7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
Size

5.7MB
MD5

706704da7601ee1d23e0b4e1ddb7966f
SHA1

1234d648ff9d7625aa9b8c43295df2cfbb15c967
SHA256

7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924
SHA512

a8c1ac73787a7638d064a93a0f8b7db0e10eef685c54397932e5faafac52558e0e762ef418640dda0dcd54bb542256db71acc17c2c03f1f20e1e43301308964c
SSDEEP

98304:1zw2cH457oTOfe6WEEH8gSLO6ZWBGhusJVjnnCZWq82zPJJlKpSGchcBrahwNO+t:xcH45kGe6WEnXZW14VjnC8u5KpSGcaBD

Score

7^/10

vmprotect

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2260	DongleServer.exe
1464	DongleServer.exe

Loads dropped DLL 13 IoCs

pid	Process
2764	cmd.exe
2260	DongleServer.exe
2260	DongleServer.exe
2260	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0008000000015c69-36.dat	vmprotect
behavioral1/files/0x0008000000015c69-37.dat	vmprotect
behavioral1/memory/2260-38-0x0000000062C20000-0x0000000062C5C000-memory.dmp	vmprotect
behavioral1/memory/2260-195-0x0000000062C20000-0x0000000062C5C000-memory.dmp	vmprotect
behavioral1/files/0x0008000000015c69-200.dat	vmprotect
behavioral1/memory/1464-370-0x0000000062C20000-0x0000000062C5C000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2260	DongleServer.exe
1464	DongleServer.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\__tmp_rar_sfx_access_check_259405638	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\Crack4Dental.bat	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log	DongleServer.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log	DongleServer.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\Winspool.drv	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\3s.dat	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\3s.dat	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log	DongleServer.exe
File opened for modification	C:\Program Files (x86)\3Shape	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServerConfig.xml	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\Crack4Dental.bat	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\ClientNames.xml	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\ClientNames.xml	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File created	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServerConfig.xml	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
File opened for modification	C:\Program Files (x86)\3Shape\Dongle Server Service\Winspool.drv	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2544	sc.exe
2684	sc.exe
816	sc.exe
3024	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
3004	taskkill.exe
2696	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	DongleServer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	DongleServer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	DongleServer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2260	DongleServer.exe
2260	DongleServer.exe
2260	DongleServer.exe
2260	DongleServer.exe
2260	DongleServer.exe
2260	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe
1464	DongleServer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2260	DongleServer.exe
Token: SeDebugPrivilege	1464	DongleServer.exe
Token: SeShutdownPrivilege	2624	powercfg.exe
Token: SeShutdownPrivilege	2984	powercfg.exe
Token: SeShutdownPrivilege	2576	powercfg.exe
Token: SeShutdownPrivilege	2560	powercfg.exe
Token: SeShutdownPrivilege	2676	powercfg.exe
Token: SeShutdownPrivilege	1432	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3004	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	28
PID 2596 wrote to memory of 3004	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	28
PID 2596 wrote to memory of 3004	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	28
PID 2596 wrote to memory of 3004	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	28
PID 2596 wrote to memory of 2696	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	31
PID 2596 wrote to memory of 2696	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	31
PID 2596 wrote to memory of 2696	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	31
PID 2596 wrote to memory of 2696	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	31
PID 2596 wrote to memory of 1732	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	33
PID 2596 wrote to memory of 1732	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	33
PID 2596 wrote to memory of 1732	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	33
PID 2596 wrote to memory of 1732	2596	7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe	33
PID 1732 wrote to memory of 2704	1732	cmd.exe	35
PID 1732 wrote to memory of 2704	1732	cmd.exe	35
PID 1732 wrote to memory of 2704	1732	cmd.exe	35
PID 1732 wrote to memory of 2704	1732	cmd.exe	35
PID 1732 wrote to memory of 2880	1732	cmd.exe	36
PID 1732 wrote to memory of 2880	1732	cmd.exe	36
PID 1732 wrote to memory of 2880	1732	cmd.exe	36
PID 1732 wrote to memory of 2880	1732	cmd.exe	36
PID 1732 wrote to memory of 2776	1732	cmd.exe	37
PID 1732 wrote to memory of 2776	1732	cmd.exe	37
PID 1732 wrote to memory of 2776	1732	cmd.exe	37
PID 1732 wrote to memory of 2776	1732	cmd.exe	37
PID 2776 wrote to memory of 2764	2776	mshta.exe	38
PID 2776 wrote to memory of 2764	2776	mshta.exe	38
PID 2776 wrote to memory of 2764	2776	mshta.exe	38
PID 2776 wrote to memory of 2764	2776	mshta.exe	38
PID 2764 wrote to memory of 2544	2764	cmd.exe	40
PID 2764 wrote to memory of 2544	2764	cmd.exe	40
PID 2764 wrote to memory of 2544	2764	cmd.exe	40
PID 2764 wrote to memory of 2544	2764	cmd.exe	40
PID 2764 wrote to memory of 2684	2764	cmd.exe	41
PID 2764 wrote to memory of 2684	2764	cmd.exe	41
PID 2764 wrote to memory of 2684	2764	cmd.exe	41
PID 2764 wrote to memory of 2684	2764	cmd.exe	41
PID 2764 wrote to memory of 816	2764	cmd.exe	42
PID 2764 wrote to memory of 816	2764	cmd.exe	42
PID 2764 wrote to memory of 816	2764	cmd.exe	42
PID 2764 wrote to memory of 816	2764	cmd.exe	42
PID 2764 wrote to memory of 3024	2764	cmd.exe	43
PID 2764 wrote to memory of 3024	2764	cmd.exe	43
PID 2764 wrote to memory of 3024	2764	cmd.exe	43
PID 2764 wrote to memory of 3024	2764	cmd.exe	43
PID 2764 wrote to memory of 2260	2764	cmd.exe	44
PID 2764 wrote to memory of 2260	2764	cmd.exe	44
PID 2764 wrote to memory of 2260	2764	cmd.exe	44
PID 2764 wrote to memory of 2260	2764	cmd.exe	44
PID 2764 wrote to memory of 1548	2764	cmd.exe	45
PID 2764 wrote to memory of 1548	2764	cmd.exe	45
PID 2764 wrote to memory of 1548	2764	cmd.exe	45
PID 2764 wrote to memory of 1548	2764	cmd.exe	45
PID 1548 wrote to memory of 852	1548	net.exe	46
PID 1548 wrote to memory of 852	1548	net.exe	46
PID 1548 wrote to memory of 852	1548	net.exe	46
PID 1548 wrote to memory of 852	1548	net.exe	46
PID 1464 wrote to memory of 2676	1464	DongleServer.exe	48
PID 1464 wrote to memory of 2676	1464	DongleServer.exe	48
PID 1464 wrote to memory of 2676	1464	DongleServer.exe	48
PID 1464 wrote to memory of 2676	1464	DongleServer.exe	48
PID 1464 wrote to memory of 2576	1464	DongleServer.exe	49
PID 1464 wrote to memory of 2576	1464	DongleServer.exe	49
PID 1464 wrote to memory of 2576	1464	DongleServer.exe	49
PID 1464 wrote to memory of 2576	1464	DongleServer.exe	49

C:\Users\Admin\AppData\Local\Temp\7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe
"C:\Users\Admin\AppData\Local\Temp\7dd570dc785119b92871362d089f10ca781c027ad04433ae042c7a2622570924.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im "DongleServer.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /t /im "DentalDesktopServer.NTService.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\3Shape\Dongle Server Service\Crack4Dental.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\find.exe
    find "5."
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\mshta.exe
    mshta vbscript:createobject("shell.application").shellexecute("C:\PROGRA~2\3Shape\DONGLE~1\CRACK4~1.BAT","goto :Admin","","runas",1)(window.close)
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\PROGRA~2\3Shape\DONGLE~1\CRACK4~1.BAT" goto :Admin
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\sc config DentalUpdater start=auto
        5⤵
        Launches sc.exe
        
        PID:2544
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\sc config ThreeShapeDentalManagerService start=auto
        5⤵
        Launches sc.exe
        
        PID:2684
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\sc config DongleServerService start=auto
        5⤵
        Launches sc.exe
        
        PID:816
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\System32\sc config DentalDesktopServer start=auto
        5⤵
        Launches sc.exe
        
        PID:3024
    - - C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
        
        "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe" /install /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\SysWOW64\net.exe
        
        C:\Windows\System32\net start DongleServerService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1548
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start DongleServerService
        6⤵
        
        PID:852
    - - C:\Windows\SysWOW64\net.exe
        
        C:\Windows\System32\net start DentalDesktopServer
        5⤵
        
        PID:2564
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start DentalDesktopServer
        6⤵
        
        PID:2756
    - - C:\Windows\SysWOW64\net.exe
        
        C:\Windows\System32\net start ThreeShapeDentalManagerService
        5⤵
        
        PID:2816
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start ThreeShapeDentalManagerService
        6⤵
        
        PID:2840

C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
"C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setacvalueindex 381b4222-f694-41f0-9685-ff5bb260df2e 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setdcvalueindex 381b4222-f694-41f0-9685-ff5bb260df2e 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setacvalueindex a1841308-3541-4fab-bc81-f71556f20b4a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setdcvalueindex a1841308-3541-4fab-bc81-f71556f20b4a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\system32\powercfg.exe" -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\3Shape\Dongle Server Service\3s.dat

Filesize
112KB

MD5
0230a9f24d7fa8759f457d17452b909e

SHA1
c176b404560260cdad3a1ad2143784c13176dff1

SHA256
98271745c1eca49fff504d936f75cbc101050085760aadc8311c1a5eedcbb81b

SHA512
5699bfb1e4136ed718f9ec6d25ebfa6d6e788f5cff189f721195be136de7f3b8509520e58bb9b188c31f39ff719a2d208efbc39b84a6abaaaa543198a8c0d0bc

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\ClientNames.xml

Filesize
1KB

MD5
03e755200772d78f08a5a15b66cfa1b6

SHA1
42e903a8ad88437765bc9de32444a108fab765c2

SHA256
ff6b53313e59b2b77abd2e2ee5fe590f5cbeecf8785bee279a4f312f3bf48783

SHA512
f7863f1dfccb6d7c2b5d57965702d5614a961df2770a0f5eb41a54ad274e879d59bec0f7fc0f8e7a2d00138c9b77c1a1a9d091574021b1256559fc592fe5d325

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\Crack4Dental.bat

Filesize
1KB

MD5
e1f27afeac3b5a37368e89db21f6510b

SHA1
e38e0b2fe09317ea43171e7d88890f796390f4d8

SHA256
ec1a552aef8bff45fbeed30309e1618ce816767a741f15073e08ab1acf5d5839

SHA512
8dab8969128640e57089f6807c57dd63f594a98809b52db320aee44958f7fb3dd5877989a8aa03e130696758701e586ae442a7ce4cec3b28a1ea80c646c98f38

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\Crack4Dental.bat

Filesize
1KB

MD5
e1f27afeac3b5a37368e89db21f6510b

SHA1
e38e0b2fe09317ea43171e7d88890f796390f4d8

SHA256
ec1a552aef8bff45fbeed30309e1618ce816767a741f15073e08ab1acf5d5839

SHA512
8dab8969128640e57089f6807c57dd63f594a98809b52db320aee44958f7fb3dd5877989a8aa03e130696758701e586ae442a7ce4cec3b28a1ea80c646c98f38

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DDCHANGE.DLL

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll

Filesize
151KB

MD5
42772d7f0cf71d62f307408419ff8162

SHA1
a8be2f013fbb7851799b4e255791b8a5bf24bca6

SHA256
e8ed3378b1dcf98650f20c1a44cf08b5d82f2a632200570ea7954d5fbc1c3372

SHA512
7b8a9369beb0dbdb9fe93e434b87a4d5be513cce82d0e205c3c7268684899021010f47ae215caf92442ddbd7dd779ae67c21279e3a816d522400cc58ad619b45

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

Filesize
5.2MB

MD5
e819c6b87d38f3f2ab9dba469adff60e

SHA1
97d0f78c839da1a075f3554506d71d801429e8b0

SHA256
e598cb8d49c566f7a818a03ed979a4433a29b08f5adcd8067b1ced7303dad4b3

SHA512
594ea7dbcdfbc9e886b31a9bff00d3c9f5ad79acfb8194bee58fd7b9bd5360cbd0202b53bf8e4aa8c099e0cd7d7d79b8283cd829f3834d2a2b1f1f5f52b5bf83

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

Filesize
5.2MB

MD5
e819c6b87d38f3f2ab9dba469adff60e

SHA1
97d0f78c839da1a075f3554506d71d801429e8b0

SHA256
e598cb8d49c566f7a818a03ed979a4433a29b08f5adcd8067b1ced7303dad4b3

SHA512
594ea7dbcdfbc9e886b31a9bff00d3c9f5ad79acfb8194bee58fd7b9bd5360cbd0202b53bf8e4aa8c099e0cd7d7d79b8283cd829f3834d2a2b1f1f5f52b5bf83

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

Filesize
5.2MB

MD5
e819c6b87d38f3f2ab9dba469adff60e

SHA1
97d0f78c839da1a075f3554506d71d801429e8b0

SHA256
e598cb8d49c566f7a818a03ed979a4433a29b08f5adcd8067b1ced7303dad4b3

SHA512
594ea7dbcdfbc9e886b31a9bff00d3c9f5ad79acfb8194bee58fd7b9bd5360cbd0202b53bf8e4aa8c099e0cd7d7d79b8283cd829f3834d2a2b1f1f5f52b5bf83

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

Filesize
244B

MD5
8b8b2eb6dbb36d8f1e5fca3d621ed48d

SHA1
9bf612322919707ec1ca1ebbf9df928f4e6e1e80

SHA256
c30a4836f18d26001ba1b6722dfb1c15838e24caf4ab4ea4dd61244e1155c4fc

SHA512
7525bd648d2c2cc893c740951c18b321a75b15cb2d74eaa0f6621133460ded36b4095dda80cf563f45d1dd5dc4adff6ffbaa8a42447dc420468e5e7f6a781895

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServerConfig.xml

Filesize
581B

MD5
c9cf83c3e2068cb8d3d6a75096ed4f0c

SHA1
647bc9eddc3e863807ccea1bbd9fd7e0f270b7c8

SHA256
073651fc93394e138b41330db4172fb02e08867a1cb661960e1d7d873791bfd6

SHA512
0c1c13306dc7dbb93ff524bfb00b1330bd70b65043ab56a6d5fd6d1639dc6f6472fa4086e1596839556f16af9b7bc51168bf0f4b84f90113498f9323ed81a2ec

Download Submit
C:\Program Files (x86)\3Shape\Dongle Server Service\winspool.drv

Filesize
3.6MB

MD5
c3ba93bd9cfb4a0f88499512251de2d0

SHA1
e4a820d34bf0be8c72992509430ecc0f29c0ee3d

SHA256
2f72740f5ecd9804e5d5664950704cf0570f52c042977f62df872810e3fa60c6

SHA512
018ef462569fcf24928d7816768b07f2b3ecdaf92efe32ecf1a8d99b59a7db4b07c0eb4c07eb5ae724656db80503b702b8f253934b19dc4bbb96337458cffe0a

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\3s.dat

Filesize
112KB

MD5
0230a9f24d7fa8759f457d17452b909e

SHA1
c176b404560260cdad3a1ad2143784c13176dff1

SHA256
98271745c1eca49fff504d936f75cbc101050085760aadc8311c1a5eedcbb81b

SHA512
5699bfb1e4136ed718f9ec6d25ebfa6d6e788f5cff189f721195be136de7f3b8509520e58bb9b188c31f39ff719a2d208efbc39b84a6abaaaa543198a8c0d0bc

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\3s.dat

Filesize
112KB

MD5
0230a9f24d7fa8759f457d17452b909e

SHA1
c176b404560260cdad3a1ad2143784c13176dff1

SHA256
98271745c1eca49fff504d936f75cbc101050085760aadc8311c1a5eedcbb81b

SHA512
5699bfb1e4136ed718f9ec6d25ebfa6d6e788f5cff189f721195be136de7f3b8509520e58bb9b188c31f39ff719a2d208efbc39b84a6abaaaa543198a8c0d0bc

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll

Filesize
151KB

MD5
42772d7f0cf71d62f307408419ff8162

SHA1
a8be2f013fbb7851799b4e255791b8a5bf24bca6

SHA256
e8ed3378b1dcf98650f20c1a44cf08b5d82f2a632200570ea7954d5fbc1c3372

SHA512
7b8a9369beb0dbdb9fe93e434b87a4d5be513cce82d0e205c3c7268684899021010f47ae215caf92442ddbd7dd779ae67c21279e3a816d522400cc58ad619b45

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll

Filesize
151KB

MD5
42772d7f0cf71d62f307408419ff8162

SHA1
a8be2f013fbb7851799b4e255791b8a5bf24bca6

SHA256
e8ed3378b1dcf98650f20c1a44cf08b5d82f2a632200570ea7954d5fbc1c3372

SHA512
7b8a9369beb0dbdb9fe93e434b87a4d5be513cce82d0e205c3c7268684899021010f47ae215caf92442ddbd7dd779ae67c21279e3a816d522400cc58ad619b45

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

Filesize
5.2MB

MD5
e819c6b87d38f3f2ab9dba469adff60e

SHA1
97d0f78c839da1a075f3554506d71d801429e8b0

SHA256
e598cb8d49c566f7a818a03ed979a4433a29b08f5adcd8067b1ced7303dad4b3

SHA512
594ea7dbcdfbc9e886b31a9bff00d3c9f5ad79acfb8194bee58fd7b9bd5360cbd0202b53bf8e4aa8c099e0cd7d7d79b8283cd829f3834d2a2b1f1f5f52b5bf83

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

Filesize
5.2MB

MD5
e819c6b87d38f3f2ab9dba469adff60e

SHA1
97d0f78c839da1a075f3554506d71d801429e8b0

SHA256
e598cb8d49c566f7a818a03ed979a4433a29b08f5adcd8067b1ced7303dad4b3

SHA512
594ea7dbcdfbc9e886b31a9bff00d3c9f5ad79acfb8194bee58fd7b9bd5360cbd0202b53bf8e4aa8c099e0cd7d7d79b8283cd829f3834d2a2b1f1f5f52b5bf83

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\Winspool.drv

Filesize
3.6MB

MD5
c3ba93bd9cfb4a0f88499512251de2d0

SHA1
e4a820d34bf0be8c72992509430ecc0f29c0ee3d

SHA256
2f72740f5ecd9804e5d5664950704cf0570f52c042977f62df872810e3fa60c6

SHA512
018ef462569fcf24928d7816768b07f2b3ecdaf92efe32ecf1a8d99b59a7db4b07c0eb4c07eb5ae724656db80503b702b8f253934b19dc4bbb96337458cffe0a

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\Winspool.drv

Filesize
3.6MB

MD5
c3ba93bd9cfb4a0f88499512251de2d0

SHA1
e4a820d34bf0be8c72992509430ecc0f29c0ee3d

SHA256
2f72740f5ecd9804e5d5664950704cf0570f52c042977f62df872810e3fa60c6

SHA512
018ef462569fcf24928d7816768b07f2b3ecdaf92efe32ecf1a8d99b59a7db4b07c0eb4c07eb5ae724656db80503b702b8f253934b19dc4bbb96337458cffe0a

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
\Program Files (x86)\3Shape\Dongle Server Service\ddchange.dll

Filesize
95KB

MD5
37850c457c42e8b48b4b4dd8255fcbac

SHA1
39e9ab478096b3186ba99930952339e648a37247

SHA256
c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

SHA512
45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

Download Submit
memory/1464-343-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/1464-280-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-341-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/1464-342-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/1464-340-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1464-358-0x0000000002090000-0x00000000020AD000-memory.dmp

Filesize
116KB

Download
memory/1464-360-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1464-327-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-321-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-309-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/1464-311-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1464-304-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-298-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-292-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-287-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/1464-357-0x0000000002090000-0x00000000020AD000-memory.dmp

Filesize
116KB

Download
memory/1464-274-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-268-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-262-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-256-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-250-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-244-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/1464-238-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/1464-204-0x00000000739C0000-0x0000000074160000-memory.dmp

Filesize
7.6MB

Download
memory/1464-201-0x00000000739C0000-0x0000000074160000-memory.dmp

Filesize
7.6MB

Download
memory/1464-361-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/1464-362-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/1464-363-0x0000000002090000-0x00000000020AD000-memory.dmp

Filesize
116KB

Download
memory/1464-364-0x0000000002090000-0x00000000020AD000-memory.dmp

Filesize
116KB

Download
memory/1464-370-0x0000000062C20000-0x0000000062C5C000-memory.dmp

Filesize
240KB

Download
memory/2260-77-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2260-94-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-142-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-147-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/2260-149-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2260-159-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-165-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-130-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-124-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/2260-179-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2260-180-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2260-118-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-182-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/2260-184-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/2260-189-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/2260-190-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-192-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-193-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/2260-194-0x0000000071050000-0x00000000717F0000-memory.dmp

Filesize
7.6MB

Download
memory/2260-195-0x0000000062C20000-0x0000000062C5C000-memory.dmp

Filesize
240KB

Download
memory/2260-196-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2260-197-0x0000000000400000-0x0000000000948000-memory.dmp

Filesize
5.3MB

Download
memory/2260-112-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-109-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2260-107-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2260-105-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2260-106-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-103-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2260-101-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2260-99-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2260-100-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-97-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2260-95-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2260-136-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-93-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2260-91-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2260-89-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2260-87-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2260-88-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-85-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2260-83-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2260-81-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2260-82-0x0000000077120000-0x0000000077121000-memory.dmp

Filesize
4KB

Download
memory/2260-79-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2260-75-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2260-76-0x000000007711F000-0x0000000077120000-memory.dmp

Filesize
4KB

Download
memory/2260-73-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2260-71-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2260-70-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2260-68-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2260-65-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2260-63-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2260-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2260-58-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2260-55-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2260-53-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2260-50-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2260-48-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2260-46-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2260-45-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2260-43-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2260-42-0x0000000071050000-0x00000000717F0000-memory.dmp

Filesize
7.6MB

Download
memory/2260-40-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2260-39-0x0000000071050000-0x00000000717F0000-memory.dmp

Filesize
7.6MB

Download
memory/2260-38-0x0000000062C20000-0x0000000062C5C000-memory.dmp

Filesize
240KB

Download