Analysis

  • max time kernel
    145s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 08:44

General

  • Target

    dd75273b1b2eaf807546691b24e4c703cb2963931fd5a7d4c7e77554271b542d.exe

  • Size

    5.1MB

  • MD5

    42eb620e3bd578f6a854f3fd9707d66a

  • SHA1

    e328d5fab3840415fdd02ae7f3d12181f94568f2

  • SHA256

    dd75273b1b2eaf807546691b24e4c703cb2963931fd5a7d4c7e77554271b542d

  • SHA512

    b35e80a54a828d7e80f6702f61f8f5c1acc5bfdba37358e2bd077da5a8567619f49f65460ecde865970694982d76fa2dd9d97e25fe8bbd3bc3dddc0d85e446a2

  • SSDEEP

    98304:1zQuOP7cqK3k+BfwhIJkJFnvLcbRSIGEWJB0jX6ENkSH32nm:WuSchRdJkJlvaFFWTQ6EC6am

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 37 IoCs
  • VMProtect packed file 6 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Power Settings 1 TTPs 14 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Drops file in Program Files directory 32 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd75273b1b2eaf807546691b24e4c703cb2963931fd5a7d4c7e77554271b542d.exe
    "C:\Users\Admin\AppData\Local\Temp\dd75273b1b2eaf807546691b24e4c703cb2963931fd5a7d4c7e77554271b542d.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /t /im "DongleServer.exe"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /t /im "DentalDesktopServer.NTService.exe"
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\3Shape\Dongle Server Service\ClientLicense.bat" "
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\taskkill.exe
        C:\Windows\System32\taskkill /f /t /im "DongleServer.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1204
      • C:\Windows\SysWOW64\taskkill.exe
        C:\Windows\System32\taskkill /f /t /im "DentalDesktopServer.NTService.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5076
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\System32\sc config DentalUpdater start=auto
        3⤵
        • Launches sc.exe
        PID:4080
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\System32\sc config ThreeShapeDentalManagerService start=auto
        3⤵
        • Launches sc.exe
        PID:4636
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\System32\sc config DongleServerService start=auto
        3⤵
        • Launches sc.exe
        PID:740
      • C:\Windows\SysWOW64\sc.exe
        C:\Windows\System32\sc config DentalDesktopServer start=auto
        3⤵
        • Launches sc.exe
        PID:4260
      • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
        "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe" /install /silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:3612
      • C:\Windows\SysWOW64\net.exe
        C:\Windows\System32\net start DongleServerService
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start DongleServerService
          4⤵
            PID:4864
        • C:\Windows\SysWOW64\net.exe
          C:\Windows\System32\net start ThreeShapeDentalManagerService
          3⤵
            PID:4620
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start ThreeShapeDentalManagerService
              4⤵
                PID:3456
            • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
              DongleServer.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              PID:1592
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "Get-Clipboard"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2872
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex 381b4222-f694-41f0-9685-ff5bb260df2e 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2376
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex 381b4222-f694-41f0-9685-ff5bb260df2e 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4520
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex 3af9B8d9-7c97-431d-ad78-34a8bfea439f 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:2808
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex 3af9B8d9-7c97-431d-ad78-34a8bfea439f 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3124
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4284
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4440
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex 961cc777-2547-4f9d-8174-7d86181b8a7a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3472
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex 961cc777-2547-4f9d-8174-7d86181b8a7a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3448
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex a1841308-3541-4fab-bc81-f71556f20b4a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:728
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex a1841308-3541-4fab-bc81-f71556f20b4a 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:720
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex ded574b5-45a0-4f42-8737-46345c09c238 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3168
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex ded574b5-45a0-4f42-8737-46345c09c238 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4048
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setacvalueindex e9a42b02-d5df-448d-aa00-03f14749eb61 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3860
          • C:\Windows\SysWOW64\powercfg.exe
            "C:\Windows\system32\powercfg.exe" -setdcvalueindex e9a42b02-d5df-448d-aa00-03f14749eb61 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:1084
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2296
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:4288
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:448
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2100
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:4516
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2444
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:3240
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          PID:1924
        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe
          "C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          PID:5116

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\3Shape\Dongle Server Service\ClientLicense.bat

          Filesize

          1KB

          MD5

          9fe8ce5663de64fd407968c6a9317c22

          SHA1

          1440c367d350f8ecb4ba8fb7b977c7eaf64c0eaa

          SHA256

          67a4fee9fbe70b7e70378f146d6ccc4de8d3c83fa9b25d87e58593e9193ca099

          SHA512

          c39c3a6399deb6fd2c369990d55dceca62c446c2702c8d4e4187da92af0cdd545d5b99f5c4d448cfcb5f07902f242e75d9a70008a8fccb81c842ea7c6ed3afe8

        • C:\Program Files (x86)\3Shape\Dongle Server Service\ClientNames.xml

          Filesize

          1KB

          MD5

          03e755200772d78f08a5a15b66cfa1b6

          SHA1

          42e903a8ad88437765bc9de32444a108fab765c2

          SHA256

          ff6b53313e59b2b77abd2e2ee5fe590f5cbeecf8785bee279a4f312f3bf48783

          SHA512

          f7863f1dfccb6d7c2b5d57965702d5614a961df2770a0f5eb41a54ad274e879d59bec0f7fc0f8e7a2d00138c9b77c1a1a9d091574021b1256559fc592fe5d325

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DDCHANGE.DLL

          Filesize

          95KB

          MD5

          37850c457c42e8b48b4b4dd8255fcbac

          SHA1

          39e9ab478096b3186ba99930952339e648a37247

          SHA256

          c4d39ff5b0ce78a885c2247806e72ab21fb3f8f2e2877eb44ffa558deeded224

          SHA512

          45e67e00825ce3d7105f4b0c76526a432188d5e8e0e5703eba1d54b8dc05265342703cedc05ca39dadc4b9515faa5de31efc7c09e81ad6be2873d2b478b1b9d8

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DinkeyChange.dll

          Filesize

          494KB

          MD5

          6768851cdf2634e6250541633f8fb504

          SHA1

          5e9185cbed205146ef990e911a7ac523c9dadf70

          SHA256

          ccacbf2473b8b9cd99d7200326801109174b17a6136bd88e9614d7804a733cb4

          SHA512

          9783754c8352380c8b9b7d98f32b33f6391924592a9ac222197b2a62b9bb3d9359bc8adcbed5ee1a53bf6ea5fd5abe9f7643aee70e11e4b0452cabce14213816

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe

          Filesize

          5.2MB

          MD5

          d09d6fc69cbd0b669fac024105eb576b

          SHA1

          506f5d9821c64e0e8bb692098cac2b4d70e02584

          SHA256

          41b11ac538f3f74f99975a3a2aedacbd054a926a0f9f30737a3d5009450ef7c5

          SHA512

          13b6eef492907c5711b8fb8d79c83e9a40899907c03420470f7c7f7044b8410504f559b8c5528f7d3bb51344a08954c01bd8203fc3a91c5c74463edd855635ad

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          6728587152f5460cb756ff24c0e0685e

          SHA1

          1f94baadeeb44cedfb1b6b2fccc4ba6acdc0ac66

          SHA256

          6a74dc0f08ec92d8bb0ab3f7aab8c6d1f8db0cda96a98f38c29128122f189b03

          SHA512

          d6cd02fff82a838d56b8fc511b2b6348ef4fcf65b7982c4804395705743cae1ce3fa8456a690775620768c19ab4449915beff13b0a515aa0ad893ae830707aae

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          c95be990fc3fd7823e4c1cc82a780709

          SHA1

          0aaeef44e41a7eca409a3b9b0acda8fa01c81fa8

          SHA256

          1e749f94002fde94bcb00d77ff420a8fc2876c09e8929514ab3fade89147cc85

          SHA512

          07c6bc1f6287383c226859cc7f2c761c13892621f002ccf872552f3e006ffb305ebb6cff6b525f20e2b38e45010991289643bb9b6a8862277fb8e203d9b629db

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          08423c733f1d2d24dd828c49a21d7297

          SHA1

          04e6c8ff2f29ab387fb6c5772386bb2bfad764bd

          SHA256

          d0a54960fcdcb1d883fc3fc268076605ff2fe170b2eb00d533a65409cf87fe82

          SHA512

          d8c79098508d8925f601226443d0f05196d5ebee8240ff89385a8693dee8087704c9a25a7d4580860282b6a84ab0955766bed21e65b2c5936ecb50801acabdfd

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          d023947116a0b60fd06e196c8590cd53

          SHA1

          80a6a1db69e8197ee3c845141c0e446851ee3fc2

          SHA256

          54e06d6bae2629abd3e3fd4328735773bbf87156d8e21a2884605286b13e4c91

          SHA512

          5587b28db36f49f4865be7319878074d5699aa92dbc64332c6b968fe49e4b2a5168c5edd820e92fb8c742017a3bf8c7efd2882f48869ece33c64e04c0d02d2ba

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          2KB

          MD5

          d083b1a230ae8bc8a4433e93f6869ad5

          SHA1

          b149fc1da13ee4a668a48b0e22a6162834f4da75

          SHA256

          849b67d4b50a0e3f2b179bd82c81be7b437c1b10e459c2fa124d6699d75aaf52

          SHA512

          b55b5c3f252d9b4f6de85bd04aad33962696bda2e088ad89ed1eb07d8127b161ef9666ce0d583ed098a88ca2707bcdc2429b71d45b09be451e2fbb725b8a8402

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          2KB

          MD5

          cfeed49600e989f68b60081ed6e9ca19

          SHA1

          db8e28b0bb4d09343cce23edbaf2c65a236616c8

          SHA256

          b0ffbab5484e599c07b04b9968b8b4477b43aa503733b7b6f15e4f9e2c32f0d5

          SHA512

          58a9688bf757c51cefd0add60248eb8f7e417aebcd495d7ae3c58399ca757b509377c900b4b9e735681ed586453abb00b9a8d6d69c312f25471e3733990661c5

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          2KB

          MD5

          eec0da1ea48806b124a83e0fe3be9587

          SHA1

          101f8f9a094bc1f2f6a6f63cc65adade01dcdc4c

          SHA256

          c3022ef9be75948cf9318d0565ba0df19aa51859c00f2af07999769386ea9de6

          SHA512

          66d16cfcfec5d31000ccd1dfe5b8bee3a0f243707f3bb65722f3a5613d7c5a36311c52c215c73e75677cc0ea8fb2fde4a5d2cbe802cd0d519422be9739bd902b

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          2KB

          MD5

          bd95fcef84da830210b55003ae94d82c

          SHA1

          c361e6e42fe84b55978513817db73f8920562e0d

          SHA256

          33d253527057dd2606079c9d1157a28d31353ff1d23241768a83ff30010ba1b7

          SHA512

          9d12a3e8ee57255428b3b4ce84d5719fb5b85d9c1438a21a159cb94b4f41a6e1345eefa129e886417f69947427d2a32bca3f62abccabee7fe1f469f47b4ea8f8

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          986B

          MD5

          e4492552f06f0507f15fd1eb04704465

          SHA1

          b9b0fe3d8ccf930fbbf6644412ac3fcc85c8d9bb

          SHA256

          95176fbd810bd5a4e01ef8d506fa2d06527243081a117cbbe949a03b0d1b147f

          SHA512

          2c360ba65266614fdf1c98863f286ad68f94f54f45cf11d0e98d51ead12d5ae7c6ae5b1db31fb2f6aae80b3c63a821168d441c1812f22cb89d66bd5eb6887c8d

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          4ea22eb5206840ce7d749d5b20126629

          SHA1

          8b466cc84082dfec253135479e86a91843e31375

          SHA256

          605dfab75b888abdab65f69b99a0a16bd59cc40f3ed717b2b9ed9614fff7815c

          SHA512

          36bae3634e44ffecdf90f92d5aa6813443027e9145b02a95c46ef167c85550d6e9320f73ddcd137592849037142ad2104462bfdee67e75042b7742f1fac30a44

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServer.exe.log

          Filesize

          1KB

          MD5

          aa6bae96070062c75668f6242eae0b48

          SHA1

          c5dfe7f2af11685af9223b83c969c6ae497e478d

          SHA256

          b94dde33b03c4df988db97bca13c66183d7541cdce9e5bcff3b33f4b27f89582

          SHA512

          f18096a964076df6d82919ff82ff961a0de75707a2ee6006ebd34d19c4d6487908fb1dd30060dfacd923f09841fd21cd4672b83efd2d7f58d1ce48d5114ab2e5

        • C:\Program Files (x86)\3Shape\Dongle Server Service\DongleServerConfig.xml

          Filesize

          581B

          MD5

          c9cf83c3e2068cb8d3d6a75096ed4f0c

          SHA1

          647bc9eddc3e863807ccea1bbd9fd7e0f270b7c8

          SHA256

          073651fc93394e138b41330db4172fb02e08867a1cb661960e1d7d873791bfd6

          SHA512

          0c1c13306dc7dbb93ff524bfb00b1330bd70b65043ab56a6d5fd6d1639dc6f6472fa4086e1596839556f16af9b7bc51168bf0f4b84f90113498f9323ed81a2ec

        • C:\Program Files (x86)\3Shape\Dongle Server Service\Winspool.drv

          Filesize

          2.7MB

          MD5

          8077181a3608728119ce333981d2d917

          SHA1

          80eeff801080c2908ac15b22757e71d202bd55f5

          SHA256

          a3d5eb9491d0ac5ba7bb7bb3f44d4d2f459cfbd1ba4007cebd03d18fae0cf3ef

          SHA512

          0ae002c58ec3d007fb54300449d528c747e2a918338f425b8a35482ed853de1992f10d1603ef66c0e505e89082f6c66944d7b8e6edd8de61301ef4c164f07985

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ft31fuke.sew.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/448-179-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/1592-73-0x00000000025E0000-0x00000000025E1000-memory.dmp

          Filesize

          4KB

        • memory/1592-77-0x00000000747D0000-0x0000000074D9C000-memory.dmp

          Filesize

          5.8MB

        • memory/1592-84-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/1592-80-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/1592-76-0x0000000002610000-0x0000000002611000-memory.dmp

          Filesize

          4KB

        • memory/1592-75-0x0000000002600000-0x0000000002601000-memory.dmp

          Filesize

          4KB

        • memory/1592-74-0x00000000025F0000-0x00000000025F1000-memory.dmp

          Filesize

          4KB

        • memory/1592-71-0x00000000025A0000-0x00000000025A1000-memory.dmp

          Filesize

          4KB

        • memory/1592-72-0x00000000025D0000-0x00000000025D1000-memory.dmp

          Filesize

          4KB

        • memory/1592-70-0x0000000002590000-0x0000000002591000-memory.dmp

          Filesize

          4KB

        • memory/1592-69-0x0000000000B90000-0x0000000000B91000-memory.dmp

          Filesize

          4KB

        • memory/1924-293-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2100-202-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2296-125-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/2296-117-0x0000000000B10000-0x0000000000B11000-memory.dmp

          Filesize

          4KB

        • memory/2296-133-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2296-132-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/2296-131-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2296-121-0x00000000013D0000-0x00000000013D1000-memory.dmp

          Filesize

          4KB

        • memory/2296-116-0x0000000000B00000-0x0000000000B01000-memory.dmp

          Filesize

          4KB

        • memory/2296-114-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

          Filesize

          4KB

        • memory/2296-120-0x00000000013C0000-0x00000000013C1000-memory.dmp

          Filesize

          4KB

        • memory/2296-115-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

          Filesize

          4KB

        • memory/2296-122-0x00000000749A0000-0x0000000074F6C000-memory.dmp

          Filesize

          5.8MB

        • memory/2296-118-0x0000000000B40000-0x0000000000B41000-memory.dmp

          Filesize

          4KB

        • memory/2296-119-0x0000000000B50000-0x0000000000B51000-memory.dmp

          Filesize

          4KB

        • memory/2444-249-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2444-246-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/2872-100-0x0000000006140000-0x000000000615E000-memory.dmp

          Filesize

          120KB

        • memory/2872-105-0x0000000007770000-0x0000000007D14000-memory.dmp

          Filesize

          5.6MB

        • memory/2872-89-0x0000000005AF0000-0x0000000005B56000-memory.dmp

          Filesize

          408KB

        • memory/2872-101-0x0000000006340000-0x000000000638C000-memory.dmp

          Filesize

          304KB

        • memory/2872-102-0x0000000007120000-0x00000000071B6000-memory.dmp

          Filesize

          600KB

        • memory/2872-103-0x0000000006620000-0x000000000663A000-memory.dmp

          Filesize

          104KB

        • memory/2872-104-0x0000000006680000-0x00000000066A2000-memory.dmp

          Filesize

          136KB

        • memory/2872-85-0x0000000002B90000-0x0000000002BC6000-memory.dmp

          Filesize

          216KB

        • memory/2872-106-0x0000000007280000-0x0000000007312000-memory.dmp

          Filesize

          584KB

        • memory/2872-86-0x0000000005350000-0x0000000005978000-memory.dmp

          Filesize

          6.2MB

        • memory/2872-99-0x0000000005B60000-0x0000000005EB4000-memory.dmp

          Filesize

          3.3MB

        • memory/2872-88-0x0000000005A80000-0x0000000005AE6000-memory.dmp

          Filesize

          408KB

        • memory/2872-87-0x00000000051B0000-0x00000000051D2000-memory.dmp

          Filesize

          136KB

        • memory/3240-271-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/3612-31-0x0000000002850000-0x0000000002851000-memory.dmp

          Filesize

          4KB

        • memory/3612-26-0x00000000026D0000-0x00000000026D1000-memory.dmp

          Filesize

          4KB

        • memory/3612-42-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/3612-33-0x00000000748C0000-0x0000000074E8C000-memory.dmp

          Filesize

          5.8MB

        • memory/3612-32-0x0000000002860000-0x0000000002861000-memory.dmp

          Filesize

          4KB

        • memory/3612-25-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

          Filesize

          4KB

        • memory/3612-37-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/3612-27-0x0000000002700000-0x0000000002701000-memory.dmp

          Filesize

          4KB

        • memory/3612-28-0x0000000002710000-0x0000000002711000-memory.dmp

          Filesize

          4KB

        • memory/3612-29-0x0000000002830000-0x0000000002831000-memory.dmp

          Filesize

          4KB

        • memory/3612-30-0x0000000002840000-0x0000000002841000-memory.dmp

          Filesize

          4KB

        • memory/3836-52-0x00000000012C0000-0x00000000012C1000-memory.dmp

          Filesize

          4KB

        • memory/3836-49-0x0000000001270000-0x0000000001271000-memory.dmp

          Filesize

          4KB

        • memory/3836-107-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/3836-48-0x0000000000B00000-0x0000000000B01000-memory.dmp

          Filesize

          4KB

        • memory/3836-51-0x00000000012B0000-0x00000000012B1000-memory.dmp

          Filesize

          4KB

        • memory/3836-50-0x00000000012A0000-0x00000000012A1000-memory.dmp

          Filesize

          4KB

        • memory/3836-47-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

          Filesize

          4KB

        • memory/3836-53-0x00000000012D0000-0x00000000012D1000-memory.dmp

          Filesize

          4KB

        • memory/3836-66-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/3836-46-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

          Filesize

          4KB

        • memory/3836-108-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/3836-54-0x00000000747D0000-0x0000000074D9C000-memory.dmp

          Filesize

          5.8MB

        • memory/3836-57-0x0000000000400000-0x0000000000947000-memory.dmp

          Filesize

          5.3MB

        • memory/4288-137-0x0000000001360000-0x0000000001361000-memory.dmp

          Filesize

          4KB

        • memory/4288-140-0x00000000013B0000-0x00000000013B1000-memory.dmp

          Filesize

          4KB

        • memory/4288-153-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/4288-138-0x0000000001370000-0x0000000001371000-memory.dmp

          Filesize

          4KB

        • memory/4288-136-0x0000000000A90000-0x0000000000A91000-memory.dmp

          Filesize

          4KB

        • memory/4288-141-0x00000000013D0000-0x00000000013D1000-memory.dmp

          Filesize

          4KB

        • memory/4288-139-0x0000000001380000-0x0000000001381000-memory.dmp

          Filesize

          4KB

        • memory/4288-142-0x00000000013E0000-0x00000000013E1000-memory.dmp

          Filesize

          4KB

        • memory/4288-144-0x0000000074DF0000-0x00000000753BC000-memory.dmp

          Filesize

          5.8MB

        • memory/4288-143-0x00000000013F0000-0x00000000013F1000-memory.dmp

          Filesize

          4KB

        • memory/4288-156-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/4516-225-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/4516-222-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/5116-309-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB

        • memory/5116-312-0x0000000010000000-0x00000000100B3000-memory.dmp

          Filesize

          716KB