Windows Analysis Report
3Shape Unite Installer.exe

Overview

General Information

Sample name: 3Shape Unite Installer.exe
Analysis ID: 1430706
MD5: 857961a5b10497d89090478072408b67
SHA1: 028c4d320002b979c31e4b839091e34688796276
SHA256: dcd87001dc2761b6b3b66e4c8b7e468ec41375fd9e16ce0e589f4247f480a96c
Infos:

Detection

Score: 42
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 64
Range: 0 - 100

Signatures

.NET source code contains potential unpacker
Queries Google from non browser process on port 80
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Compliance
barindex
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.log Jump to behavior
Source: 3Shape Unite Installer.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 13.107.246.69:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: 3Shape Unite Installer.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\Dinkey\dd_them\32bit\ddchange\debugdll\DDChange64\x64\Release\DDChange64.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: #.dll.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr
Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll.0.dr

Networking
barindex
Queries Google from non browser process on port 80
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe HTTP traffic: HEAD / HTTP/1.1 Host: google.com Connection: Keep-Alive
Yara detected Generic Downloader
Source: Yara match File source: 3Shape Unite Installer.exe, type: SAMPLE
Source: Yara match File source: 0.0.3Shape Unite Installer.exe.ba5a18.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.3Shape Unite Installer.exe.b98060.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.3Shape Unite Installer.exe.b9d338.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.3Shape Unite Installer.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe, type: DROPPED
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /api/versions/latest HTTP/1.1Host: installer.3shapedentaldesktop.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.69 13.107.246.69
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /api/versions/latest HTTP/1.1Host: installer.3shapedentaldesktop.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: 3shape.com
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://3shape.com
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://3shape.com/
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0G
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com/
Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://schemas.3shape.com/2014/DDT/DataAccess
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://schemas.3shape.com/2014/DDT/DataAccessT
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.google.com/sorry/index?continue=http://google.com/&q=EgSaEGkkGJHDobEGIjAT51CbVHv-Lwb5oN8J
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr, ddchange.dll.0.dr String found in binary or memory: http://www.microcosm.co.uk
Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000375B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://3shape.com/
Source: 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://3shapeconfig.com
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://installer.3shapedentaldesktop.com
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000393F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000391F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003923000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://installer.3shapedentaldesktop.com/api/downloads/3Shape
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://installer.3shapedentaldesktop.com/api/versions/latest
Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latest
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldeskt
Source: 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://www.globalsign.com/repository/03
Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.dr String found in binary or memory: https://www.globalsign.com/repository/06
Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr String found in binary or memory: https://www.sqlite.org/copyright.html0
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown HTTPS traffic detected: 13.107.246.69:443 -> 192.168.2.4:49734 version: TLS 1.2
Detected potential crypto function
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Code function: 0_2_013A5A37 0_2_013A5A37
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_063E7950 1_2_063E7950
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B03D698 1_2_0B03D698
PE file contains executable resources (Code or Archives)
Source: DDChange64.dll.0.dr Static PE information: Resource name: OVL type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: SQLite.Interop.dll.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SQLite.Interop.dll0.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Sample file is different than original file name gathered from version info
Source: 3Shape Unite Installer.exe, 00000000.00000002.1678084761.0000000005B00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000097D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.0000000004045000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1677633040.0000000005450000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1678127792.0000000005B10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000636000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1677601420.0000000005440000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000620000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1656965719.0000000000C9A000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000A84000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.0000000002FCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.0000000002FCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2920691455.0000000006190000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2921857805.0000000006943000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2920731005.00000000061A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2922618309.0000000006E10000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2921615763.0000000006400000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe, 00000001.00000002.2920770888.00000000061B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
Source: 3Shape Unite Installer.exe.0.dr Binary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
Source: DinkeyChange.dll.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 3Shape Unite Installer.exe, FN.cs Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 3Shape Unite Installer.exe.0.dr, FN.cs Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 3Shape Unite Installer.exe.0.dr, IA.cs Security API names: System.IO.DirectoryInfo.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 3Shape Unite Installer.exe.0.dr, IA.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 3Shape Unite Installer.exe.0.dr, IA.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 3Shape Unite Installer.exe, IA.cs Security API names: System.IO.DirectoryInfo.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 3Shape Unite Installer.exe, IA.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 3Shape Unite Installer.exe, IA.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: File.GetAccessControl
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: File.SetAccessControl
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: System.IO.DirectoryInfo.GetAccessControl()
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.GetAccessRules(bool, bool, System.Type)
Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal42.troj.evad.winEXE@3/11@3/3
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.log Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Mutant created: NULL
Source: 3Shape Unite Installer.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 3Shape Unite Installer.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.77%
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.dr Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 3Shape Unite Installer.exe String found in binary or memory: 4views/addmanuallypage.baml
Source: 3Shape Unite Installer.exe String found in binary or memory: Dviews/installationabortedpage.baml
Source: 3Shape Unite Installer.exe String found in binary or memory: >views/installationtypepage.baml
Source: 3Shape Unite Installer.exe String found in binary or memory: /silent, /installationType={0}
Source: 3Shape Unite Installer.exe String found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldesktop.com/api/versions/latest
Source: 3Shape Unite Installer.exe String found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/addmanuallypage.xaml
Source: 3Shape Unite Installer.exe String found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/installationtypepage.xaml
Source: 3Shape Unite Installer.exe String found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/installationabortedpage.xaml
Source: 3Shape Unite Installer.exe String found in binary or memory: /donotrun+ /forceserveragentrun- /installationType={0}eConfiguration has been successfully downloaded to
Source: 3Shape Unite Installer.exe String found in binary or memory: GET{https://installer.3shapedentaldesktop.com/api/versions/latest
Source: 3Shape Unite Installer.exe String found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT Caption FROM Win32_OperatingSystemiSELECT OperatingSystemSKU FROM Win32_OperatingSystem10.0){0} v{1}.{2}.{3}.{4}
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File read: C:\Users\user\Desktop\3Shape Unite Installer.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\3Shape Unite Installer.exe "C:\Users\user\Desktop\3Shape Unite Installer.exe"
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: rasman.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: winsta.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: msctfui.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: secur32.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: schannel.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 3Shape Unite Installer.exe Static PE information: certificate valid
Source: 3Shape Unite Installer.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 3Shape Unite Installer.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: 3Shape Unite Installer.exe Static file information: File size 7328464 > 1048576
Source: 3Shape Unite Installer.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x6e2e00
Source: 3Shape Unite Installer.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 3Shape Unite Installer.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\Dinkey\dd_them\32bit\ddchange\debugdll\DDChange64\x64\Release\DDChange64.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: #.dll.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr
Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll.0.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 3Shape Unite Installer.exe, ON.cs .Net Code: V System.Reflection.Assembly.Load(byte[])
Source: 3Shape Unite Installer.exe, ON.cs .Net Code: V System.Reflection.Assembly.Load(byte[])
Source: 3Shape Unite Installer.exe.0.dr, ON.cs .Net Code: V System.Reflection.Assembly.Load(byte[])
Source: 3Shape Unite Installer.exe.0.dr, ON.cs .Net Code: V System.Reflection.Assembly.Load(byte[])
Source: 0.2.3Shape Unite Installer.exe.2fe70c4.3.raw.unpack, AssemblyFactory.cs .Net Code: Load System.Reflection.Assembly.Load(byte[])
PE file contains an invalid checksum
Source: DinkeyChange.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x28794
Source: ddchange.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x1c1cc
Source: DinkeyChange64.dll.0.dr Static PE information: real checksum: 0x5d2b0 should be: 0x5b439
Uses code obfuscation techniques (call, push, ret)
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0347C332 push esp; retf 1_2_0347C341
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_03476475 pushfd ; iretd 1_2_03476479
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0347BE62 pushad ; iretd 1_2_0347BE69
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0347BD6A pushfd ; iretd 1_2_0347BE99
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_063E36B8 push ebp; iretd 1_2_063E36B9
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_063E2BD0 push es; ret 1_2_063E2BE0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B0341B8 push es; ret 1_2_0B034240
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B03ABC3 push es; ret 1_2_0B03ABD0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B03A9F3 push es; ret 1_2_0B03AA00
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B03786F push dword ptr [esp+ecx*2-75h]; ret 1_2_0B037873
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B033891 push es; ret 1_2_0B0338A0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B034331 push es; ret 1_2_0B034340
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B034250 push es; ret 1_2_0B034260
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B034270 push es; ret 1_2_0B034280
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B034290 push es; ret 1_2_0B0342A0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B0342B0 push es; ret 1_2_0B0342C0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B0342D0 push es; ret 1_2_0B0342E0
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Code function: 1_2_0B03C140 push es; ret 1_2_0B03C150
Source: ddchange.dll.0.dr Static PE information: section name: .text entropy: 6.860374789119434
Source: DinkeyChange.dll.0.dr Static PE information: section name: .text entropy: 7.4181442467940615
Source: DinkeyChange64.dll.0.dr Static PE information: section name: .text entropy: 6.810804932361454
Drops PE files
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.log Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Section loaded: OutputDebugStringW count: 113
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Memory allocated: 12F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Memory allocated: 2FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Memory allocated: 12F0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Memory allocated: 3430000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Memory allocated: 3650000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Memory allocated: 3490000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Window / User API: threadDelayed 563 Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Window / User API: threadDelayed 968 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll Jump to dropped file
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Dropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe TID: 7276 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 3Shape Unite Installer.exe, 00000000.00000002.1668795548.000000000145A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 3Shape Unite Installer.exe, 00000001.00000002.2910834390.000000000180A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "c:\programdata\3shape\dentaldesktop.bootstrapper\sessionfiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3shape unite installer.exe" /isconfigured /originalfilepath="c:\users\user\desktop\3shape unite installer.exe" c:\users\user\desktop\3shape unite installer.exe
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Process created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "c:\programdata\3shape\dentaldesktop.bootstrapper\sessionfiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3shape unite installer.exe" /isconfigured /originalfilepath="c:\users\user\desktop\3shape unite installer.exe" c:\users\user\desktop\3shape unite installer.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Queries volume information: C:\Users\user\Desktop\3Shape Unite Installer.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation Jump to behavior
Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\3Shape Unite Installer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.69
 part-0041.t-0009.t-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.251.2.139
 google.com United States
15169 GOOGLEUS false
40.67.232.186
 3shape.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
google.com 142.251.2.139 true
part-0041.t-0009.t-msedge.net 13.107.246.69 true
3shape.com 40.67.232.186 true
installer.3shapedentaldesktop.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://installer.3shapedentaldesktop.com/api/versions/latest false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown