Overview

overview

8

Static

static

1

b6c8ad2f49...18.exe

windows7-x64

8

b6c8ad2f49...18.exe

windows10-2004-x64

1

$PLUGINSDI...pt.dll

windows7-x64

1

$PLUGINSDI...pt.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows7-x64

1

$PLUGINSDI...ls.dll

windows10-2004-x64

1

$PLUGINSDI...rk.dll

windows7-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

$PLUGINSDI...et.dll

windows7-x64

1

$PLUGINSDI...et.dll

windows10-2004-x64

1

$PLUGINSDI...us.dll

windows7-x64

1

$PLUGINSDI...us.dll

windows10-2004-x64

1

$PLUGINSDI...gr.dll

windows7-x64

3

$PLUGINSDI...gr.dll

windows10-2004-x64

3

$PLUGINSDI...rt.dll

windows7-x64

1

$PLUGINSDI...rt.dll

windows10-2004-x64

1

$PLUGINSDI...us.dll

windows7-x64

1

$PLUGINSDI...us.dll

windows10-2004-x64

1

$PLUGINSDI...pt.exe

windows7-x64

1

$PLUGINSDI...pt.exe

windows10-2004-x64

1

$PLUGINSDI...Id.dll

windows7-x64

3

$PLUGINSDI...Id.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...rt.dll

windows7-x64

3

$PLUGINSDI...rt.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...xp.dll

windows7-x64

1

$PLUGINSDI...xp.dll

windows10-2004-x64

1

$PLUGINSDI...ig.dll

windows7-x64

1

$PLUGINSDI...ig.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17/06/2024, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe
  • Size 25.9MB
  • Sample240617-e7s6waydqq
  • SHA256 dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarebootkitdiscoveryevasionpersistencestealer

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 9 IoCs
    persistence
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 9 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 10 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6c8ad2f49e3fe9eba546ab1d18bc2f7_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\RegSvr32.exe
      "RegSvr32.exe" /s "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\WebMonBHO.dll"
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1532
    • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\ChromeNativeExt.exe
      "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\ChromeNativeExt.exe" install bdossext
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:1436
    • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDDownloader.exe
      "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDDownloader.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Users\Admin\AppData\Local\Temp\BDDownloader_Installer\1.0.111.0[2024-6-17-4-36-12]\BDDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\BDDownloader_Installer\1.0.111.0[2024-6-17-4-36-12]\BDDownloader.exe" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe
          "C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1068
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="百度高速下载器" dir=in program="C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe" description="C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe" action=allow
            5⤵
            • Modifies Windows Firewall
            PID:1864
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\program files (x86)\common files\baidu\bddownload\109\bdcomproxy.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:324
    • C:\Windows\SysWOW64\cacls.exe
      "cacls" "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697" /T /E /C /G everyone:F
      2⤵
        PID:1624
      • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSd.exe
        "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSd.exe" -mod=BDCooly.dll -install -oldv= -newv=4.0.0.6697
        2⤵
        • Executes dropped EXE
        PID:2328
      • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDKVWsc.exe
        "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDKVWsc.exe" -start
        2⤵
        • Executes dropped EXE
        PID:2664
      • C:\Windows\SysWOW64\RegSvr32.exe
        "RegSvr32.exe" /s "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDShellExt.dll"
        2⤵
        • Modifies system executable filetype association
        • Modifies registry class
        PID:2736
      • C:\Windows\SysWOW64\RegSvr32.exe
        "RegSvr32.exe" /s "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDShellExt64.dll"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDShellExt64.dll"
          3⤵
          • Modifies system executable filetype association
          • Registers COM server for autorun
          • Modifies registry class
          PID:2584
      • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdTray.exe
        "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdTray.exe"
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3016
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUProxy64.exe
          "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUProxy64.exe"
          3⤵
          • Executes dropped EXE
          PID:3048
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDKVDeskBand64.dll"
            4⤵
            • Registers COM server for autorun
            PID:1000
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\ChromeNativeExt.exe
          install bdossext
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:2160
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe
          "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe" ##DisplayType=0;VirusUpdate=1;UpdateSource=44;
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2240
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe
          "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe" ##DisplayType=0;AppUpdate=1;VirusUpdate=0;VersionUpdate=1;ModuleUpdate=0;UpdateSource=4;
          3⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          PID:868
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdBugRpt.exe
          "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdBugRpt.exe" /BSOD
          3⤵
          • Executes dropped EXE
          PID:2372
        • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe
          "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdUpdate.exe" ##DisplayType=0;VirusUpdate=0;AppUpdate=1;VersionUpdate=0;ModuleUpdate=1;UpdateSource=4;
          3⤵
          • Executes dropped EXE
          PID:1988
    • C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.2.0.751\BaiduHips.exe
      "C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.2.0.751\BaiduHips.exe"
      1⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdSvc.exe
      "C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BaiduSdSvc.exe" -r
      1⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1564
    • C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe
      "C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2032
    • C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe
      "C:\program files (x86)\common files\baidu\bddownload\109\bddownloader.exe" -Embedding
      1⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:2140

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          3
          T1547

          Registry Run Keys / Startup Folder

          3
          T1547.001

          Browser Extensions

          1
          T1176

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          3
          T1547

          Registry Run Keys / Startup Folder

          3
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          4
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          BDCrashCatcher.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDCrashCatcher.dll
          • Size 46KB
          • SHA256 450a4af71af6cd10aeb8bfc82c44ae9f61bd046d449a1f49c2b0f7aecb4220ce
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          baidusd_number_new.ttf
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\baidusd_number_new.ttf
          • Size 28KB
          • SHA256 b7792578d75b2224effb6a144af47d5ffe8764d5a307db41beded7ef6d5b8e98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AntiExp.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\AntiExp.dll
          • Size 574KB
          • SHA256 d252e7202475a601d11bc99b1f71cddad6d43173bf451894ae3337467e9d6b86
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDConfig.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDConfig.dll
          • Size 486KB
          • SHA256 6da5b3222321574eb4b0c5041075a7dd750469f5f239c6bcf250a8a7f17f3b7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDDriverFixer.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDDriverFixer.dll
          • Size 222KB
          • SHA256 6bdc54de43ffabc3765d4fa50af22d905d5056646522334669903322d163b17a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDLogicUtils.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDLogicUtils.dll
          • Size 158KB
          • SHA256 965a63ad1af107adec87a27fe0dab8957a85bfea104fed5a77f1daca4c513c30
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMAVCached.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMAVCached.dll
          • Size 294KB
          • SHA256 97c43ba0587b8c46d70f94e7370d5f21f26159afd5f61ff37559b79de532a5d7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMAVEng.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMAVEng.dll
          • Size 642KB
          • SHA256 db9d65537f8e1acfba0a469726a96893fe8baedf882b926ddbef645914b661ec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMBase.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMBase.dll
          • Size 934KB
          • SHA256 daeb58b48afac1f7eceee1ddb04826d0efcd306a30e49fef4d820f968a92d6f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMDownload.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMDownload.dll
          • Size 94KB
          • SHA256 ce24f3ee96ea337d8a769088c802d5257c73537dffe27faee41e82b922e5bbf4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMLog.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMLog.dll
          • Size 42KB
          • SHA256 423965b682301ad630a196aee044938864ac731393506535030fb7e08d3a97df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMMsg.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMMsg.dll
          • Size 46KB
          • SHA256 07dc34aa45e99219d4ba065452f2050a9cc1d4222d75a24c5e7bf642150914ab
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMNet.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMNet.dll
          • Size 806KB
          • SHA256 b034afe58bfb1273fbaad6a39a879c516d1b3077f62f471698b179b6b0750f38
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMPatchAgent.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMPatchAgent.dll
          • Size 38KB
          • SHA256 0464a3ce8ab71b43d23d9b0e104229c3b741755302b1b63a6c20602fedee2fa8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMReport.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMReport.dll
          • Size 278KB
          • SHA256 609b79bf6924492722885f1a0abfcd712b95e80ebe921329d01f69ebff08a726
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMStringUtils.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMStringUtils.dll
          • Size 62KB
          • SHA256 539bfa7f63ac75108721b71b287e40629dcc50b296e438294e94370b92488f1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMTinyXml.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMTinyXml.dll
          • Size 174KB
          • SHA256 ec5b24269407edae6c8739c4ef2e5a195b45ace191d154050cb7d8c62975b81c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMUpdate.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMUpdate.dll
          • Size 158KB
          • SHA256 a80a136d4f8199891438a90b9fe5aa87f7a14ea9aeb4e4279345beef4935a122
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDPerflog.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDPerflog.dll
          • Size 118KB
          • SHA256 cdd152ad817582c3ab0fc6773c42dda864a922d919a226963fab60deab675590
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHips.exe
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHips.exe
          • Size 62KB
          • SHA256 888aa88e46388ad00adeee5393ce7d1045633b2b9fb5d36cc939b82b97962486
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHipsBugRpt.exe
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHipsBugRpt.exe
          • Size 546KB
          • SHA256 f1a1f63b31398cd06d246bdc031689d440fe8c649eabab13028fcaf490f6ef6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHipsBusiness.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHipsBusiness.dll
          • Size 258KB
          • SHA256 1c44c62a5408c7b1d7ffd9a43e5b5becf8075a9a1553a3e19175c64fbe6517fc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHipsCore.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHipsCore.dll
          • Size 1.1MB
          • SHA256 1cc1df943f10347ece236fe8f51668fb23976cdb25b98da68c7f6c90b7354b38
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHipsUpdate.exe
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHipsUpdate.exe
          • Size 36KB
          • SHA256 5fda191637bd00fcdeb9931a0afb854466bf8a18cb7772d648e607c79e3d54c5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduPrevUIn.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduPrevUIn.dll
          • Size 386KB
          • SHA256 aa95742c04ce81d6947bd9ce22215fcb46df353f1d05bc3f1fa668f9b81c0eb1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DriverManager.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\DriverManager.dll
          • Size 110KB
          • SHA256 de88c5cf7739fae167eb147feb2e4f1a4ffd3613f5c53e4873d224d4f12e4a34
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          InstallCfg.xml
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\InstallCfg.xml
          • Size 177B
          • SHA256 de32b751c50c52c88b3a1d85ba78187b163a6be3334a6f75dd80ddddd369efb9
          • MD5 SHA1 SHA512
          Submit Download

          TrustAndIso.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\TrustAndIso.dll
          • Size 78KB
          • SHA256 b885cb7e8802e20433b50faa23594dfa9a22e8c6c08c79becaf1c5f66088cb30
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ad.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\ad.dll
          • Size 586KB
          • SHA256 37eeb2b55bc64ab02ec509029098c6e9bcfbd0cc0b3d0ad162b438ab9137b207
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0001.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\bd0001.dll
          • Size 124KB
          • SHA256 0dcd2793e4e2343de2d3db10ddeb8d7955f70ee0689fe17a264ac60759a8ddaf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0002.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\bd0002.dll
          • Size 478KB
          • SHA256 c25b45a943f80d4fdb00bf09261a9772682b92c92438dfab9c6d628d4e4d94f0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          blacksign.dat
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\blacksign.dat
          • Size 852B
          • SHA256 24bdd1605d46ea380134e8f3483e0a0f38125964f0ea30e5e09fc46c8e645eca
          • MD5 SHA1 SHA512
          Submit Download

          cache_config.dat
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\cache_config.dat
          • Size 469B
          • SHA256 22ba15b77e7a790503aaadf3a75a4b895966263f7e4daf3ef989a4d4d393759d
          • MD5 SHA1 SHA512
          Submit Download

          BDDefense_x64.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x64\BDDefense_x64.sys
          • Size 101KB
          • SHA256 7f8775fda1c3ade09df1c01a373be020d4c30f848c8bfa3c34e8e0a379183d98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0001.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x64\bd0001.sys
          • Size 197KB
          • SHA256 94672c8ac825277e70642c1e49ca1940913f7ff3b820af663eeb429020f5f40b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0002.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x64\bd0002.sys
          • Size 193KB
          • SHA256 f1f1417994a881351dfe5316ae7b990526dcb131a5fe5f19c00043bfae7143dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDAntiExp.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x86\BDAntiExp.sys
          • Size 149KB
          • SHA256 461c218ab0b9b19a94d8d22b69e0e562901904331439c9f16e7a4d9c275d6405
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDArKit.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x86\BDArKit.sys
          • Size 141KB
          • SHA256 9a9fb5a9a65f98b4dbdc33da74794c5a16f4e52265bfc53fa8d5e456e3fcacae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDDefense.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x86\BDDefense.sys
          • Size 120KB
          • SHA256 e1f741bc4dbb2775ca2c87495bd3304ad4f58d23f6c11e323c2166f5bbd456fb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0001.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x86\bd0001.sys
          • Size 84KB
          • SHA256 70c120d561fd4df928f706f7d97fb30fb7aa24103e4459b115313a8aa47f4a04
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0002.sys
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\drivers\x86\bd0002.sys
          • Size 164KB
          • SHA256 d4173d4844b0cd6613d9caeb4a3e10b89c244f308615e1148ba381b58fb9fad7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          hips_customer.xml
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\hips_customer.xml
          • Size 75B
          • SHA256 3b5b5b2ddb6f2a702a3e9fc48e6b2ae91b01f52ea6c59c658e3515b8c4443058
          • MD5 SHA1 SHA512
          Submit Download

          hips_product.xml
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\hips_product.xml
          • Size 291B
          • SHA256 c756aaa4c7ac4215529a57670004e3e3e0680698c29ceb19bcff8fd272e70c68
          • MD5 SHA1 SHA512
          Submit Download

          hips_self_enc.xml
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\hips_self_enc.xml
          • Size 1KB
          • SHA256 eefcd2173d5544790ef13b182866b53f30a5e387220b5dafcb82bbe1b376b2fb
          • MD5 SHA1 SHA512
          Submit Download

          patch.7z
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\patch.7z
          • Size 662KB
          • SHA256 70487a7393b716fe3b80b1d13bb54f98814fefc1f1bc61a1646f02ce863f7cc9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          placeholder_tmp
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\patch\placeholder_tmp
          • Size 11B
          • SHA256 4097889236a2af26c293033feb964c4cf118c0224e0d063fec0a89e9d0569ef2
          • MD5 SHA1 SHA512
          Submit Download

          policy.xml
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\policy.xml
          • Size 2KB
          • SHA256 987a1e4bf8f1a625c23a4ba0013c0904d080a42584f576185eb544960ba134e1
          • MD5 SHA1 SHA512
          Submit Download

          wverify.dat
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\wverify.dat
          • Size 2.0MB
          • SHA256 089bc4fcfb0615a9cc0490f55b8903dda3d81218aa23f12c2c36e9f330063974
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WebMonBHO.dll
          • Path C:\Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\WebMonBHO.dll
          • Size 478KB
          • SHA256 b16e62b303fdc57b110b1da09fa9f2ea860d6217878bb7aced96d635cdf53618
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduAn_HipsClient_2.3.xml
          • Path C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.2.0.751\un7zpatch\patch\BaiduAn_HipsClient_2.3.xml
          • Size 2KB
          • SHA256 b183d8f03703de244974b8fe22edee2529d8e01b86021d0b2bb8113b2a66023c
          • MD5 SHA1 SHA512
          Submit Download

          BaiduAn_PreU_2.3.xml
          • Path C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.2.0.751\un7zpatch\patch\BaiduAn_PreU_2.3.xml
          • Size 602B
          • SHA256 a3c00ba0099186b94204dfe63b5ddc1c06dfd45cf5bc7b7ad50b2bbf13d28992
          • MD5 SHA1 SHA512
          Submit Download

          810.dat
          • Path C:\ProgramData\Baidu\BaiduSd\Config\810.dat
          • Size 3KB
          • SHA256 d24979923988328ba251611deb6c884ba576c389e61460eadc6185fdae723815
          • MD5 SHA1 SHA512
          Submit Download

          Global.db
          • Path C:\ProgramData\Baidu\Common\Global.db
          • Size 52B
          • SHA256 ffdfda9c53c635679756a72d187df618fb9f1945aae7463f2c8884738f09d543
          • MD5 SHA1 SHA512
          Submit Download

          bddownloader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\BDDownloader_Installer\1.0.111.0[2024-6-17-4-36-12]\bddownloader.exe
          • Size 1.4MB
          • SHA256 65914e680a0767d31ddd4265537711a0a7842d8a0f347a1672c6b43310a5466c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMNetGetInfo_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\BDRecomm\BDMNetGetInfo_1.dll
          • Size 324KB
          • SHA256 6878c666cb88ec03b298054a54a3118123113d75c3dd42276a9604c60ed05896
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nst53CD.tmp\System.dll
          • Size 17KB
          • SHA256 d9069d550a357e0426e319283cab8efce891d2c87e106fc0e93b95a990aa5e45
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDArKit.sys
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDArKit.sys
          • Size 148KB
          • SHA256 c5c36f671434b1270126fef51afb8be41d0826a1db379a7d94850852a7be2d58
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDKitUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDKitUtils.dll
          • Size 68KB
          • SHA256 99247cd1de9ee72dc9694bdcfb4ede4fb494d4301c3e321c255690317290141e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDLogicUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDLogicUtils.dll
          • Size 282KB
          • SHA256 25f671709f69b45a81f32d959e74ac71340ae558439ee96ba99094467a4d56e5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMFrameWork.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDMFrameWork.dll
          • Size 226KB
          • SHA256 5149a8d1a0d8f361fe4060092164eb44f363b8d7958ee7327529cc8f9eafdb25
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMNet.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDMNet.dll
          • Size 974KB
          • SHA256 42cc622c89a84f5ef904c5387bee3d5044ea6868b64c5c2229abdc623410d801
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMPluginMgr.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDMPluginMgr.dll
          • Size 758KB
          • SHA256 81d2e08f0b4aeffb418764037e6ea2a3c10ddb3de4ce4f29d4162bf1a080bebc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMReport.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BDMReport.dll
          • Size 430KB
          • SHA256 29f1690afc465616d89dc59656a080f56bc563acc6d7ccb6dead8c34d4b8f38f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduSdBugRpt.exe
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\BaiduSdBugRpt.exe
          • Size 707KB
          • SHA256 ddce99fbb9b667d6ad5d5bf00f336d1ac179738ecb1f8b819be28e5d6a4fe850
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NetService.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\NetService.ini
          • Size 615B
          • SHA256 38a45da1fcb7bd796d99cd6569e48ce7bbe4a655cd7a0a82e7b1a55e8bd1cc9d
          • MD5 SHA1 SHA512
          Submit Download

          PullUpConfig.xml
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\PullUpConfig.xml
          • Size 880B
          • SHA256 2560b9c986fbeb09c649d5eda7d9d7a83337fce89992b27f9888d631d063d0cf
          • MD5 SHA1 SHA512
          Submit Download

          systemfile.dat
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\file\systemfile.dat
          • Size 3KB
          • SHA256 9b17cdefe0f458c32fb175e4d6324fdc2fb8cdd41b30617a5845f6b95a413854
          • MD5 SHA1 SHA512
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsyFAC.tmp\nsExec.dll
          • Size 13KB
          • SHA256 a4929cc9f098a33918dcdc760456f8520e3f2a2d2cf128bbedbfe973d1c8760c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMWrench_x64.sys
          • Path C:\Windows\System32\drivers\BDMWrench_x64.sys
          • Size 60KB
          • SHA256 f69ee1400c7e828b938b993916c90a7615700663406795e94248b747c1d8796e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bd0003.sys
          • Path C:\Windows\System32\drivers\bd0003.sys
          • Size 67KB
          • SHA256 e1285e2f1bb190e0a195f376f1dae783c3ab5290bb30db2c93579d3ac8e4bd42
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDDownloader.exe
          • Path \Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\BDDownloader.exe
          • Size 1.5MB
          • SHA256 de5fd2d9bf4de3b3f6bac1ad5aee0755eb2460b69167d47aa3d6ccf98bd4d525
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMFrameWork.dll
          • Path \Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BDMFrameWork.dll
          • Size 274KB
          • SHA256 6d1dd03f9e95077866c637972b9d358c968f1b763b1978bfdb089002927e656d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BaiduHipsIU.dll
          • Path \Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\hipsengine\BaiduHipsIU.dll
          • Size 62KB
          • SHA256 4707e1aa040387146b4eea84a057bfabb7243f91129a61cfd8bcc87dc23b9b44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ChromeNativeExt.exe
          • Path \Program Files (x86)\Baidu\BaiduSd\4.0.0.6697\websafe\ChromeNativeExt.exe
          • Size 331KB
          • SHA256 dc366b936980cb44f07c14e1d714e85af22a851556a0c0159b6c53033be0b7af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDKVZipRpt.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\BDKVZipRpt.dll
          • Size 224KB
          • SHA256 c4d9c642d2f6f55be404498c236f2e732f4c63106a58995c0a14690b779fc372
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMNetPlus.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\BDMNetPlus.dll
          • Size 886KB
          • SHA256 9d7ba68f888e6faa003e089406d83218cdd99b19de867a8b84ccc59f71ce266f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BDMReportPlus.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\BDMReportPlus.dll
          • Size 390KB
          • SHA256 1301a2621e9e3afa3227cebe7ea588e0d293186d8b6348990fb2e60eddbec7aa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GetSupplyId.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\GetSupplyId.dll
          • Size 108KB
          • SHA256 e2ab61f602396cb75ff0745cf08c09ba6588163b34b9af93503e994df76a697e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          KVInstallHelper.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\KVInstallHelper.dll
          • Size 807KB
          • SHA256 5a7a171b6fbf66e399e2bb19449fc7bd00e94a2df800a64221068f77508ff0cc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Report.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\Report.dll
          • Size 98KB
          • SHA256 1d697cba0b02f54a5fb5759f0b5feca39dd272a35a8621b14624e9067d78c2db
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path \Users\Admin\AppData\Local\Temp\nsyFAC.tmp\System.dll
          • Size 18KB
          • SHA256 d23676fbcf76355d1af68e7b32964b837243349920921b2ec74d97554809a65e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/756-1733-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-1731-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-1557-0x0000000004370000-0x0000000004402000-memory.dmp
          Download

          memory/756-1582-0x00000000043B0000-0x00000000043E5000-memory.dmp
          Download

          memory/756-1581-0x00000000043B0000-0x00000000043E5000-memory.dmp
          Download

          memory/756-1854-0x00000000043B0000-0x00000000043DB000-memory.dmp
          Download

          memory/756-1850-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-1852-0x00000000043B0000-0x00000000043DB000-memory.dmp
          Download

          memory/756-1851-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-1849-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-1847-0x0000000004010000-0x0000000004026000-memory.dmp
          Download

          memory/756-1846-0x0000000004010000-0x0000000004026000-memory.dmp
          Download

          memory/756-1569-0x00000000043B0000-0x0000000004406000-memory.dmp
          Download

          memory/756-1837-0x00000000043B0000-0x00000000043E5000-memory.dmp
          Download

          memory/756-1574-0x00000000043B0000-0x0000000004406000-memory.dmp
          Download

          memory/756-1836-0x00000000043B0000-0x00000000043E5000-memory.dmp
          Download

          memory/756-1817-0x00000000043B0000-0x0000000004406000-memory.dmp
          Download

          memory/756-1735-0x00000000043B0000-0x00000000043DB000-memory.dmp
          Download

          memory/756-15-0x00000000021E0000-0x00000000022AB000-memory.dmp
          Download

          memory/756-37-0x0000000000980000-0x0000000000998000-memory.dmp
          Download

          memory/756-1736-0x00000000043B0000-0x00000000043DB000-memory.dmp
          Download

          memory/756-1734-0x00000000043B0000-0x00000000043D9000-memory.dmp
          Download

          memory/756-42-0x00000000029A0000-0x00000000029D7000-memory.dmp
          Download

          memory/756-46-0x0000000003A10000-0x0000000003A71000-memory.dmp
          Download

          memory/756-1420-0x0000000003E20000-0x0000000003E2E000-memory.dmp
          Download

          memory/756-1562-0x0000000004370000-0x00000000043A9000-memory.dmp
          Download

          memory/756-1728-0x0000000004010000-0x0000000004026000-memory.dmp
          Download

          memory/756-51-0x0000000003BC0000-0x0000000003C9E000-memory.dmp
          Download

          memory/756-1729-0x0000000004010000-0x0000000004026000-memory.dmp
          Download

          memory/756-68-0x0000000004370000-0x000000000444E000-memory.dmp
          Download

          memory/756-1428-0x0000000003E40000-0x0000000003E4F000-memory.dmp
          Download

          memory/756-1725-0x0000000004370000-0x00000000043A9000-memory.dmp
          Download

          memory/1436-1360-0x0000000002520000-0x0000000002615000-memory.dmp
          Download

          memory/1436-1356-0x0000000002170000-0x00000000021DB000-memory.dmp
          Download

          memory/1564-1818-0x00000000044E0000-0x00000000044F6000-memory.dmp
          Download

          memory/1564-2026-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1908-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1871-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1963-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-2024-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2006-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-1739-0x0000000000080000-0x00000000000B7000-memory.dmp
          Download

          memory/1564-1737-0x00000000004C0000-0x000000000057E000-memory.dmp
          Download

          memory/1564-1856-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-1857-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-2042-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1859-0x0000000004480000-0x0000000004496000-memory.dmp
          Download

          memory/1564-1816-0x0000000004480000-0x0000000004496000-memory.dmp
          Download

          memory/1564-1815-0x00000000042D0000-0x00000000042E6000-memory.dmp
          Download

          memory/1564-2010-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1855-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-1819-0x00000000044E0000-0x00000000044F6000-memory.dmp
          Download

          memory/1564-1879-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1861-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2002-0x0000000005000000-0x0000000005029000-memory.dmp
          Download

          memory/1564-2025-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1862-0x00000000044E0000-0x00000000044F6000-memory.dmp
          Download

          memory/1564-1864-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1865-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1867-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1866-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-1858-0x00000000042D0000-0x00000000042E6000-memory.dmp
          Download

          memory/1564-1860-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2028-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2027-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2033-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2034-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/1564-2041-0x0000000005000000-0x000000000502B000-memory.dmp
          Download

          memory/2328-1745-0x00000000002E0000-0x0000000000317000-memory.dmp
          Download

          memory/2328-1743-0x0000000000210000-0x00000000002CE000-memory.dmp
          Download

          memory/2328-1741-0x0000000000150000-0x0000000000197000-memory.dmp
          Download

          memory/2600-1615-0x0000000000720000-0x000000000073A000-memory.dmp
          Download

          memory/2600-1942-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1844-0x0000000002F80000-0x0000000002FA9000-memory.dmp
          Download

          memory/2600-1842-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1841-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1840-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1839-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1835-0x0000000006640000-0x000000000665D000-memory.dmp
          Download

          memory/2600-1834-0x0000000006640000-0x000000000665D000-memory.dmp
          Download

          memory/2600-1687-0x0000000005960000-0x0000000005972000-memory.dmp
          Download

          memory/2600-1663-0x0000000002F80000-0x0000000002FA9000-memory.dmp
          Download

          memory/2600-1870-0x0000000006640000-0x000000000665D000-memory.dmp
          Download

          memory/2600-1664-0x0000000002F80000-0x0000000002FA9000-memory.dmp
          Download

          memory/2600-1667-0x00000000045B0000-0x00000000045F8000-memory.dmp
          Download

          memory/2600-1646-0x0000000002AC0000-0x0000000002B50000-memory.dmp
          Download

          memory/2600-1874-0x0000000006640000-0x000000000665D000-memory.dmp
          Download

          memory/2600-1944-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1945-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1943-0x0000000006660000-0x0000000006689000-memory.dmp
          Download

          memory/2600-1845-0x0000000002F80000-0x0000000002FA9000-memory.dmp
          Download

          memory/2600-1588-0x0000000000410000-0x00000000004F9000-memory.dmp
          Download

          memory/2600-1643-0x0000000002A50000-0x0000000002AB0000-memory.dmp
          Download

          memory/2600-1592-0x0000000000230000-0x0000000000274000-memory.dmp
          Download

          memory/2600-1652-0x0000000002CF0000-0x0000000002D90000-memory.dmp
          Download

          memory/2600-1637-0x0000000002870000-0x0000000002902000-memory.dmp
          Download

          memory/2600-1648-0x0000000002870000-0x00000000028C6000-memory.dmp
          Download

          memory/2600-1649-0x0000000002870000-0x00000000028A5000-memory.dmp
          Download

          memory/2600-1650-0x0000000002CA0000-0x0000000002CE0000-memory.dmp
          Download

          memory/2600-1619-0x0000000001740000-0x000000000180A000-memory.dmp
          Download

          memory/2600-1611-0x0000000001250000-0x000000000136E000-memory.dmp
          Download

          memory/2600-1607-0x0000000000C30000-0x0000000000CA8000-memory.dmp
          Download

          memory/2600-1603-0x00000000003A0000-0x00000000003E4000-memory.dmp
          Download

          memory/2600-1600-0x0000000000350000-0x000000000035E000-memory.dmp
          Download

          memory/2600-1596-0x0000000000290000-0x00000000002BA000-memory.dmp
          Download

          memory/3016-1965-0x000000000B080000-0x000000000B0A9000-memory.dmp
          Download

          memory/3016-1964-0x000000000B080000-0x000000000B0A9000-memory.dmp
          Download

          memory/3016-2053-0x000000000B080000-0x000000000B0A9000-memory.dmp
          Download