4a112047e19db5dd351c5a3e7f0506686616fa25b
SSDEEP 48:nlbIilm4oibVqKnibVqKLJbVqKbbVqKwbVqKgCbVqKUlbVYUTbVYUlbVYfbbVqK2:qiOqxTNmG6M9C2MiSBmCmMSEQp+x
TLSH
T19AD120764F7CE83F5F85D788A5917145E638A682A943E0F8F3A442CA37A12CF208D71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files (x86)\Silver Sands Casino\d3dcompiler_47.dll
Size 3.5MB
SHA256 8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
MD5 f76b1d2cd95385b21e61874761ddb53a
SHA1 e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA512 8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP 49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai
TLSH
T184069E20FB058176D8CB01B2A59D7BB6A47C9B31473440C361B4AE99FD712E32F39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devtools_resources.pak

Path C:\Program Files (x86)\Silver Sands Casino\devtools_resources.pak
Size 1.5MB
SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
MD5 c3ac46f4cd5b964a270f1f2758f8e773
SHA1 c7f888725085c5b5069374639e557db1f1cef922
SHA512 07d7653a28b4dea51361befcc1c88b01a7c43ca25197cf300c314a8650d69acab936bb060e963041ac14bca31d1730268d53ca013676fb32f5201a97c4ab877d
SSDEEP 49152:UWTnZD7WUC15ShDmDddtZ3gyzzYLxVi0UiHkNOs1:HnZD7PjgDlZAniWHRs1
TLSH
T1AA752302B15A2690F012BC3B540EA93453F7CAE57294A5B1D68E2A773CFF81BB587770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

directsound.dll

Path C:\Program Files (x86)\Silver Sands Casino\directsound.dll
Size 221KB
SHA256 8284c399fce472968369158bb218293f9320c61685aa3ed1ad99cff65ae8e575
MD5 0f7b6cb21b4e93caf046230c1a091a36
SHA1 9e9c761485a7594de547d527d9f1bfacfa702bf9
SHA512 4b2b12444a6f53cbd15549b9a971adc83fcaddd52de282b24dac4b628f1628e6cff696770d41b8fdfcda4db0c998485312e5389b3353c9383a800420448bcc0b
SSDEEP 3072:Y/X6+rZBE596vtGPY9eP4tdIsfn2SnDvq8rS/0cve8bMLAfKobRIYTh28c//dwBh:Yf6+rZB+92KPuLAbGk5UymR0l
TLSH
T18F248D017A9180BED5F60270D1AF749BE825172C17189CFB139C18F8D5A8DD7BEBAB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extgame.dll

Path C:\Program Files (x86)\Silver Sands Casino\extgame.dll
Size 1.6MB
SHA256 6c99a919f7afb4a875bdc3945c872f69cfcb50c4165463245ad9b56c4d34ec44
MD5 4006f992b454b8a1f3ec7c440f0fbfd4
SHA1 a4ad2dcf1ebf04b4ec5e6586365c5ce8aa2ab2cc
SHA512 40915659c81a3faf3f5e167368f91fb989e0654cc1d2fd79c4fe13bd6a525b549814026fc7053c94f813ffd6fe6c115302bfd55071a59f1190cc7a893ced106f
SSDEEP 24576:OsJraxp5TNZpLduGOIij+0jeZsDZhozg/3fXj1vJxguA/l9fGH3if1Vs:OKaxHD0CeK0/3f58/l9k30js
TLSH
T123754B717706C575DCCE12B59E28EE4F505CEA981BB004EBB2CC1B5EA8B51E32E31A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00readme.txt

Path C:\Program Files (x86)\Silver Sands Casino\fonts\00readme.txt
Size 127B
SHA256 2d1559db33df1c225532caf0bf973617f07e98828d06def38ea3ebfe6dccda6f
MD5 c75060e5255f8a3a07938a55c5b3d20b
SHA1 d786597681bc820488cd10f9d5263227ef5c09dd
SHA512 d53f2b4efa0ab9f682073d22656957471f42f2931db96fd2290a5125c1e8ec0054b9df1bcf1803fa7c26260cc38f8626a808c1fcfbc1d820b82eb9653d3f6c30
TLSH
T1C9B0920BF25AA075186D004B0546E1B33B7819EEA2D2841B628286DA020233BAB54D19
MD5 SHA1 SHA512 TLSH

Submit Download

albw.ttf

Path C:\Program Files (x86)\Silver Sands Casino\fonts\albw.ttf
Size 165KB
SHA256 5f2098d5212985da4174d960b932648f5147a7ab0a052e1e80a1aecdb9c4f34f
MD5 510a06a2a3192f5b99f26c3323a50a96
SHA1 2f0ed7a97b31e15c6baf14f86dcdb74d1dda6da5
SHA512 ca8f6230fbae73648fc19690ea5307ff3f368119cf7aa13f5b2c214b30c83c772924bc4f41cb0986238be3f28b9266ffcf209ba8b0c785ce18970b78cccce31c
SSDEEP 3072:huU7GC2Q0wZ485NdsDSPneJL2iVsweQaU/HfiUqydCPMR4O:gQ0wZ485NdsDS/ecimwhlqodR4O
TLSH
T1BBF38D4FE252FD37E2A0613DD528ABBB1613BC1D536AC69AE58D0A6F84CEF204F14750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhb.ttf

Path C:\Program Files (x86)\Silver Sands Casino\fonts\mhb.ttf
Size 3.8MB
SHA256 b7bd60f30e2573d6a998f92e90b60f909392ef5fd40b0e7d68fe0fb91c2e06df
MD5 ee060a995ae4fbd7f722646017560c99
SHA1 f6fc6770744a288aefd502b6e8280646b96da010
SHA512 b3f969311a21db77dc60cd9362cbeea422c4a6d3fb09b22190e65b62282288e0f93709659ed4387a2fbc104eb9edc83a04c1e972bbe6900682a72ae4ae58aec2
SSDEEP 98304:6unGP1IakNGkNbvK5ujgl7MK6oed9XnfU:6unfaVkNbSoUt56o29PU
TLSH
T14A069ED3CBDE9A1E11317C7D8500F09FB1C2C132072686965FAA2F3E540BE9A8AD7579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhgbb.ttf

Path C:\Program Files (x86)\Silver Sands Casino\fonts\mhgbb.ttf
Size 1.7MB
SHA256 e1ece397cd3efe0425b07cb5a2161e455cec3ea730543cd0c3ae3161608ceaae
MD5 824ba12e66960b01a30d52f7a30aacc2
SHA1 3e6f232a6aa6c11a0b13736c9308288000dafb2d
SHA512 abb8bb0153eb37e98b22c7b781d67faf7163b7701d180e4194d095d1914a3f8a593af2dc4f9cf58565d1ac9e00d7d980813118044e408477de24c93a7e43bfcd
SSDEEP 24576:zDvEYRHarD0NDay+AeveonSvltx0awmH757Xuh44N+seJEKuCMDSWgX5zMz0hJmU:3cvDGHBnKkH75m4Lseg+zU0T4pfU
TLSH
T1DF85BFD3CB9E9A5A91317CBC4900F05BB1C2C03247119AD71F7A2F3A540AEDA4BE7679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\Silver Sands Casino\icudtl.dat
Size 10.0MB
SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
MD5 bc7064ba87454ff6ae541132d6678c94
SHA1 ad0f0a5c7aa60e113706971f10b523c57e5ef075
SHA512 6899cb7ec0595e938f9efd6798b5646f5e4ca18ab257b57b8995e1dd2d152c1f7d355222ccf66e9a445997672f877cb0d137598020a0fd75b45743058dcb5445
SSDEEP 196608:a+wSv9AAQQ5EliXUxR0rHf93WhlA6tv1r:OKlQQuliXUxR0rHf93WhlA6tv1r
TLSH
T154B61742B2EB4DC1F9FBAE71D9F463639526BC05AE31815906042F3B5C773E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extgame

Path C:\Program Files (x86)\Silver Sands Casino\installed\Extgame
Size 99B
SHA256 10c0f7136acfc7d53e888946dd9cbb5c37985b1a2663c5fac4f7ae7d6fc8426b
MD5 81891ae9cc87dad5fa4d40a9786f1b9c
SHA1 655c37bd100b96cbf263527b6e0bfe6261bc5ed6
SHA512 78c87eeced3c019c00e70d9e11f3da6dd30a120bd158626b50325bf19f15cf2fced6c0c713f4f6cee97bfb09894390d7bc59c06e38ae57a9bf8d0ae7407e5e12
TLSH
T13EB0118A02CB8320C8BC3AB20200330B02A8EB80228C0303022200202CEABC20B0202B
MD5 SHA1 SHA512 TLSH

Submit Download

Extgame.ini

Path C:\Program Files (x86)\Silver Sands Casino\installed\Extgame.ini
Size 742B
SHA256 f8ae4139ac9a9034695a40c42e6357dbc62f1a17b5cf4c33449de80747e5e743
MD5 f5e279c81ef7e5472a02822ba59778bb
SHA1 ab2ec8e8956fd107b282b803fa80e6f21417515d
SHA512 35cc1af7a6a086561a99a3ced05fa8232451005810cb51bb21b1249f3ee60483fd9629eda3eed5089f8a68b111edc7452e66899b0b61b76c255bb2d052c06011
TLSH
T113019C1352E98F2584BCE984B6513CCB566B97A3100E701803F5B46936D52BA87DB12E
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini

Path C:\Program Files (x86)\Silver Sands Casino\installed\Fonts - Latin.ini
Size 604B
SHA256 8c96ced00f70f60a86fcaeec68063bd762111e510e0ceef528910a6921c761f2
MD5 f4d7ae61110ce95f301a531b7c5b7816
SHA1 ed41582691fd356440cd8ad86e81b9f81b2465e8
SHA512 add8a0ece0cdac22e6b520a4bacf515ed72d6613f9f199bd7ea570c5f08517f3c2448153ceaeb3738c1cb29d70669747d5982e18b3139f187e6d22e6f17aee5a
TLSH
T1ABF0A20216BC6F1E1500E5C1E1D71A3B9A76C8A364126E0A8BF0B49E19C526C42EBA7C
MD5 SHA1 SHA512 TLSH

Submit Download

Fonts - Latin.ini~e9d10b83f59f97bb0ce3ecce2298.zip

Path C:\Program Files (x86)\Silver Sands Casino\installed\Fonts - Latin.ini~e9d10b83f59f97bb0ce3ecce2298.zip
Size 631B
SHA256 51863aae87038967829b1caf9fae654f9ba0ed6a2ccc61872c8b80b407fcae7d
MD5 5e61f2c92f3b927f24d489cb4ffdbdec
SHA1 6c45f9dcbb3145116a5aceee819000d4a39beebe
SHA512 ef923bf1d7124ca09769dc8b7d732a87ac8f52a765f7e44a3fb08ccd6f576d85970168fcd748b0eac6b9a32c1d8a53cc01b41f658363b5fcd8e71bdbe41c0a97
TLSH
T19BF0688C6705EE33C24FA0705DC507A722065D00C5B14E4942BCA0865C09716CF7FE85
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby

Path C:\Program Files (x86)\Silver Sands Casino\installed\Lobby
Size 2KB
SHA256 cf8e71ef7dc8691cd2e7c74f704649fe625a29e950077132188f4349657a505b
MD5 3f157fa362af07fa4a07500d98b8b883
SHA1 cce910832a43c9bac359538accddfdb89242ae85
SHA512 204b186aa3d8061966913cd2b4b57382a7afef24041640802e3cd59a1a8560f33646560d15c1afe40f71ba88ce3f2702f2184cae35a07d48a9d2ba99f4026884
TLSH
T1F751D433B9046E96BC48933E52BAB2B74F934DD83C7A3535D8620150047F9C360AFB8A
MD5 SHA1 SHA512 TLSH

Submit Download

Lobby.ini

Path C:\Program Files (x86)\Silver Sands Casino\installed\Lobby.ini
Size 24KB
SHA256 c995b6aa0ca7fe5fe294bf903ce0bed2239a48dacb3c0ffea33e9808fdaaadce
MD5 1a115337eadb136da6f049123688b3a7
SHA1 108bc90df57bbe7076e704dfd3bf463cdc172ffd
SHA512 dbce8d130e5c8f7e916a60c1bac7db1e9a39fbc4554449442c6f1013ad85ca1796a388132bbfa06bf405e1ea31eb3e6d823a2f65c1b681ee659a374ba30e9746
SSDEEP 384:6M+j8KYBjtQ0afETsEQoiHdiiHri6+yCWhMBJfsAeQY6mxhA:y8KY00afcssIJbysuYDE
TLSH
T11EB20023A0CE1D162B10C57CB5E07C9B3677E9022837740996AAB38D67E17FE45DF4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lobby.ini

Path C:\Program Files (x86)\Silver Sands Casino\installed\Lobby.ini
Size 24KB
SHA256 6eb794d35be0cb9ce261472bb8389e639bf0bfda249a155b7a43292625ec4cda
MD5 b1480782399d222d54b126c31af230fa
SHA1 f4a7215b7c4438e9d4208b86896d9b529550dd5b
SHA512 267ddbd5bc0c5f6c2724a7f32f231bb17f492467cd80efd3717f64e590d16010e92c498a8a063d8ae5746c9cc68f1bdf9bb518838127a9f57704d8e0b96d5f27
SSDEEP 384:MKekwhpQsGEtKXfJBHfsFqT6aIqIfb7hW3IchxNOHdM:MKp1sGXR5sFs6aNQKEm
TLSH
T104B21F2360CE1D262B10C57CB5E07C9B3277E9022837740996AAB38D67E17FE45DF4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lobby.ini~e9d10b98f5da97fd1a90ecc9ab76.zip

Path C:\Program Files (x86)\Silver Sands Casino\installed\Lobby.ini~e9d10b98f5da97fd1a90ecc9ab76.zip
Size 7KB
SHA256 07542b59d8c95362b18220c7d4231eee9c73e04e0f0e84f1f20a0697734f4601
MD5 38fd55598e3180aed1042ff6062faef9
SHA1 9149a6e5457dea2623daf266adc2b77bc4913738
SHA512 a800e21bf8f5db031e0d098caa6408a5ea3fa6966045930ca1a62d3fb12319eb57d7a0db0836aa6feeaccf01cedaf4691cc198d6a91a412542b1470d2a9b5cd3
SSDEEP 192:p6wZIywOTWHUoa00CPq/GFb6iVtR8zbZCeIPR9d9h6U:p6wZIybSsx1eFjr8zbEeIZ9j
TLSH
T111E18F494E3981BB831B3FDF4D65036B74BC86B90C5811EE3CC06BBEAF495945E928D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbyinst.exe

Path C:\Program Files (x86)\Silver Sands Casino\lbyinst.exe
Size 504KB
SHA256 a12a5dc12d0e67a3df2143c8c33c9cbf09b9365fedd5b765e2bf7ccbd9f296cf
MD5 108cbf5d33ee178c900bec4056ce4891
SHA1 349e2e116f409f07ef0a8d1a41a42078c05f57e2
SHA512 d602626485c7b75ace34272a498c389df11d2d804547821ae5a9dd4e876ec8a36c2c0afa51084a8a8d2672a6103732999349ac111f12c5c000f7001d4f838810
SSDEEP 12288:7mUzrXwirssr+eA/sREmfw5viGqcxuJs7/vg/DCr8NBBXboO9:Lwiwsr+eA/sdIg/DCr8NLX
TLSH
T1D0B47D10BA80D032D67324B14AFEC5BE195C79314B1905DB77C80A7A9FA48F17E36A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files (x86)\Silver Sands Casino\libEGL.dll
Size 305KB
SHA256 d4f51412708eb811306618d9df0154bdb1ca456907fcb890dae594767f605cd8
MD5 d333565fded30d59c53db71fc4f58068
SHA1 3d258ac779383248a538c7f85ae3b834605898e4
SHA512 9273431f417b4e37fe7255cddf5da855c582818b52207f160b84b6886079c77937ab853b281a772ff508b8522aab1288fab700e1c4dda17cc371f656968735e4
SSDEEP 6144:etJvzntGgCdDbvqb21v+bl5azaijx5dGKWjDKPvUCffBWoDcd3UMzgiz0B:eHvzntBCdO+2bl5azzsKWjDKPsYIoDcq
TLSH
T10A649E01B940C036D19E01347628E77D4E3EBE615FA1C9CBD7984ABD4FB16C09A39B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files (x86)\Silver Sands Casino\libGLESv2.dll
Size 6.6MB
SHA256 9acfb1a6673eab250ea34d0bc30a41495bfdb55f311ea093240d673a742a19cd
MD5 fa78b488cf076522e1d0ab94a5f25f2a
SHA1 af11302aac45724c53f347de2f64a51fd301aeda
SHA512 a10127d72fe9ad09f30b1e6f84a0adc74c8d2003a5c0b68f59a0f9afff3765f2ff6d8ea0dfc4e618fff2d8d452e3ceca3fad59ba547eeba9ae4072d9e354a059
SSDEEP 98304:jBDaKvhQV6lJ5Z1TQjwWinEPRQMSffPqKQV2RP9lcKVL/ymJhGFO:jBD/v5Z1TQ1inEPWMSffPXRDwgG
TLSH
T1FC669E01B180816AD40B52745B2EB72DAF789B571D60CB47EB9CBCA8BFF1690264734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.dll

Path C:\Program Files (x86)\Silver Sands Casino\lobby.dll
Size 2.7MB
SHA256 41694688dc5b120ea0a2e23e314efde2adcdf562562dbc537738692b2228b9cc
MD5 949d0b0a8defcaff5fd3cc3253aca141
SHA1 4481f1cb3cf1d31a6be9a8d15abc701d67925618
SHA512 bad91f5048aba49d532c8f57bf42dc18bf0542d27d3946ab0fd325c6b17665c61ea47c6322634886f38ae82e56e925b0777a6d5e3385ab9f62250aa1826c65ad
SSDEEP 49152:0Ta8iZ+hgOz/YvQOl5qtAN0AvIJuzKRLVrqqV5yu76lBdH+cH5ths8sz0tK/uQxT:0Ta8iZ+90vBuAvIJuzKRLVrqqV5yu76t
TLSH
T1DBD52A30B215C13AD99F01B9A96DDB4E5029BE741F6454D3B2C85E3F697B0E32E31A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.ini

Path C:\Program Files (x86)\Silver Sands Casino\lobby.ini
Size 3KB
SHA256 8e313c697ec5aa9d1bd71c7b1118bd239433bf6c56280d98277fb0532ab18502
MD5 41e0891ee946e1b5d2734b5a7e69b089
SHA1 8235633489565ff6c3bdae95427ba85c3a0e9ba6
SHA512 6c8e8e9501b682cbd48d82bdc8640bd230c2ab40ea040914d6a5b31d4d558738e204b97ac3cc8276609a49111dfe782ce2abbd21daae10eb7e4d579ee710d561
TLSH
T1DA61111E03426378C907AB262D4C9146BFFE69D35146B443B58E44CDFBDB8574776306
MD5 SHA1 SHA512 TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\Silver Sands Casino\locales\en-US.pak
Size 219KB
SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
MD5 89a808057821042f7cb0b0200dd944d6
SHA1 6ad54a17fb954aed628920682dbe79cc192177ba
SHA512 45564bcdcb6e9062d861c7eee2aad5b262242f49ccf3b75c0a49f6cf84cd4f903318d53353efe84fc4737d5658384e045a8c9c66b7601cfd6579df271ff35513
SSDEEP 6144:st49es49j2ttM89ehSmCWfaYhf5Hx+AwL:sGeXifMWmCo5HkAwL
TLSH
T158245E0FF788223A069352627F0962B2FB35D05CA36126563CAD811C3377B69D2777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Silver Sands Casino\msvcp140.dll
Size 445KB
SHA256 5b920691e5273821987680fab51b91f9de89cf2c66c10c568dca57eaf2ae74fa
MD5 448b345bcac7ec3729f291229c942060
SHA1 5813e35f62f3c670d02cf18dfa0dca523108660e
SHA512 72d01d35716ad9e1fde5941854b811765479c73a7a3cdc9e3fefcd3a6aecf68657354599b5cd18e67c8b1a61a3d5756ae83b13963c08e7bb638e415236c9d136
SSDEEP 12288:xltXrXT8sqcLNvDbiv7TlkWBElGuIMyYehUgiW6QR7t5s03Ooc8dHkC2esrMnUv:xfXrXTXLNvDb0TlkWBElqYd03Ooc8dH4
TLSH
T195A42832BB4609B2E59913B971C9472297F9FC210361E3C39BDAF0292F656C17733A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcrt.dll

Path C:\Program Files (x86)\Silver Sands Casino\msvcrt.dll
Size 260KB
SHA256 2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
MD5 0b9c183d1565b48fa6e5d1d3d4b86bcc
SHA1 69697324c1e7ad80215fb07ecf6d786e378c568f
SHA512 c836a4789270b216f8505074ce34b11d0b509e14b25133f3aab8db55ba5451e150b6633c4392cc83c1007f64da1c824596ff4a77aab5f7d340be4f631b2935f8
SSDEEP 6144:yncoHbacxB5pdVEweKMph18/VhTORAeFMWiFaNF7R5LWCC0uOpL:yncIbac33dVfnM2/Vg/5Bhum
TLSH
T15744BE6239C1CCBAD1E241B80D973F3E8BBE99614032DD83DBE45ED41F20992A75B217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plibc32.dll

Path C:\Program Files (x86)\Silver Sands Casino\plibc32.dll
Size 537KB
SHA256 ac4410e755f9f5298ad22ad536163ef74284b627a4dcb72073b99e2e2070edca
MD5 0be09294cc2e30c10496717434f56135
SHA1 8bf0a2f558f58d671d30bfd7430dc20c1ddc77cd
SHA512 4250ced1b4d0c72a236fff658faa7d92939620add56224c2d44661c945c5e60aed8a02e97549a3c98b1d868fea07688eeca2308e725f8bfd202aebd9539c4b29
SSDEEP 12288:VqPpwewCY83HElJMcED2T0euWHsPu0IWtY+GKw7qSBj+:VGpICV3Y0iT0eu8sWspy+
TLSH
T124C47E10F201927BEDE701B7DEFE257F692D6710032919D792C828999B6A6F37E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.usd.rsc

Path C:\Program Files (x86)\Silver Sands Casino\rsc\casino.usd.rsc
Size 18KB
SHA256 42137de2e167e988a51a1f3c1394762be8d8241746a9b60697df479680edf233
MD5 a194baeac2b922b5c0c84e457567f244
SHA1 d9bcf55a740e71c65e932de518eea3f2e973139b
SHA512 6cf16d2dc12e09ffb5fa692c67126b1d45b6116c9b1f6eb1d28c8b2cbdf814b9320b5e260150af7f113dfd90dfdd5faf40b3f9459d9a691651241a23c8ad5dc5
SSDEEP 384:pfUZAq+GDYTNNVGu3WZOF8WM7A4eNEfUZAq+GDYTNNVGu3WZOF8WM7A4eN7+:pOH+GDYT3335lN4euOH+GDYT3335lN4B
TLSH
T143829D0F8A23B0D43AF6B8AE84D7C4CA6928D75649D8403F3F144F8D92E27E850F517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chips32.eur.rsc

Path C:\Program Files (x86)\Silver Sands Casino\rsc\chips32.eur.rsc
Size 239KB
SHA256 93be2824383f4b9539639112afd0c49d029d2c20d1a098f490f8f7e0248c7c8e
MD5 d46a07ebec5608c61687617d4fda3034
SHA1 657d58e434b38ae2e3492d0ebf572e3a3430d52e
SHA512 02604d3f9e3cc0665b508a4253d38170e7b034a463a4f1cdcb6b8b09a6ea38e00f0f7d20507811987cfb233d992327d539d02b12a2804d64a02c1bdafb6e49cf
SSDEEP 3072:ykqtJXvilrCSxeqN39UNKqPLqWFVtXBurr5jK1y6u+7nAkL:ykkK9CSfNU7tfxurtK1yYMkL
TLSH
T11934D0AF9AB0909FF99E75310DCE0202E76933BC8A673338A4C169DE4456E0B7F550B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
TLSH
T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R8JFAXD7\lobby.en.st~95354B28CB3654610073BD7433A891A3[1].rsc
Size 16KB
SHA256 5a7b338a6f0bc51b4d9ae109a83e7b398f85444449db0faecde03cc117fb5926
MD5 95354b28cb3654610073bd7433a891a3
SHA1 8bae1ff4e07b51e4165856ca319c7a515dc8d6ec
SHA512 7f34df9c5793499bdbd6cfba85114fe0519868454f6a0bce6fe2d88f5032f9bbda28c711e55e678a0378b6e17340d7dc0031f1d73a77a475efd49381afb04bfc
SSDEEP 384:XnTINGdUg3nUojCU4FY5AFNEPBfMgekFhaBEMXp++mFqU1dbbent1TWn:XT6GT3nxje/EP1eIvKqFqUH+jCn
TLSH
T14772D0E39A1A220EB3C9D13905D0CBC226B4E2F9A7C05D0D17E99818E6B65C73345D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T11M4IO9\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kno120D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Kno120D.tmp
Size 88KB
SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
MD5 002d5646771d31d1e7c57990cc020150
SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
TLSH
T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF93.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF93.tmp
Size 1.3MB
SHA256 201dd62bdd7937eb9ee3bf88cfae4b5bb40dea76cbf50cb7dfe9108e5fc3af3b
MD5 bdef03cb76f7302d9c4e5b3ab1847cde
SHA1 22b3423af32b670fa0b4f4f467a73e215f7ef48f
SHA512 cf6161cdac15bc1ae1ed286e1bee7554f44da32ea5f6eea5c2b7340bc0ed288d74e3edd89e9cce60233c24295e32db4fbe6353796c7b9b6927e94bf6a806325a
SSDEEP 24576:pZtTJNSLh+Lmk2GX4gDFQnet86s8n4ff/cd3+bIZlfhUZPYGkQgB:pZtTJghSjKettDnbckvJUqGkQgB
TLSH
T1F2551241F7C3C9A1C44D0535885B63FA4FB06D4AAE23A39B77993B2EBE72385BB40154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isA29A.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA29A.tmp
Size 285B
SHA256 6402310caff9d682a223e4d2892942578f181cfeaf46d6051c8bb786847dd5c4
MD5 bd98fc6a08f0fdfd567f9624af8c24b9
SHA1 eb22db5b0cd143ad0833b667ca5eb57b6ca78fbe
SHA512 00b99ab53498c0f1a437891234c6fab1fc2283b117e5ed8b4cd0271157be9638bc6078b3d0f48df11abbe32b95ca9e6a27e9df6e5069d25c591f4a6be649fcd3
TLSH
T1C9D0E7F7154BE751CC75C91542A7504050514C5C0D160B01D9954D644F4D5F05054038
MD5 SHA1 SHA512 TLSH

Submit Download

_isA2BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA2BA.tmp
Size 176KB
SHA256 6ab6daa55882dade63f9cd8ad4f8bf79990b783cbbbecbf06146d7a2e38906aa
MD5 7bb06106da743bee6538d40144f9b474
SHA1 d24a937c3932265f88c8142ffe78efb3f29d0b51
SHA512 6c9b03e2b7db570d6cc0193ebd1775a157a1ce4167b4666fe4f582bd45e66dc17a8af1c00a422d69fdec12209a9ba3019680661da5a5f43628cc8bbd52b24f97
SSDEEP 3072:0KGhuKr8IO2tV1uylt4c2UlwJ997Bi8WJjkpFi5wWvYMh0FQ3LG1R4s:HsuKrGNj1V7vW1YijpKa3eR4s
TLSH
T1530423D87ED454FC0F6C9986C0D22B119F06C7E9D6A02A1A83F677469FD1B73C80A749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isA2D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA2D3.tmp
Size 1KB
SHA256 bafb9df66cb68cf2e9fbafbfc5d3753685202f3f99a95aa74b9a177d740ac21d
MD5 8f48c0107c792983638de9473168798c
SHA1 b0a06dfeca68361724f1a85ce062bc6cd510a91f
SHA512 693c9355497fb927883f4ccb6427254f405c43663f99441a5dfa7d804beb7ccb0ce30e4dbbfde1f8d9cd55c6af29d9d0afb8d331e0f6630e49654530ec7a4353
TLSH
T1D831EA2D399E94CDC871DF0143D457DE7EF5AD7866DF10D474910936C41D001528F1E5
MD5 SHA1 SHA512 TLSH

Submit Download

_isA2DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA2DB.tmp
Size 250KB
SHA256 a95f7068fc5f6168dabc0ab9cacc158b7e93077889b52236bc6b117d35e32157
MD5 7e3602d08b22debf43e6258b02696f95
SHA1 8748ed67facb6377df485d00e10882ab6b7a6528
SHA512 3cecc3934f4b62482dbb7309a0f708b29d0b80539a9311bcd325cb62fab3a8e560079d0a4e3f23745486b41ef6ae365064d3353487baa9f9e7630bbb156811cb
SSDEEP 6144:oIBXRBD/TYBYIqR8qJWDW9z4+xbOSc22vts3VlP2U4tS9s1:h/GZDWG+xba22vUtTk
TLSH
T13F4423E09E1F910DEA611D4F6BDF46BCC27C3EBF69202C12E513E983166416D817AB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isA2EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA2EB.tmp
Size 50KB
SHA256 9b94b54057cc73f36f8193df3cc5af0d0980cf94a5e3f102a1d652d9b35ea0a4
MD5 d718690b4d422351afaad30fb5005958
SHA1 f2405024c9f0c8b8ec8680d36b76f2a2fe1eff50
SHA512 6c4d324c654649df9b6b427f3fd90eb28a6121f84574a78e87db2c8b9421da19c84da6a94fb0814d46f023c4d395e010bd5c6974c82c911e154e413c910c6dd3
SSDEEP 1536:orrmXs49qNUA7gwZwi4wVZ4gq0UnOsf1raUXlI:orSVqtzdGhn1f1plI
TLSH
T1FF3302C9A43975DD5886AEA7828E33D1F18B408C71D4EF4B93FC2562904ADE744F2CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isA2FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA2FC.tmp
Size 113KB
SHA256 e0c3583cda9929efe92454f87365f56177f11de88097261ed60d440fc5a16de2
MD5 b744f334a4db8788a3eeb1430cf48d98
SHA1 3778f36a74afc672b2d85e2caac61f6981b5a9ae
SHA512 596c086bcaa0ccc0f6d4ae65bf49ff8120650d6c8c7766d265be564520398b9ab29795bba46d6936d036b44166f8e8ee4f4363399299225c494c9e29f28f2358
SSDEEP 3072:vEEw9tYANVpotzJ54OFxPmkwhaavfdf2Uog+6neZt:8pHdNMtzJ5TFYkqaavfdf2+RU
TLSH
T1DBB312C86BE37A1599192FF0EC2623DFD11C428AB8362AF5462C47EA55F114FB07BD18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isA30D.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isA30D.tmp
Size 24KB
SHA256 6785ab8ffa5c9e113bf7c17daa80aec906fddbe030dfec583dfe59431df7d34a
MD5 9fd07fe842a0c4885d17f5c950bcbbc0
SHA1 c1cbe4850fda1e1aba45b8d46d98e7f6ddf1e01b
SHA512 2fe863ea4501181c4c760ffda9b7464ff5905007b3bfd7ef027700b2f60371be5a7ac50dd909a1a96fb1a26976991e8154e46014c2ca305b26400d24b9fc26cf
SSDEEP 768:3olCJwzBAYtDm52A8iYHhtlsNpJi3VejuQHGH:IdrEg3DFejOH
TLSH
T120B2E19ED7B24D8385698489503B2307A68E3F1F6F16139B0B5B3E63F8D48633D90287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{08DB52A5-BD1D-427B-AFB9-C017CDB5FB75}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{08DB52A5-BD1D-427B-AFB9-C017CDB5FB75}\_ISMSIDEL.INI
Size 20B
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
MD5 SHA1 SHA512

Submit Download

ISBEW64.exe

Path C:\Users\Admin\AppData\Local\Temp\{6037153F-1D40-49E8-8A9D-5D2428D35BC9}\ISBEW64.exe
Size 104KB
SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
MD5 b83d2774cdaf5016cd8765a630fa1150
SHA1 50b7f86488926c6b06322af6a5176e4c7786058d
SHA512 90fd6c47d658491acfd54a1cb7d76bb01c3e6f58b4df4466998411d73e497a305dac13798182448289052f836c92958ca42b69bb14549d51aea4a0f92e665727
SSDEEP 1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
TLSH
T1D8A3295B77A4A0F5D026D27AC9929A85EBB2BC601F6103CF2721A39E1F337D15D3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.dll

Path C:\Users\Admin\AppData\Local\Temp\{6037153F-1D40-49E8-8A9D-5D2428D35BC9}\ISRT.dll
Size 258KB
SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
MD5 3795427182d2dc8ce5609a342bc65313
SHA1 0e53a85d991526a9191d3b0f3007363b3649faf0
SHA512 6c3669b38b67ee37d99f452ad6b0f58102fd0db952e9f146b8e0ec409ce5bc61052d4cdb23c2eed4183b18baf529c86ac95bae420a90908d58d5f4399b0e1b76
SSDEEP 6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
TLSH
T15F4423A3BD494D2DF8864F3A37BE12B4543C3D367E605C13A021D9934FA076811BAB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isres_0x0409.dll

Path C:\Users\Admin\AppData\Local\Temp\{6037153F-1D40-49E8-8A9D-5D2428D35BC9}\_isres_0x0409.dll
Size 540KB
SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
MD5 25f79c8f92b15d20d57142d27b43d45b
SHA1 4f9f50ee529ebd0b9e5f81958dfd33a5c3c912bf
SHA512 c989c69be10a560dc725c4433c48c6099da892b0ba21f90e5f9f4a68ce8c3cb630a9ea548da9781d6862d2c3408273987764e351598e614dbd6c76a90ea9e0c3
SSDEEP 6144:hhs4d9dcOaOdXGJ3hskkkkknffCp5CrRKlua8AHqPK8:7s4d9dfaOdWxq1qv
TLSH
T1E0C47000E6E5810EF2FEAB7498B21BA54EB23C519B3486FFBA95711D1471AD09C31F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\{BC36DF2B-5A67-459A-8BA3-0AFEAA180804}\IsConfig.ini
Size 518B
SHA256 2a6de6b8c9428d3deab56e11545acb7f95e1d2eb5db8bedb61dac152664c626f
MD5 a8c4acbdd23566420a26badca94d319c
SHA1 43f6a502beb47db74a172a2bf2e3b2c49b500672
SHA512 c1d0d882ba1642096e56b55c16aadc3839b51d7988461211391c84c0e00ad58d3d520d1341ae7a8e380123f635c16d943616081833e90127175831ead25136c0
TLSH
T1A4F0B4DF7015F2BA74274DAB8A3F04BDCAB929440A5345058525FFC869B427E02CE955
MD5 SHA1 SHA512 TLSH

Submit Download

String1033.txt

Path C:\Users\Admin\AppData\Local\Temp\{BC36DF2B-5A67-459A-8BA3-0AFEAA180804}\String1033.txt
Size 172KB
SHA256 cd87f49530de08bed72f35d8d98202a49a3734e53f4b0d6149f341c18400c8c5
MD5 2e0a679a356d7fe6c5db9b8419e93aef
SHA1 e8ae7fc90ce066bdc45ce1b20532ba085abef53d
SHA512 e0e4f60f70346fdc9c506b1717d57d1ceacc4886378f73e8be1ab82c4deac7289dd4c2ca5cb388ca4d5b14b31962a0bc391a3d4ebee437ba8ec7b4d988c68ce9
SSDEEP 1536:xuOLR6/K41VBrChTHB8WdK2hWA/z+wKZU6rPsHnQvvOuyMJice1VOL27ps:xJLu1UTh8uW9toeZ
TLSH
T14B047C56B7F90218F5F3BF95AEB550649E36BDE6A83DD21E1180100F0AF1E4099B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\{BC36DF2B-5A67-459A-8BA3-0AFEAA180804}\setup.inx
Size 271KB
SHA256 4faadd85b0359858c042e46d85b0293afacda5b5c35bcd8d29aad5c7cb3e2e06
MD5 4eb333bc20788607e9224c40602ef878
SHA1 a9ec9f88f0811d6cc76a49a01af6f79108c860b2
SHA512 94061b468fbcb3817e74b39e2dcd26de43e61450827231f8990b238452c526cb1d0daabad81d4d1e47cc49e1b24a494bf79f650b575d29c3b690742242db707b
SSDEEP 3072:jWFzV61s2ENzP53up64FxygQhkvVaklSa3JJxE6xycLQ7BEjOFPbCwnGziqWGFgm:jcp61VFteIEeycQE6ZCwnzqWkD1qUl
TLSH
T15944AFAC8D960F8EB7288AEAF8271CD035C1EC4DE1B545D7A3A2C5D08F794F941DD09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~A2C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\~A2C0.tmp
Size 5KB
SHA256 328ea08dc6548562585b0a86f372f384764e27687d2ba617131ee8d3b2f620a1
MD5 3b1218d00b8f3fcba966465f7a8a7d57
SHA1 aac30471bac4ddd359df4cc0a0adaa02de73662c
SHA512 f2ada41b255459f1795f0f93feb03aa464754bc7601b485a705fc555a3d127fcaf358426d52823ebecbf3d96c639e065936391e4d0f7078c5aa6ec8f21347eef
SSDEEP 96:rEhkMGP4dB4gsT5EgIzBAeiON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05wT:YhYP4dB4gs1DIdAMcuQaEZhdxoIWRGcB
TLSH
T1A8C1D0172BFA001EF6F39B45DAF1453797263D51282CC61C55E0435A18F2E818A67BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA5C8.tmp

Path C:\Windows\Installer\MSIA5C8.tmp
Size 141KB
SHA256 0adf895701c34044e9a9060dd2beea9e69f99c1d6a48580d017f4d3a66b8b414
MD5 cf4b14337e2a58317d69079644b980ee
SHA1 de92fac8b7b49286b1be44885db3043a9806fdb8
SHA512 b9a135220b3ff77bbecf1bf3593fd326229b8ae47c7db0ad5ead1887be03eca533992e09cd57c771fa20616ddd8b72b2eee0a5b05d8a63df64bd4ec4992fd637
SSDEEP 1536:2v7QNZRrFws8gty+zEHX3TqYWaYprUTzFeMxRkgWGcRiBwc3y2NgnVCUv:2v7QNZRxws8g9GgRpr6bmGNuc3yQav
TLSH
T113E38E51B9928071E68D167D2879AB39AB3F9AE5CF208EC78324CD9C6D307D19D39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF4F5.tmp

Path C:\Windows\Installer\MSIF4F5.tmp
Size 2.5MB
SHA256 f2da0e2cfd8ad4d9c80afce7b139ab6ec71b8705cdd87a8a052f7c3fc9e7d182
MD5 8229eb466a31a0300f9f522be5965b27
SHA1 d2a38a407f9c7cbfaa72562e7a620b415ed1c4ae
SHA512 5a690cf3a9613e72eed10105fd90ef21d9688cbee76a7ecbfac62223f940993bc5edf3392bbb7409439e9a14e799126e62f9b63d310466de13a054d8a931fbf0
SSDEEP 49152:8P8jxz1XYy3fHcFlFWT02h6p7RttDndTdACUWGkQT:lx1Yy3fHcLsTJs1tNn9l/GkQT
TLSH
T1BCC50102F782C573C44D0634482BA77A4B39AD65CF2287877358BB1E7D72390BB76686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-523-0x0000000003520000-0x00000000035C6000-memory.dmp

Download

memory/1508-479-0x0000000003680000-0x0000000003726000-memory.dmp

Download

memory/1508-184-0x0000000003B80000-0x0000000003C09000-memory.dmp

Download

memory/1508-178-0x0000000003A20000-0x0000000003AC6000-memory.dmp

Download

memory/1508-179-0x0000000003A20000-0x0000000003AC6000-memory.dmp

Download

memory/1508-522-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1508-147-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1508-452-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1508-524-0x0000000003520000-0x00000000035C6000-memory.dmp

Download

memory/1508-495-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1508-482-0x0000000003A20000-0x0000000003AA9000-memory.dmp

Download

memory/1520-124-0x0000000004970000-0x0000000004A16000-memory.dmp

Download

memory/1520-125-0x0000000004970000-0x0000000004A16000-memory.dmp

Download

memory/1520-130-0x0000000004AA0000-0x0000000004B29000-memory.dmp

Download

memory/1520-77-0x0000000004900000-0x0000000004989000-memory.dmp

Download

memory/1520-80-0x0000000004770000-0x0000000004816000-memory.dmp

Download

memory/1520-93-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/1520-72-0x0000000004770000-0x0000000004816000-memory.dmp

Download

memory/1520-41-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4184-432-0x0000000003910000-0x0000000003999000-memory.dmp

Download

memory/4184-413-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4184-438-0x0000000003770000-0x0000000003816000-memory.dmp

Download

memory/4184-436-0x0000000003770000-0x0000000003816000-memory.dmp

Download