Overview

overview

7

Static

static

1

auslogics-...up.exe

windows10-2004-x64

7

auslogics-...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 05:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    auslogics-windows-slimmer-setup.exe
  • Size 23.4MB
  • Sample260820-gmt9jsbf52
  • SHA256 7d272e536dfb41f0619a3702863560c69468c4ad53c418f81d320d22c5ac18dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoveryinstallerpersistencespywarestealertrojan

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 51 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\is-VTPA7.tmp\auslogics-windows-slimmer-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VTPA7.tmp\auslogics-windows-slimmer-setup.tmp" /SL5="$801EE,24038918,505856,C:\Users\Admin\AppData\Local\Temp\auslogics-windows-slimmer-setup.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe
        "C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe" /install /setautostart
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1436
      • C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe
        "C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe" /FromInstall
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5096
  • C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe
    "C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\WindowsSlimmer.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\WindowsSlimmer.exe"
      2⤵
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Checks computer location settings
      • Drops file in Windows directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Users\Admin\AppData\Local\Temp\EB14DE5A-BFDD-4E92-BB97-F56D1076D9A2\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\EB14DE5A-BFDD-4E92-BB97-F56D1076D9A2\dismhost.exe {AF14B94B-A801-496A-A66B-ADA633EB3BB3}
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\5538B750-F1FA-459B-8604-7F6D4A7B0ADE\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\5538B750-F1FA-459B-8604-7F6D4A7B0ADE\dismhost.exe {94CA4B41-1603-422F-A111-DFBBB0F378B0}
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        PID:5172
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\TabReports.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\TabReports.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4240
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\TabMakePortable.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\TabMakePortable.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2980
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\TabCareCenter.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\TabCareCenter.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2620
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\ActionCenter.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\ActionCenter.exe" /NoActivate
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2496
  • C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe
    "C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5520
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\windowsslimmer.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\windowsslimmer.exe"
      2⤵
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Drops file in Windows directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5840
      • C:\Users\Admin\AppData\Local\Temp\FB5EEB5B-3104-45C0-ACF6-B4ECD704D34B\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\FB5EEB5B-3104-45C0-ACF6-B4ECD704D34B\dismhost.exe {73E78D7F-7055-480E-AA07-300DBB99A543}
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2304
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\tabreports.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\tabreports.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5888
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\tabmakeportable.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\tabmakeportable.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5992
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\tabcarecenter.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\tabcarecenter.exe" /NoActivate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1936
    • C:\Program Files (x86)\Auslogics\Windows Slimmer\actioncenter.exe
      "C:\Program Files (x86)\Auslogics\Windows Slimmer\actioncenter.exe" /NoActivate
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CommonForms.Routine2.dll
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\CommonForms.Routine2.dll
        • Size 1.2MB
        • SHA256 0594cf3e71a042fb9628f469c63b721876de038d970f7bca58b6b900db956d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.ini
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\Data\main.ini
        • Size 1KB
        • SHA256 6a7e710d31d90fa6ff8dfb3909296ff713ff13616f3ecbf9f78d21392ff6e836
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\Integrator.exe
        • Size 5.4MB
        • SHA256 02b3e9dcc13148c2ff7a6ecb60e17cad9a42ce3b3e5a6141bd21990302ca883c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RescueCenterHelper.dll
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\RescueCenterHelper.dll
        • Size 685KB
        • SHA256 e3587a26ca880d79b52156e6c4af1b27fbb9fe53bc11bc2d1b0ff85ee7036b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TaskSchedulerHelper.dll
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\TaskSchedulerHelper.dll
        • Size 549KB
        • SHA256 7532b39ca374ea34b6744072d03137bca88fc1f7d1a94251d0b6a798602ec6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsSlimmer.exe
        • Path C:\Program Files (x86)\Auslogics\Windows Slimmer\WindowsSlimmer.exe
        • Size 2.6MB
        • SHA256 649ba68d611a031593fd54a9f4e6b698d9a6507e6f3c1f090aafc24a4825bd0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismHost.exe
        • Path C:\Users\Admin\AppData\Local\Temp\5538B750-F1FA-459B-8604-7F6D4A7B0ADE\DismHost.exe
        • Size 142KB
        • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AxComponentsRTL.bpl
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\AxComponentsRTL.bpl
        • Size 2.8MB
        • SHA256 0662fb3fa684c1b0a273e5ff7ca8a17d248580038e573f8f197c654de294a3b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AxComponentsVCL.bpl
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\AxComponentsVCL.bpl
        • Size 9.0MB
        • SHA256 fa4096d1909f26e35c5e9a790053bea9eb213cda6f2e12886f0c306de6c813f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BrowserHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\BrowserHelper.dll
        • Size 1.9MB
        • SHA256 1d45fb36734d44b505e5f3fdd3d68d6e873a71c0a8c6b7ad193493fcb12de8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CFAHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\CFAHelper.dll
        • Size 97KB
        • SHA256 c299c06cd3b78e058970d2ad428d5ce9121efa0e2c8c85bff8df9eb9c9af860e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CommonForms.Site.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\CommonForms.Site.dll
        • Size 250KB
        • SHA256 eafe7ade456a783b11f9f1fbac87378126ccf1c488dad575abe2bd47af4ab828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleAnalyticsHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\GoogleAnalyticsHelper.dll
        • Size 141KB
        • SHA256 4dc82ddd3473c88deac99b891b5a40f51d978050de79a9f81c8a8add98693a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Localizer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\Localizer.dll
        • Size 202KB
        • SHA256 dc67fa2247169729991979a2100f66f2600c5042a179bfab14cd9a2e3a3a114b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetupCustom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\SetupCustom.dll
        • Size 2.2MB
        • SHA256 1dff2e4371905ac2a52415552a0dacaa7cf985bbf7e18a28abbcb778242ed5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        enu.lng
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\enu.lng
        • Size 497KB
        • SHA256 9897a71acf7aed340dab37545540baac9d4ab64524e09e63f0686d34ec2733a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rtl250.bpl
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\rtl250.bpl
        • Size 10.1MB
        • SHA256 66f2f6b2e8c24827d63f6415094ae40fddd50f30e097cda395cc0116d57356a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\sqlite3.dll
        • Size 2.4MB
        • SHA256 b35bab5ec73dc5202bce864f7e64f8beb5ae2eee05cbdee9d29c28e6bc64d4e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcl250.bpl
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\vcl250.bpl
        • Size 3.9MB
        • SHA256 10b9d8569b8f9e9e46e7a579855492353c43f1e3b5d4a28959015bed5570350c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vclimg250.bpl
        • Path C:\Users\Admin\AppData\Local\Temp\is-NBRM8.tmp\vclimg250.bpl
        • Size 355KB
        • SHA256 6be794294ff9c4b27debc6ed50fce865d028cf496d4e39fcce9c4f8e48cbfbfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auslogics-windows-slimmer-setup.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-VTPA7.tmp\auslogics-windows-slimmer-setup.tmp
        • Size 1.5MB
        • SHA256 9b8e7bdafc97faa3d2ca60dd5c12836b2b2a840261e07ecfb6adb14ae6441292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 2.1MB
        • SHA256 da5871fbfa1501fd38bda99b5936906a134559fe65563047af42cc3b6648854d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/960-89-0x0000000000400000-0x0000000000485000-memory.dmp
        Download

        memory/960-0-0x0000000000400000-0x0000000000485000-memory.dmp
        Download

        memory/1372-415-0x0000000006E00000-0x0000000006F2B000-memory.dmp
        Download

        memory/1372-416-0x0000000007100000-0x0000000007125000-memory.dmp
        Download

        memory/1372-364-0x0000000001120000-0x0000000001B46000-memory.dmp
        Download

        memory/1372-414-0x0000000006D20000-0x0000000006D61000-memory.dmp
        Download

        memory/1372-412-0x0000000006C50000-0x0000000006C6B000-memory.dmp
        Download

        memory/1372-362-0x0000000000A80000-0x0000000000ADA000-memory.dmp
        Download

        memory/1372-413-0x0000000006C70000-0x0000000006D1E000-memory.dmp
        Download

        memory/1372-360-0x0000000000E40000-0x0000000001113000-memory.dmp
        Download

        memory/1372-411-0x0000000006B90000-0x0000000006BC4000-memory.dmp
        Download

        memory/1372-400-0x0000000006B60000-0x0000000006B81000-memory.dmp
        Download

        memory/1372-401-0x0000000006B60000-0x0000000006B81000-memory.dmp
        Download

        memory/1436-325-0x00000000073B0000-0x00000000073E4000-memory.dmp
        Download

        memory/1436-349-0x0000000050A80000-0x0000000050E72000-memory.dmp
        Download

        memory/1436-350-0x0000000000E50000-0x0000000000EAA000-memory.dmp
        Download

        memory/1436-345-0x0000000007520000-0x00000000075CE000-memory.dmp
        Download

        memory/1436-352-0x00000000018E0000-0x00000000021DF000-memory.dmp
        Download

        memory/1436-347-0x0000000000400000-0x0000000000964000-memory.dmp
        Download

        memory/1436-333-0x0000000007470000-0x00000000074FB000-memory.dmp
        Download

        memory/1436-351-0x0000000000EB0000-0x00000000018D6000-memory.dmp
        Download

        memory/1436-311-0x0000000007240000-0x0000000007261000-memory.dmp
        Download

        memory/1436-348-0x0000000050000000-0x00000000502D3000-memory.dmp
        Download

        memory/1436-299-0x0000000000E50000-0x0000000000EAA000-memory.dmp
        Download

        memory/1436-303-0x00000000018E0000-0x00000000021DF000-memory.dmp
        Download

        memory/1436-301-0x0000000000EB0000-0x00000000018D6000-memory.dmp
        Download

        memory/4740-64-0x0000000004710000-0x0000000004744000-memory.dmp
        Download

        memory/4740-215-0x00000000045B0000-0x00000000045B1000-memory.dmp
        Download

        memory/4740-191-0x0000000050A80000-0x0000000050E72000-memory.dmp
        Download

        memory/4740-205-0x0000000005D60000-0x0000000005F55000-memory.dmp
        Download

        memory/4740-196-0x0000000003650000-0x0000000003923000-memory.dmp
        Download

        memory/4740-197-0x0000000003930000-0x0000000004356000-memory.dmp
        Download

        memory/4740-187-0x0000000050000000-0x00000000508FF000-memory.dmp
        Download

        memory/4740-336-0x0000000003930000-0x0000000004356000-memory.dmp
        Download

        memory/4740-186-0x00000000033B0000-0x00000000035E8000-memory.dmp
        Download

        memory/4740-182-0x0000000000400000-0x000000000058B000-memory.dmp
        Download

        memory/4740-108-0x0000000000860000-0x0000000000861000-memory.dmp
        Download

        memory/4740-90-0x0000000000400000-0x000000000058B000-memory.dmp
        Download

        memory/4740-326-0x00000000033B0000-0x00000000035E8000-memory.dmp
        Download

        memory/4740-97-0x0000000005D60000-0x0000000005F55000-memory.dmp
        Download

        memory/4740-321-0x0000000000400000-0x000000000058B000-memory.dmp
        Download

        memory/4740-338-0x0000000004A50000-0x0000000004A91000-memory.dmp
        Download

        memory/4740-335-0x0000000003650000-0x0000000003923000-memory.dmp
        Download

        memory/4740-92-0x0000000050000000-0x00000000508FF000-memory.dmp
        Download

        memory/4740-93-0x0000000050A80000-0x0000000050E72000-memory.dmp
        Download

        memory/4740-103-0x0000000003930000-0x0000000004356000-memory.dmp
        Download

        memory/4740-105-0x0000000004A50000-0x0000000004A91000-memory.dmp
        Download

        memory/4740-106-0x0000000004B30000-0x0000000004B4B000-memory.dmp
        Download

        memory/4740-107-0x0000000004B50000-0x0000000004B75000-memory.dmp
        Download

        memory/4740-104-0x0000000004710000-0x0000000004744000-memory.dmp
        Download

        memory/4740-100-0x0000000003650000-0x0000000003923000-memory.dmp
        Download

        memory/4740-99-0x00000000035F0000-0x000000000364A000-memory.dmp
        Download

        memory/4740-394-0x0000000003930000-0x0000000004356000-memory.dmp
        Download

        memory/4740-393-0x0000000003650000-0x0000000003923000-memory.dmp
        Download

        memory/4740-399-0x0000000005D60000-0x0000000005F55000-memory.dmp
        Download

        memory/4740-398-0x0000000004B50000-0x0000000004B75000-memory.dmp
        Download

        memory/4740-389-0x00000000033B0000-0x00000000035E8000-memory.dmp
        Download

        memory/4740-388-0x0000000000400000-0x000000000058B000-memory.dmp
        Download

        memory/4740-91-0x00000000033B0000-0x00000000035E8000-memory.dmp
        Download

        memory/4740-81-0x0000000004B30000-0x0000000004B4B000-memory.dmp
        Download

        memory/4740-86-0x0000000004B50000-0x0000000004B75000-memory.dmp
        Download

        memory/4740-88-0x00000000045B0000-0x00000000045B1000-memory.dmp
        Download

        memory/4740-73-0x0000000004A50000-0x0000000004A91000-memory.dmp
        Download

        memory/4740-55-0x0000000003930000-0x0000000004356000-memory.dmp
        Download

        memory/4740-32-0x00000000033B0000-0x00000000035E8000-memory.dmp
        Download

        memory/4740-49-0x00000000035F0000-0x000000000364A000-memory.dmp
        Download

        memory/4740-52-0x0000000003650000-0x0000000003923000-memory.dmp
        Download

        memory/4740-5-0x0000000000860000-0x0000000000861000-memory.dmp
        Download