Overview

overview

7

Static

static

3

FrostSetup.exe

windows10-2004-x64

7

FrostSetup.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 23:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FrostSetup.exe
  • Size 68.9MB
  • Sample261110-3d8apsst8m
  • SHA256 a19432062cc097e4b497fea4aad911baa7cf02bf482494add63eb19faa441219
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FrostSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\FrostSetup.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4580.4120.8500256242823757379 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
      2⤵
      • Enumerates system info in registry
      PID:3688
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView /prefetch:4 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff858b5fd8,0x7fff858b5fe4,0x7fff858b5ff0
        3⤵
          PID:3216
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
          3⤵
            PID:5480
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
            3⤵
              PID:5660
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
              3⤵
                PID:4864
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad /prefetch:1
                3⤵
                  PID:1840
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
                  3⤵
                    PID:2696
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
                    3⤵
                      PID:1380
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4384 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5956
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView" --webview-exe-name=FrostSetup.exe --webview-exe-version=1.0.0+d316cf5fe253621a3eda5e0e2b6313e979bbaeb4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2736 --field-trial-handle=1784,i,14732771706851004550,13388623058430836969,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:24b05d8837069743950b03f2d5d8e0fa2a5549ad
                      3⤵
                        PID:5908

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        FrostSetup.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\FrostSetup.dll
                        • Size 130KB
                        • SHA256 2ffcf1be6a67ae1c44685110f44965ee0f6b389f9075cd0539b4537b87b3cbf1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Microsoft.Win32.SystemEvents.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\Microsoft.Win32.SystemEvents.dll
                        • Size 93KB
                        • SHA256 b633eb8894b8b4bbbc257512cb0ee86d827d7cd78385162a1918fede6725258c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Collections.NonGeneric.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Collections.NonGeneric.dll
                        • Size 101KB
                        • SHA256 611c7eec786aaf57a0056c7a26159e79b5707a9ec0ec0601a797d50ab4bd4176
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Collections.Specialized.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Collections.Specialized.dll
                        • Size 101KB
                        • SHA256 adb510e0904a7ee18d0eb4f0b4a8aad7e098fc96bbf6aee1ea61a0d02ceafde8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Collections.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Collections.dll
                        • Size 253KB
                        • SHA256 c739bf643d75b7fc8f70761d5bf7462c4709af28fd87606cf7e462c882579043
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.ComponentModel.EventBasedAsync.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.ComponentModel.EventBasedAsync.dll
                        • Size 45KB
                        • SHA256 47e95871b271ae69d52b7cafa54c6080409fc0b1ba6286cc393544ee00123e1f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.ComponentModel.Primitives.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.ComponentModel.Primitives.dll
                        • Size 77KB
                        • SHA256 cd638355c785799763447cdc3bbc765c8d158cca499f4f53c651a3492f16311e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.ComponentModel.TypeConverter.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.ComponentModel.TypeConverter.dll
                        • Size 729KB
                        • SHA256 f796462c484accb0c7ae2dc8e980f068c89072e37d0df7d4f0f556922923da17
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.ComponentModel.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.ComponentModel.dll
                        • Size 29KB
                        • SHA256 abf0e4bd0aaafd043e5fb420f32078a8c3b41b5814488ff0057e7d219c7011ec
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Diagnostics.TraceSource.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Diagnostics.TraceSource.dll
                        • Size 141KB
                        • SHA256 50c3d622fde2d19fa23c1ad088b6dfa1b5ae9aa24a188dca5292ab51cd4d27b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Drawing.Common.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Drawing.Common.dll
                        • Size 1.5MB
                        • SHA256 b95b32f1d88fde6afdb130a742c9fb8da21c27b56b417e74f6543cdb4ccb8ba4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Drawing.Primitives.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Drawing.Primitives.dll
                        • Size 129KB
                        • SHA256 1357b9218b5422fb8dbb3bfb612392b11416f36ec4f64126947ed9a0848685a1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Memory.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Memory.dll
                        • Size 153KB
                        • SHA256 81745379c1ab2d8b43386d8124da4c4ae5080485f91098d5656695a27352aa9d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Private.CoreLib.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Private.CoreLib.dll
                        • Size 12.6MB
                        • SHA256 6a67b6cd954f981ba4945eb6a0c8bc9326f8d8d27ae7f8e2982aa649638334b0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Private.Uri.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Private.Uri.dll
                        • Size 253KB
                        • SHA256 5f7e6dde9fbaab99541cd7efe73ef6e66b04ba958b3516a09f6dbb6a1554932d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Runtime.InteropServices.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Runtime.InteropServices.dll
                        • Size 93KB
                        • SHA256 a3561f3afbff213e9f545836eaddc5ed154dadb90977e993a5136ca0a36665a4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Text.Json.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Text.Json.dll
                        • Size 1.4MB
                        • SHA256 f42b6ecb99db592d2d6b127907c19c50104beae0a6298d07330db5d76cc258ed
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Threading.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Threading.dll
                        • Size 81KB
                        • SHA256 fd0bd8f64140300775c08f2a36c01080f913a7f455adf743c9f375230529d17d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Windows.Forms.Primitives.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Windows.Forms.Primitives.dll
                        • Size 2.9MB
                        • SHA256 35a668702513ee419b1c0aa0366ab5ab3fa8fa465ed6cd7858e5eed4344f75de
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.Windows.Forms.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\System.Windows.Forms.dll
                        • Size 12.9MB
                        • SHA256 ee556763c5706e81a8bd05da03b57f7951ba8968c1d5b3f61dd3ba55b02723d0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WebView2Loader.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\.net\FrostSetup\HIy1IYR2Acx_\WebView2Loader.dll
                        • Size 161KB
                        • SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        6669c577-e529-4ee9-ae4b-ad128e44d468.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView\Default\Network\6669c577-e529-4ee9-ae4b-ad128e44d468.tmp
                        • Size 785B
                        • SHA256 2978a806949217eb1dfc4f53e4dbfd042e1427a6e548fa62cf889b1e11cceb09
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView\Default\Network\Network Persistent State
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        SCT Auditing Pending Reports
                        • Path C:\Users\Admin\AppData\Local\Temp\FrostSetup-WV2\EBWebView\Default\Network\SCT Auditing Pending Reports
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512
                        Submit Download

                        memory/1840-518-0x00007FFFA7EE0000-0x00007FFFA7EE1000-memory.dmp
                        Download

                        memory/2696-576-0x00007FFFA7D30000-0x00007FFFA7D31000-memory.dmp
                        Download

                        memory/2696-575-0x00007FFFA9410000-0x00007FFFA9411000-memory.dmp
                        Download

                        memory/5480-513-0x00007FFFA7EE0000-0x00007FFFA7EE1000-memory.dmp
                        Download

                        memory/5956-581-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-579-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-590-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-589-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-588-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-587-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-586-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download

                        memory/5956-585-0x000002695DE90000-0x000002695DE91000-memory.dmp
                        Download