076b9be47c4080ab74d79979e858524cb456c820f1c62a7535e706fea01d4d6a

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe
Size 20.7MB
Sample260813-eacgvsy1bt
SHA256 076b9be47c4080ab74d79979e858524cb456c820f1c62a7535e706fea01d4d6a
MD5 ba91d19194554fc67d4fba40a8b97e85
SHA1 4a01ce04fad04463a693c03267a9caa54d0adf13
SHA512 c021211cd0ff40daef47bbfa2902756efef3a04219b1efdc7238d5d8d8de52694285f72d73855f572fe2ea40862895f4fb99067734b4498bae2aa337cc3aa330
SSDEEP 393216:gJarI1KSRlYQOhSBylblDbzUWfnAB3JZykpxpN1Jm/Jr81T1zyV0w5MiTzxF59j:lrsT6hSBwJbgsABikp3zJt15zO0wuiTX
TLSH
T1B6273367445E17F7F5811672E8989BD30F743B628F7886CB6BA08133B9C02B56DFA042
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3956	remoting_host.exe

Loads dropped DLL 8 IoCs

pid	Process
2416	MsiExec.exe
2416	MsiExec.exe
2416	MsiExec.exe
2416	MsiExec.exe
4812	MsiExec.exe
4812	MsiExec.exe
4812	MsiExec.exe
3956	remoting_host.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\icudtl.dat	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_host.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_start_host.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remote_assistance_host.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remote_security_key.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_native_messaging_host.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_crashpad_handler.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\com.google.chrome.remote_desktop.json	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\com.google.chrome.remote_desktop-firefox.json	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\com.google.chrome.remote_webauthn.json	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\CREDITS.txt	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remote_webauthn.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_desktop.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remote_assistance_host_uiaccess.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remote_open_url.exe	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_core.dll	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\com.google.chrome.remote_assistance.json	msiexec.exe
File created	C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\com.google.chrome.remote_assistance-firefox.json	msiexec.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF5357E5-089B-4503-A777-6A0D7B01E5E0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2228.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591b1f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20AE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5zclpwnd.c5a.psm1	powershell.exe
File created	C:\Windows\Installer\e591b23.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{EF5357E5-089B-4503-A777-6A0D7B01E5E0}\chromoting.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAA9F5625A0BC55E5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF616B111E867742CC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3517.tmp	msiexec.exe
File created	C:\Windows\Installer\e591b1f.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE842205EA65584B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB640B44CD0D7C432.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI213D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xcabbeh1.ix5.ps1	powershell.exe
File created	C:\Windows\Installer\wix{EF5357E5-089B-4503-A777-6A0D7B01E5E0}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{EF5357E5-089B-4503-A777-6A0D7B01E5E0}\chromoting.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remoting_host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\Application\ApplicationCompany = "Google LLC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\Application\ApplicationDescription = "@C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll,-120"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\shell\open\command\ = "\"C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remote_open_url.exe\" %1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{e051a481-6345-4ba1-bdb1-cf7929955268}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\767F12B2751E6AF469C35538C441336A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{52e6fd1a-f16e-49c0-aacb-5436a915448b}\AccessPermission = 010014807800000088000000140000003000000002001c000100000011001400040000000101000000000010002000000200480003000000000014000b000000010100000000000512000000000018000b00000001020000000000052000000020020000000014000b0000000101000000000005130000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\ = "IRdpDesktopSessionEventHandler PSFactory"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\Version = "2382372116"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\Application	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{52e6fd1a-f16e-49c0-aacb-5436a915448b}\LaunchPermission = 010014807800000088000000140000003000000002001c000100000011001400040000000101000000000010002000000200480003000000000014000b000000010100000000000512000000000018000b00000001020000000000052000000020020000000014000b0000000101000000000005130000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}\LocalServer32\ = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_host.exe --type=rdp_desktop_session"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E7535FEB98030547A77A6D0B7105E0E\chromoting_host	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\PackageCode = "05F4C12F6BE2869449E0C5172E26CF0F"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\Application\ApplicationIcon = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll,-112"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{655bd819-c08c-4b04-80c2-f160739ff6ef}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{e051a481-6345-4ba1-bdb1-cf7929955268}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\ProxyStubClsid32\ = "{6a7699f0-ee43-43e7-aa30-a6738f9bd470}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\SourceList\PackageName = "chromeremotedesktophost.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppId\{52e6fd1a-f16e-49c0-aacb-5436a915448b}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}\AppID = "{52e6fd1a-f16e-49c0-aacb-5436a915448b}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{e051a481-6345-4ba1-bdb1-cf7929955268}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\ProxyStubClsid32\ = "{b59b96da-83cb-40ee-9b91-c377400fc3e3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\ProductName = "Chrome Remote Desktop Host"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}\ = "RdpDesktopSession Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{655bd819-c08c-4b04-80c2-f160739ff6ef}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\ = "IRdpDesktopSessionEventHandler"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\Application\ApplicationName = "@C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll,-119"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\DefaultIcon\ = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll,-112"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChromeRemoteDesktopUrlForwarder\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e22bc11f-1060-57f3-81ae-1df25b1ae931}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\ = "IRdpDesktopSession PSFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\142.0.7444.18\\remoting_core.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{e051a481-6345-4ba1-bdb1-cf7929955268}\TypeLib\ = "{b6396c45-b0cc-456b-9f49-f12964ee6df4}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\TypeLib\ = "{b6396c45-b0cc-456b-9f49-f12964ee6df4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6a7699f0-ee43-43e7-aa30-a6738f9bd470}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b59b96da-83cb-40ee-9b91-c377400fc3e3}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\ = "Chromoting 1.0 Type Library"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Typelib\{b6396c45-b0cc-456b-9f49-f12964ee6df4}\1.0\0\win32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E7535FEB98030547A77A6D0B7105E0E\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
840	msiexec.exe
840	msiexec.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	840	msiexec.exe
Token: SeCreateTokenPrivilege	3892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3892	msiexec.exe
Token: SeLockMemoryPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeMachineAccountPrivilege	3892	msiexec.exe
Token: SeTcbPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeLoadDriverPrivilege	3892	msiexec.exe
Token: SeSystemProfilePrivilege	3892	msiexec.exe
Token: SeSystemtimePrivilege	3892	msiexec.exe
Token: SeProfSingleProcessPrivilege	3892	msiexec.exe
Token: SeIncBasePriorityPrivilege	3892	msiexec.exe
Token: SeCreatePagefilePrivilege	3892	msiexec.exe
Token: SeCreatePermanentPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeDebugPrivilege	3892	msiexec.exe
Token: SeAuditPrivilege	3892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3892	msiexec.exe
Token: SeChangeNotifyPrivilege	3892	msiexec.exe
Token: SeRemoteShutdownPrivilege	3892	msiexec.exe
Token: SeUndockPrivilege	3892	msiexec.exe
Token: SeSyncAgentPrivilege	3892	msiexec.exe
Token: SeEnableDelegationPrivilege	3892	msiexec.exe
Token: SeManageVolumePrivilege	3892	msiexec.exe
Token: SeImpersonatePrivilege	3892	msiexec.exe
Token: SeCreateGlobalPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: 35	3656	powershell.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeShutdownPrivilege	4812	MsiExec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe
Token: SeTakeOwnershipPrivilege	840	msiexec.exe
Token: SeRestorePrivilege	840	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3892	msiexec.exe
840	msiexec.exe
2416	MsiExec.exe
4812	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4900	4600	2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe	89
PID 4900 wrote to memory of 3892	4900	cmd.exe	91
PID 840 wrote to memory of 2416	840	msiexec.exe	93
PID 840 wrote to memory of 4812	840	msiexec.exe	94
PID 4812 wrote to memory of 3656	4812	MsiExec.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ba91d19194554fc67d4fba40a8b97e85_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\exec.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i chromeremotedesktophost.msi /qn
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6ED09B98237C124DFB7F68B1D0CE7541
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CED6A9DED57A54F7B2B4BFCAA6F3B6D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass New-Item -ItemType SymbolicLink -Path 'C:\Program Files (x86)\Google\Chrome Remote Desktop\CurrentVersion' -Target 'C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\' -Force
    3⤵
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3656

C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_host.exe
"C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_host.exe" --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591b22.rbs

Path C:\Config.Msi\e591b22.rbs
Size 283KB
SHA256 fc6e5277f6dd80e6ff1c290147ba6398606e370a2c4c72f64a27e15c028583d5
MD5 888302bd74c366f51ffa909961ee30ca
SHA1 06f081350b368832431aa9f42228640ef84c2743
SHA512 7eeb1474daa6ae96b67475a702e2e202b29c6e7f800608acd231a87f2fdd630b2acbd4bbdd4785becd5c3c8f1cb21b6dc3ad698697b6ea0eea26da263f36e935
SSDEEP 3072:d4/nqeYTkLkmbJPpx/PSvC0vkHvdPI12fvpN4yPtKUxEWe+cxZrxk4:d4LYSFpyMdLhN4GJjh74
TLSH
T1FA547D1232A4407AF6FF0636E56896716F3FF524A7A4CA4A83844D0E5DA41C0AFF7B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remoting_core.dll

Path C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_core.dll
Size 29.2MB
SHA256 024f0d6e48cbb4f7110e32a22b86495936eea656a92f65f0433b7af2a006616a
MD5 8470e5e95f360237b815214f6d74717d
SHA1 4f1cff6a9c3b38a278dc4b15acd115572bc79e07
SHA512 f355b06bb3a53d0cb610d9f605fd8f426a0a5eec6a988fec57ee2d899cad4055c83c4387aad2024d2e8fb65a9bae7537a0df9f11a9761bc37a73c323ad262f9c
SSDEEP 786432:8UO+RdcE0XInPOqKWbHrelrje7rB53anwKUqqdbApqVVmWGFOnmbHls+hg1:8UO+jcE0XInPOqKWbHrelrje7rrqwKw9
TLSH
T19467AF02B271F074D88731B2742EB77E2E24555787268AE79E902CC46BB56D1327B3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remoting_host.exe

Path C:\Program Files (x86)\Google\Chrome Remote Desktop\142.0.7444.18\remoting_host.exe
Size 72KB
SHA256 36e6024a219b2ed9c54a918480d46185249a2f1eb64e7635dde121887757dca5
MD5 dabbe32833224e6156f543ad0fdfbd6a
SHA1 87f7b578f897e88a6c9a831b7eafc40563441c1b
SHA512 f07cb9b618e3a1a66f50a15d68a6ad6fac1dbada9fe9e2897d27da7d462c5ed4998b5730c50ce72a78d085f54cda45cf117d078364583607ff7a60ea38f2b3c3
SSDEEP 1536:jISEf2LfRHjQyzXu1O/Vb79JpRjE0ZEC6PrQL8sPRvstrl5WuGLQLFcnZl7qEq2p:jEf2LfRHjQyz+g/Vb79JpRY0ZEC6PrQb
TLSH
T10573BA656BFC276FF8F36FB075B5134296B5BC22DE31C2AE454502090C22960EE61B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromeremotedesktophost.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\chromeremotedesktophost.msi
Size 20.9MB
SHA256 7d879a6a65350fb862949ebed33e618a4f6c8d8d5b3deb08f9fb163b9ae29650
MD5 550dd77334f8a05a5fdc54008b06ed6c
SHA1 76f4a288a43b76ee7dc455aae69f2b02b99e8b7d
SHA512 f57452141d1b2d998017c0a0210dbb50d280376e58dcce8b40e8ad4cc7052a0d77163b19485b28189cd212025313aa58f36711a34c916a382ffc977426c0c614
SSDEEP 393216:D175TV3gAKTZ+Y/F6fGlm9zfGhZUdfB4MIYb9DusQpVciVXB2YyfxJWoQsbSlsn:D1lTVwA4ZF6f1xf0efm0b9jQZXoYKxJz
TLSH
T1EF27331BE4992777F6970232E9BC87524F387E20CE35C65A2395711369F02B07AF7292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exec.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\exec.bat
Size 53B
SHA256 bff2119a470ec00a9508f98ed32e8ebaa7a8714dfc9af7ec455df74052001573
MD5 c3c24d7755bed9f596aca8926db71a71
SHA1 d9ee537f5b4e31999443533b390b53fd26036086
SHA512 604a52202a522c1cedaa50853b231ce4c2682b8d3bb824a1b61451ef8028cef4727ac1dba5a16204d458c0bb3d55b6e1b7639ab316b3dae9b5b334cc905a4e66
TLSH
T1329002160814D81555715E84545645E27D0F184015A185C1B0430471495D4F984C6781
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1EE8.tmp

Path C:\Windows\Installer\MSI1EE8.tmp
Size 168KB
SHA256 b9e73e5ab78d033e0328fc74a9e4ebbd1af614bc4a7c894beb8c59d24ee3ede9
MD5 a0962dd193b82c1946dc67e140ddf895
SHA1 7f36c38d80b7c32e750e22907ac7e1f0df76e966
SHA512 118b0bd2941d48479446ed16ab23861073d23f9cc815f5f1d380f9977f18c34a71f61496c78b77b9a70f8b0a6cd08fe1edc1adb376dad5762ad0dd2068c64751
SSDEEP 1536:ITrI12IxKBhPTpX1vPiAmd/Blv1JUQ9GTP4yl+UQ/b9wLDVkbcTx7sWjcdAle+ci:IPI12fvpN4yPtKUxEWe+cxZrxk
TLSH
T1DAF36C2266A44039F7FF0637E5689671AE3FF1682B64DA59C3844C4F29A80C0A7F7717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI20EE.tmp

Path C:\Windows\Installer\MSI20EE.tmp
Size 88KB
SHA256 e24376a9346c2d486ce7426ca3ddc73cd020bb7216f8e5a0b9b2cb23caddcf31
MD5 85fcf7b457b7194bbeb46db22fae05c3
SHA1 5eca64d0d4ab4599852a475a7dd25beb88ae1c27
SHA512 12d46c2d63d221adb288a89b2fe0b423d4ae7579c24c36d651a6ce9488bfdc669a1e8378309c28f7019c7cfc43fa87e99b4829cace97715c0b94ac9e2a758339
SSDEEP 1536:EuBpEBa5arTkqbszXeYycSikLbsWjcdmbHpPpx/PS1h:H4/nqeYTkLkmbJPpx/PSv
TLSH
T116936C1072E14179E5FF0A31B97885621F7EBE25EA70CC96A785124E5CB06D0FE72B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3656-62-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/3656-61-0x0000000005BB0000-0x0000000005F0B000-memory.dmp

Download

memory/3656-57-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/3656-63-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Download

memory/3656-64-0x00000000070B0000-0x0000000007146000-memory.dmp

Download

memory/3656-65-0x00000000063E0000-0x00000000063FA000-memory.dmp

Download

memory/3656-66-0x0000000006430000-0x0000000006452000-memory.dmp

Download

memory/3656-67-0x0000000007710000-0x0000000007CCA000-memory.dmp

Download

memory/3656-60-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3656-56-0x0000000005850000-0x0000000005872000-memory.dmp

Download

memory/3656-55-0x00000000051D0000-0x000000000581A000-memory.dmp

Download

memory/3656-54-0x0000000002690000-0x00000000026C6000-memory.dmp

Download