Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
3Shape Unite Installer.exe

Overview

General Information

Sample name:3Shape Unite Installer.exe
Analysis ID:1430706
MD5:857961a5b10497d89090478072408b67
SHA1:028c4d320002b979c31e4b839091e34688796276
SHA256:dcd87001dc2761b6b3b66e4c8b7e468ec41375fd9e16ce0e589f4247f480a96c
Infos:

Detection

Score:42
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:64
Range:0 - 100

Signatures

.NET source code contains potential unpacker
Queries Google from non browser process on port 80
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • 3Shape Unite Installer.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\3Shape Unite Installer.exe" MD5: 857961A5B10497D89090478072408B67)
    • 3Shape Unite Installer.exe (PID: 7312 cmdline: "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe MD5: 857961A5B10497D89090478072408B67)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
3Shape Unite Installer.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.0.3Shape Unite Installer.exe.ba5a18.13.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        0.0.3Shape Unite Installer.exe.b98060.4.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
          0.0.3Shape Unite Installer.exe.b9d338.3.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
            0.0.3Shape Unite Installer.exe.5a0000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              ⊘No Snort rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              Compliance

              barindex
              Creates install or setup log file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.logJump to behavior
              PE / OLE file has a valid certificate
              Source: 3Shape Unite Installer.exeStatic PE information: certificate valid
              Uses secure TLS version for HTTPS connections
              Source: unknownHTTPS traffic detected: 13.107.246.69:443 -> 192.168.2.4:49734 version: TLS 1.2
              Contains modern PE file flags such as dynamic base (ASLR) or NX
              Source: 3Shape Unite Installer.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Binary contains paths to debug symbols
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\Dinkey\dd_them\32bit\ddchange\debugdll\DDChange64\x64\Release\DDChange64.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: #.dll.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr
              Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll.0.dr

              Networking

              barindex
              Queries Google from non browser process on port 80
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeHTTP traffic: HEAD / HTTP/1.1 Host: google.com Connection: Keep-Alive
              Yara detected Generic Downloader
              Source: Yara matchFile source: 3Shape Unite Installer.exe, type: SAMPLE
              Source: Yara matchFile source: 0.0.3Shape Unite Installer.exe.ba5a18.13.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.3Shape Unite Installer.exe.b98060.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.3Shape Unite Installer.exe.b9d338.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.0.3Shape Unite Installer.exe.5a0000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe, type: DROPPED
              Source: global trafficHTTP traffic detected: GET /api/versions/latest HTTP/1.1Host: installer.3shapedentaldesktop.comConnection: Keep-Alive
              Source: Joe Sandbox ViewIP Address: 13.107.246.69 13.107.246.69
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /api/versions/latest HTTP/1.1Host: installer.3shapedentaldesktop.comConnection: Keep-Alive
              Source: unknownDNS traffic detected: queries for: 3shape.com
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://3shape.com
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://3shape.com/
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0G
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl.globalsign.net/root.crl0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://google.com
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://google.com/
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp.digicert.com0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp.digicert.com0A
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp.digicert.com0C
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp.digicert.com0X
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
              Source: 3Shape Unite Installer.exe.0.drString found in binary or memory: http://schemas.3shape.com/2014/DDT/DataAccess
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://schemas.3shape.com/2014/DDT/DataAccessT
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: http://www.digicert.com/CPS0
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/sorry/index?continue=http://google.com/&q=EgSaEGkkGJHDobEGIjAT51CbVHv-Lwb5oN8J
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr, ddchange.dll.0.drString found in binary or memory: http://www.microcosm.co.uk
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.newtonsoft.com/jsonschema
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000375B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://3shape.com/
              Source: 3Shape Unite Installer.exe.0.drString found in binary or memory: https://3shapeconfig.com
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://installer.3shapedentaldesktop.com
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000393F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000391F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003923000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://installer.3shapedentaldesktop.com/api/downloads/3Shape
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: https://installer.3shapedentaldesktop.com/api/versions/latest
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latest
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drString found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldeskt
              Source: 3Shape Unite Installer.exe.0.drString found in binary or memory: https://www.globalsign.com/repository/0
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: https://www.globalsign.com/repository/03
              Source: 3Shape Unite Installer.exe, DinkeyChange64.dll.0.dr, 3Shape Unite Installer.exe.0.drString found in binary or memory: https://www.globalsign.com/repository/06
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
              Source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drString found in binary or memory: https://www.sqlite.org/copyright.html0
              Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
              Source: unknownHTTPS traffic detected: 13.107.246.69:443 -> 192.168.2.4:49734 version: TLS 1.2
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeCode function: 0_2_013A5A370_2_013A5A37
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_063E79501_2_063E7950
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B03D6981_2_0B03D698
              Source: DDChange64.dll.0.drStatic PE information: Resource name: OVL type: PE32 executable (GUI) Intel 80386, for MS Windows
              Source: SQLite.Interop.dll.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: SQLite.Interop.dll0.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1678084761.0000000005B00000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.000000000308B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B6F000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000097D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.0000000004045000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1677633040.0000000005450000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.00000000009FA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1678127792.0000000005B10000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000636000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1677601420.0000000005440000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000B01000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000620000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1656965719.0000000000C9A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.0000000000A84000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.0000000002FCA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1674372572.0000000002FCA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2920691455.0000000006190000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2921857805.0000000006943000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2920731005.00000000061A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2922618309.0000000006E10000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2921615763.0000000006400000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2920770888.00000000061B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exeBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameDDChange2 vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameDinkeyChange.dll: vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameDinkeyChange64.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameSQLite.Interop.dllF vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameDentalDesktop.ModuleAPI.dllP vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.CommonDataAccess.dllX vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Networking.dllh$ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerAddresses.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServerDiscovery.dll\ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.ServiceClientsCore.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.WebBrowserApi.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktopStyles.dll^ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.ErrorHandling.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Globalization.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.IO.dll< vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Licensing.CDC.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Licensing.CDS.CdContracts.dllj% vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Licensing.Dongle.DinkeyUtilities.dllx, vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.PropertyChangedNotification.dlln' vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Security.Cryptography.dllb! vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.SystemInfo.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.SystemWrapper.dllR vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Threading.dllJ vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.TitlelessWindow.dllL vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Win32.dllD vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.Wpf.dll> vs 3Shape Unite Installer.exe
              Source: 3Shape Unite Installer.exe.0.drBinary or memory string: OriginalFilenameThreeShape.DentalDesktop.Bootstrapper.exe: vs 3Shape Unite Installer.exe
              Source: DinkeyChange.dll.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: 3Shape Unite Installer.exe, FN.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
              Source: 3Shape Unite Installer.exe.0.dr, FN.csCryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
              Source: 3Shape Unite Installer.exe.0.dr, IA.csSecurity API names: System.IO.DirectoryInfo.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: 3Shape Unite Installer.exe.0.dr, IA.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
              Source: 3Shape Unite Installer.exe.0.dr, IA.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
              Source: 3Shape Unite Installer.exe, IA.csSecurity API names: System.IO.DirectoryInfo.GetAccessControl(System.Security.AccessControl.AccessControlSections)
              Source: 3Shape Unite Installer.exe, IA.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
              Source: 3Shape Unite Installer.exe, IA.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: File.GetAccessControl
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: File.SetAccessControl
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: System.IO.DirectoryInfo.GetAccessControl()
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.GetAccessRules(bool, bool, System.Type)
              Source: 0.2.3Shape Unite Installer.exe.5b00000.12.raw.unpack, VX.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
              Source: classification engineClassification label: mal42.troj.evad.winEXE@3/11@3/3
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.logJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeMutant created: NULL
              Source: 3Shape Unite Installer.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: 3Shape Unite Installer.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.77%
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
              Source: 3Shape Unite Installer.exe, 00000000.00000000.1655507078.000000000065D000.00000002.00000001.01000000.00000003.sdmp, 3Shape Unite Installer.exe, 00000000.00000002.1675202956.000000000406D000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
              Source: 3Shape Unite Installer.exeString found in binary or memory: 4views/addmanuallypage.baml
              Source: 3Shape Unite Installer.exeString found in binary or memory: Dviews/installationabortedpage.baml
              Source: 3Shape Unite Installer.exeString found in binary or memory: >views/installationtypepage.baml
              Source: 3Shape Unite Installer.exeString found in binary or memory: /silent, /installationType={0}
              Source: 3Shape Unite Installer.exeString found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldesktop.com/api/versions/latest
              Source: 3Shape Unite Installer.exeString found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/addmanuallypage.xaml
              Source: 3Shape Unite Installer.exeString found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/installationtypepage.xaml
              Source: 3Shape Unite Installer.exeString found in binary or memory: /ThreeShape.DentalDesktop.Bootstrapper;component/views/installationabortedpage.xaml
              Source: 3Shape Unite Installer.exeString found in binary or memory: /donotrun+ /forceserveragentrun- /installationType={0}eConfiguration has been successfully downloaded to
              Source: 3Shape Unite Installer.exeString found in binary or memory: GET{https://installer.3shapedentaldesktop.com/api/versions/latest
              Source: 3Shape Unite Installer.exeString found in binary or memory: https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT Caption FROM Win32_OperatingSystemiSELECT OperatingSystemSKU FROM Win32_OperatingSystem10.0){0} v{1}.{2}.{3}.{4}
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile read: C:\Users\user\Desktop\3Shape Unite Installer.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\3Shape Unite Installer.exe "C:\Users\user\Desktop\3Shape Unite Installer.exe"
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exeJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: dwrite.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: msvcp140_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: version.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dwrite.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: msvcp140_clr0400.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: wldp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: amsi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: profapi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: rasman.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: d3d9.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: d3d10warp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: netutils.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: wtsapi32.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: winsta.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dataexchange.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: d3d11.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dcomp.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dxgi.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: twinapi.appcore.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: uiautomationcore.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: propsys.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: windowscodecs.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: msctfui.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: resourcepolicyclient.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: dxcore.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: d3dcompiler_47.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: secur32.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: schannel.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: 3Shape Unite Installer.exeStatic PE information: certificate valid
              Source: 3Shape Unite Installer.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: 3Shape Unite Installer.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
              Source: 3Shape Unite Installer.exeStatic file information: File size 7328464 > 1048576
              Source: 3Shape Unite Installer.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x6e2e00
              Source: 3Shape Unite Installer.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Source: 3Shape Unite Installer.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\DentalDesktop.ModuleAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: 3Shape Unite Installer.exe, 00000001.00000002.2925659767.0000000007AF0000.00000004.08000000.00040000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004651000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\4afd342cc1610f37\ThreeShape.Licensing.CDS.CdContracts\obj\Release\net461\ThreeShape.Licensing.CDS.CdContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\_ThreeShape.SystemWrapper_master\ThreeShape.SystemWrapper\obj\Release\net461\ThreeShape.SystemWrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: e:\src\ThreeShape.Win32\ThreeShape.Win32\obj\Release\ThreeShape.Win32.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\Dinkey\dd_them\32bit\ddchange\debugdll\DDChange64\x64\Release\DDChange64.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktopStyles.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.IO.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\esktop.ServiceClientsCore_v1.0.0\ThreeShape.DentalDesktop.ServiceClientsCore\obj\Release\net461\ThreeShape.DentalDesktop.ServiceClientsCore.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: #.dll.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.Bootstrapper.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.CDC.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerDiscovery_v5.1.0\ThreeShape.DentalDesktop.ServerDiscovery\obj\Release\net461\ThreeShape.DentalDesktop.ServerDiscovery.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\opertyChangedNotification_master\ThreeShape.PropertyChangedNotification\obj\Release\net461\ThreeShape.PropertyChangedNotification.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.DataContracts.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Dental.DentalDesktop.ExternalAPI.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ape.Security.Cryptography_master\ThreeShape.Security.Cryptography\obj\Release\net45\ThreeShape.Security.Cryptography.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.Licensing.Dongle.DinkeyUtilities.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr
              Source: Binary string: E:\src\431bc6c5d902b579\ThreeShape.DentalDesktop.Networking\obj\Release\net46\ThreeShape.DentalDesktop.Networking.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.SystemInfo.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.TitlelessWindow\TitlelessWindow\obj\Release\ThreeShape.TitlelessWindow.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\ared_ThreeShape.Threading_master\ThreeShape.Threading\obj\Release\net461\ThreeShape.Threading.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Globalization\ThreeShape.Globalization\obj\Release\ThreeShape.Globalization.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\ThreeShape.Wpf\ThreeShape.Wpf\obj\Release\ThreeShape.Wpf.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.ErrorHandling.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\jenkins\workspace\alDesktop.ServerAddresses_v1.2.0\ThreeShape.DentalDesktop.ServerAddresses\obj\Release\net461\ThreeShape.DentalDesktop.ServerAddresses.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.DentalDesktop.WebBrowserApi.pdbBSJB source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: E:\src\968681874a7bf6ed\Obfuscated\ThreeShape.CommonDataAccess.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr
              Source: Binary string: C:\dev\sqlite\dotnet\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: 3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll.0.dr

              Data Obfuscation

              barindex
              .NET source code contains potential unpacker
              Source: 3Shape Unite Installer.exe, ON.cs.Net Code: V System.Reflection.Assembly.Load(byte[])
              Source: 3Shape Unite Installer.exe, ON.cs.Net Code: V System.Reflection.Assembly.Load(byte[])
              Source: 3Shape Unite Installer.exe.0.dr, ON.cs.Net Code: V System.Reflection.Assembly.Load(byte[])
              Source: 3Shape Unite Installer.exe.0.dr, ON.cs.Net Code: V System.Reflection.Assembly.Load(byte[])
              Source: 0.2.3Shape Unite Installer.exe.2fe70c4.3.raw.unpack, AssemblyFactory.cs.Net Code: Load System.Reflection.Assembly.Load(byte[])
              Source: DinkeyChange.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x28794
              Source: ddchange.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x1c1cc
              Source: DinkeyChange64.dll.0.drStatic PE information: real checksum: 0x5d2b0 should be: 0x5b439
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0347C332 push esp; retf 1_2_0347C341
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_03476475 pushfd ; iretd 1_2_03476479
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0347BE62 pushad ; iretd 1_2_0347BE69
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0347BD6A pushfd ; iretd 1_2_0347BE99
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_063E36B8 push ebp; iretd 1_2_063E36B9
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_063E2BD0 push es; ret 1_2_063E2BE0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B0341B8 push es; ret 1_2_0B034240
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B03ABC3 push es; ret 1_2_0B03ABD0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B03A9F3 push es; ret 1_2_0B03AA00
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B03786F push dword ptr [esp+ecx*2-75h]; ret 1_2_0B037873
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B033891 push es; ret 1_2_0B0338A0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B034331 push es; ret 1_2_0B034340
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B034250 push es; ret 1_2_0B034260
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B034270 push es; ret 1_2_0B034280
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B034290 push es; ret 1_2_0B0342A0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B0342B0 push es; ret 1_2_0B0342C0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B0342D0 push es; ret 1_2_0B0342E0
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeCode function: 1_2_0B03C140 push es; ret 1_2_0B03C150
              Source: ddchange.dll.0.drStatic PE information: section name: .text entropy: 6.860374789119434
              Source: DinkeyChange.dll.0.drStatic PE information: section name: .text entropy: 7.4181442467940615
              Source: DinkeyChange64.dll.0.drStatic PE information: section name: .text entropy: 6.810804932361454
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.logJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Tries to delay execution (extensive OutputDebugStringW loop)
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeSection loaded: OutputDebugStringW count: 113
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeMemory allocated: 12F0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeMemory allocated: 2FC0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeMemory allocated: 12F0000 memory reserve | memory write watchJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeMemory allocated: 3430000 memory reserve | memory write watchJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeMemory allocated: 3650000 memory reserve | memory write watchJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeMemory allocated: 3490000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeWindow / User API: threadDelayed 563Jump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeWindow / User API: threadDelayed 968Jump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeDropped PE file which has not been started: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dllJump to dropped file
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exe TID: 7276Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: 3Shape Unite Installer.exe, 00000000.00000002.1668795548.000000000145A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
              Source: 3Shape Unite Installer.exe, 00000001.00000002.2910834390.000000000180A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess token adjusted: DebugJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeMemory allocated: page read and write | page guardJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exeJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "c:\programdata\3shape\dentaldesktop.bootstrapper\sessionfiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3shape unite installer.exe" /isconfigured /originalfilepath="c:\users\user\desktop\3shape unite installer.exe" c:\users\user\desktop\3shape unite installer.exe
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeProcess created: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe "c:\programdata\3shape\dentaldesktop.bootstrapper\sessionfiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3shape unite installer.exe" /isconfigured /originalfilepath="c:\users\user\desktop\3shape unite installer.exe" c:\users\user\desktop\3shape unite installer.exeJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeQueries volume information: C:\Users\user\Desktop\3Shape Unite Installer.exe VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
              Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\3Shape Unite Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
              Command and Scripting Interpreter              		1
              DLL Side-Loading              		11
              Process Injection              		1
              Masquerading              		OS Credential Dumping1
              Query Registry              		Remote Services11
              Archive Collected Data              		11
              Encrypted Channel              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
              DLL Side-Loading              		1
              Disable or Modify Tools              		LSASS Memory1
              Security Software Discovery              		Remote Desktop ProtocolData from Removable Media1
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)131
              Virtualization/Sandbox Evasion              		Security Account Manager1
              Process Discovery              		SMB/Windows Admin SharesData from Network Shared Drive2
              Non-Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
              Process Injection              		NTDS131
              Virtualization/Sandbox Evasion              		Distributed Component Object ModelInput Capture3
              Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Deobfuscate/Decode Files or Information              		LSA Secrets1
              Application Window Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
              Obfuscated Files or Information              		Cached Domain Credentials1
              File and Directory Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
              Software Packing              		DCSync12
              System Information Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              DLL Side-Loading              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              3Shape Unite Installer.exe3%ReversingLabs
              3Shape Unite Installer.exe0%VirustotalBrowse

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe3%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe0%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll4%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll1%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll0%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll3%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll2%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll0%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll4%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll1%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll0%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll0%VirustotalBrowse
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll0%ReversingLabs
              C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll0%VirustotalBrowse

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              SourceDetectionScannerLabelLink
              part-0041.t-0009.t-msedge.net0%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              https://csp.withgoogle.com/csp/gws/other-hp0%URL Reputationsafe
              http://james.newtonking.com/projects/json0%URL Reputationsafe
              https://installer.3shapedentaldesktop.com/api/versions/latest0%Avira URL Cloudsafe
              https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldeskt0%Avira URL Cloudsafe
              https://3shapeconfig.com0%Avira URL Cloudsafe
              https://installer.3shapedentaldesktop.com0%Avira URL Cloudsafe
              https://installer.3shapedentaldesktop.com/api/downloads/3Shape0%Avira URL Cloudsafe
              https://3shapeconfig.com0%VirustotalBrowse
              https://installer.3shapedentaldesktopdev.com/api/versions/latest0%Avira URL Cloudsafe
              https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT0%Avira URL Cloudsafe
              http://www.microcosm.co.uk0%Avira URL Cloudsafe
              https://installer.3shapedentaldesktop.com/api/versions/latest0%VirustotalBrowse
              http://www.microcosm.co.uk0%VirustotalBrowse

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              google.com
              		142.251.2.139
              		truefalse
                		high
                part-0041.t-0009.t-msedge.net
                		13.107.246.69
                		truefalseunknown
                3shape.com
                		40.67.232.186
                		truefalse
                  		high
                  installer.3shapedentaldesktop.com
                  		unknown
                  		unknownfalse
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://installer.3shapedentaldesktop.com/api/versions/latestfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://3shape.com3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://google.com/3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://schemas.3shape.com/2014/DDT/DataAccess3Shape Unite Installer.exe.0.drfalse
                          		high
                          https://3shapeconfig.com3Shape Unite Installer.exe.0.drfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          		unknown
                          http://3shape.com/3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://installer.3shapedentaldesktopdev.com/api/versions/latestzhttps://installer.3shapedentaldeskt3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://csp.withgoogle.com/csp/gws/other-hp3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            https://installer.3shapedentaldesktop.com3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.google.com/sorry/index?continue=http://google.com/&q=EgSaEGkkGJHDobEGIjAT51CbVHv-Lwb5oN8J3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://3shape.com/3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000375B000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://www.nuget.org/packages/Newtonsoft.Json.Bson3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://google.com3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://schemas.3shape.com/2014/DDT/DataAccessT3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drfalse
                                      		high
                                      https://www.sqlite.org/copyright.html03Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, SQLite.Interop.dll0.0.dr, SQLite.Interop.dll.0.drfalse
                                        		high
                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003651000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://james.newtonking.com/projects/json3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://installer.3shapedentaldesktop.com/api/downloads/3Shape3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000393F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000391F000.00000004.00000800.00020000.00000000.sdmp, 3Shape Unite Installer.exe, 00000001.00000002.2912305216.0000000003923000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://installer.3shapedentaldesktopdev.com/api/versions/latest3Shape Unite Installer.exe, 00000001.00000002.2912305216.000000000376A000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.microcosm.co.uk3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.dr, DDChange64.dll.0.dr, ddchange.dll.0.drfalse
                                          • 0%, Virustotal, Browse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.newtonsoft.com/jsonschema3Shape Unite Installer.exe, 00000001.00000002.2916978669.0000000004770000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://installer.3shapedentaldesktopdev.com/api/versions/latestSSELECT3Shape Unite Installer.exe, 3Shape Unite Installer.exe.0.drfalse
                                            • Avira URL Cloud: safe
                                            		unknown

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            13.107.246.69
                                            		part-0041.t-0009.t-msedge.netUnited States
                                            		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                            142.251.2.139
                                            		google.comUnited States
                                            		15169GOOGLEUSfalse
                                            40.67.232.186
                                            		3shape.comUnited States
                                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                            General Information

                                            Joe Sandbox version:40.0.0 Tourmaline
                                            Analysis ID:1430706
                                            Start date and time:2024-04-24 03:33:16 +02:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 7m 16s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:8
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Sample name:3Shape Unite Installer.exe
                                            Detection:MAL
                                            Classification:mal42.troj.evad.winEXE@3/11@3/3
                                            EGA Information:
                                            • Successful, ratio: 50%
                                            HCA Information:
                                            • Successful, ratio: 100%
                                            • Number of executed functions: 257
                                            • Number of non-executed functions: 3
                                            Cookbook Comments:
                                            • Found application associated with file extension: .exe

                                            Warnings

                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                            • Excluded IPs from analysis (whitelisted): 20.70.246.20, 20.112.250.133, 20.231.239.246, 20.76.201.171, 20.236.44.162
                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, microsoft.com, prod-dd-inst-cdnep-neu-ms.afd.azureedge.net, prod-dd-inst-cdnep-neu-ms.azureedge.net, fe3cr.delivery.mp.microsoft.com
                                            • Execution Graph export aborted for target 3Shape Unite Installer.exe, PID 7312 because it is empty
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • Report size getting too big, too many NtReadVirtualMemory calls found.

                                            Simulations

                                            Behavior and APIs

                                            ⊘No simulations

                                            Joe Sandbox View / Context

                                            IPs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            13.107.246.69https://wmicrosouab-4ba8.udydzj.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                              https://uqgekpc20qn1.azureedge.net/6466/Get hashmaliciousTechSupportScamBrowse
                                                https://condoresorts.com/Get hashmaliciousUnknownBrowse
                                                  https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0Get hashmaliciousUnknownBrowse
                                                    https://19apmic17.z13.web.core.windows.net/Get hashmaliciousTechSupportScamBrowse
                                                      FFE Order details - Cincy v41720.xlsxGet hashmaliciousUnknownBrowse
                                                        https://pub-32bf4e9c1a1344aa8c0925c562b60fd3.r2.dev/index2.htmlGet hashmaliciousHTMLPhisherBrowse
                                                          https://ukrainerecordings.com/wp-includes/outfit/Office365/Office365/Get hashmaliciousHTMLPhisherBrowse
                                                            https://preview.webflow.com/preview/2024-project?utm_medium=preview_link&utm_source=designer&utm_content=2024-project&preview=2bf57169f6b59ecf9c01ab696f7c3560&workflow=previewGet hashmaliciousHTMLPhisherBrowse
                                                              https://pub-e98bcbb63fbd4f549e44c6a27ef5d234.r2.dev/to.htmlGet hashmaliciousHTMLPhisherBrowse

                                                                Domains

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                part-0041.t-0009.t-msedge.netSecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                                • 13.107.213.69
                                                                https://wmicrosouab-4ba8.udydzj.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.213.69
                                                                https://uqgekpc20qn1.azureedge.net/6466/Get hashmaliciousTechSupportScamBrowse
                                                                • 13.107.246.69
                                                                https://magnisteel.lk/4765445b-32c6-49b0-83e6-1d93765276ca.phpGet hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.213.69
                                                                https://condoresorts.com/Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://mota-engil.caf0sa.com/tiyamike.chikabadwa56078874fessdGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB097140964?5101245168264822=2215800694735574#dGl5YW1pa2UuY2hpa2FiYWR3YUBtb3RhLWVuZ2lsLnB0Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://19apmic17.z13.web.core.windows.net/Get hashmaliciousTechSupportScamBrowse
                                                                • 13.107.246.69
                                                                FFE Order details - Cincy v41720.xlsxGet hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://pub-32bf4e9c1a1344aa8c0925c562b60fd3.r2.dev/index2.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.246.69
                                                                https://hello-world-still-tree-8187.stevenmoulder.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.213.69

                                                                ASNs

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSOHkRFujs2m.exeGet hashmaliciousUnknownBrowse
                                                                • 104.208.16.94
                                                                SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                                • 13.107.213.69
                                                                https://wmicrosouab-4ba8.udydzj.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.213.69
                                                                https://uqgekpc20qn1.azureedge.net/6466/Get hashmaliciousTechSupportScamBrowse
                                                                • 13.107.213.69
                                                                https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2wGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                • 13.89.178.26
                                                                https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2wGet hashmaliciousUnknownBrowse
                                                                • 13.107.136.10
                                                                https://condoresorts.com/Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3DGet hashmaliciousHTMLPhisherBrowse
                                                                • 52.96.189.2
                                                                zlONcFaXkc.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                                • 23.101.168.44
                                                                KxgGGaiW3E.exeGet hashmaliciousQuasarBrowse
                                                                • 13.107.213.41
                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSOHkRFujs2m.exeGet hashmaliciousUnknownBrowse
                                                                • 104.208.16.94
                                                                SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                                • 13.107.213.69
                                                                https://wmicrosouab-4ba8.udydzj.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.213.69
                                                                https://uqgekpc20qn1.azureedge.net/6466/Get hashmaliciousTechSupportScamBrowse
                                                                • 13.107.213.69
                                                                https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2wGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                • 13.89.178.26
                                                                https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2wGet hashmaliciousUnknownBrowse
                                                                • 13.107.136.10
                                                                https://condoresorts.com/Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3DGet hashmaliciousHTMLPhisherBrowse
                                                                • 52.96.189.2
                                                                zlONcFaXkc.exeGet hashmaliciousPureLog Stealer, Xmrig, zgRATBrowse
                                                                • 23.101.168.44
                                                                KxgGGaiW3E.exeGet hashmaliciousQuasarBrowse
                                                                • 13.107.213.41

                                                                JA3 Fingerprints

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                3b5074b1b5d032e5620f69f9f700ff0eScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                • 13.107.246.69
                                                                ScreenConnect.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                • 13.107.246.69
                                                                X1.exeGet hashmaliciousXWormBrowse
                                                                • 13.107.246.69
                                                                Output.exeGet hashmaliciousRedLine, XWormBrowse
                                                                • 13.107.246.69
                                                                X2.exeGet hashmaliciousXWormBrowse
                                                                • 13.107.246.69
                                                                BARSYL SHIPPING Co (VIETNAM).exeGet hashmaliciousAgentTeslaBrowse
                                                                • 13.107.246.69
                                                                https://www.admin-longin.co.jp.mc3lva.cn/Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.69
                                                                https://wmicrosouab-4ba8.udydzj.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                • 13.107.246.69
                                                                KxgGGaiW3E.exeGet hashmaliciousQuasarBrowse
                                                                • 13.107.246.69
                                                                https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-websiteGet hashmaliciousUnknownBrowse
                                                                • 13.107.246.69

                                                                Dropped Files

                                                                ⊘No context

                                                                Created / dropped Files

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\ExceptionLog.txt

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:ASCII text, with CRLF line terminators
                                                                Category:modified
                                                                Size (bytes):1051
                                                                Entropy (8bit):5.194648970377659
                                                                Encrypted:false
                                                                SSDEEP:24:IkDtVRs//TvGs5Gcmt3mtL5HHKkDtVNy3Ij5+t1U2Kk:hDtVRmGs5yt2tLNH3DtVEhVKk
                                                                MD5:09389CDEAA6FA1BC6C4089A72F80A553
                                                                SHA1:87B87BC74FFD69A0B00D2E22FE2FEBDE5F411A8F
                                                                SHA-256:36759C0115CAB0F2A7FBE922A5E9AB7DA0204A49280EA84654BF17C9CB48C0BC
                                                                SHA-512:81C65EB422C32794CE891FF186B58C831070947EA518C02279F13AC4DC629EC469CE11D6B152701EFAD4EB9AC451CE7E8780FC7F935DF4AEE1A30E80054337DC
                                                                Malicious:false
                                                                Reputation:low
                                                                Preview:2024-04-24 03:34:06.234(7256:1) [Application]: 3Shape Unite Installer (version 1.1.0.0) is launched...2024-04-24 03:34:06.250(7256:1) [EnvironmentSetup]: Configuration file extracted...2024-04-24 03:34:06.375(7256:1) [EnvironmentSetup]: Native assemblies unpacked...2024-04-24 03:34:06.562(7256:1) [EnvironmentSetup]: The application instance unpacked...2024-04-24 03:34:06.578(7256:1) [EnvironmentSetup]: The application will be restarted with command line arguments: /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe...2024-04-24 03:34:06.797(7256:1) [Application]: The application is closed with exit code: 0..2024-04-24 03:34:07.242(7312:1) [Application]: 3Shape Unite Installer (version 1.1.0.0) is launched...2024-04-24 03:34:07.382(7312:1) Localization: Loading default localization..2024-04-24 03:34:08.007(7312:1) [Navigation]: The SelectLanguage page was activated...2024-04-24 03:34:10.476(7312:3) [Updati

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):7328464
                                                                Entropy (8bit):6.693432625099296
                                                                Encrypted:false
                                                                SSDEEP:98304:f0sRzqGkPXogSatgi4Ot68Gyctt2sucYY7zzd:NEGkPXowcOfGnqczp
                                                                MD5:857961A5B10497D89090478072408B67
                                                                SHA1:028C4D320002B979C31E4B839091E34688796276
                                                                SHA-256:DCD87001DC2761B6B3B66E4C8B7E468EC41375FD9E16CE0E589F4247F480A96C
                                                                SHA-512:68EF483F5A20A7E27F0DB078598425243548FB1F8964CCBA9502F76A948F0F1300CCC9F07FA88E82057A8999D1F2B4F671BD40EEAE38CD085A3D987A3049A965
                                                                Malicious:true
                                                                Yara Hits:
                                                                • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe, Author: Joe Security
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 3%
                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6d..............0...n...o......Ln.. ...`n...@.. ........................p..... .p...`.................................4Ln.W.....n..w............o..(...`n......Wl.............................................. ............... ..H............text....,n.. ....n................. ..`.reloc.......`n......0n.............@..B.rsrc....w....n..x...2n.............@..@................pLn.....H....... Xl.........I........ik..Wl.....................................".(.....*....0...........(3.....}4.....}5...*....0...........{4...*..0...........{5...*..0..;........u......,/(6....{4....{4...o7...,.(8....{5....{5...o9...*.*..0..4....... .Ne. )UU.Z(6....{4...o:...X )UU.Z(8....{5...o;...X*.0..b........r[..p......%..{4......%q.........-.&.+.......o<....%..{5......%q.........-.&.+.......o<....(=...*...0...........(>...*..0...........(3.....}?.....}@...*....0...........{?.

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe.config

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                Category:dropped
                                                                Size (bytes):2760
                                                                Entropy (8bit):5.011169043874111
                                                                Encrypted:false
                                                                SSDEEP:48:3ErY7JghlgDYag7727Rguo3pgdBJgPvg1zg+XgqPgFQgXw:Urg5okD
                                                                MD5:0A0C44FA175EB4213B621A35C90D9228
                                                                SHA1:FF29BA311B1EF906000AAFA0EFD24D393A5D2B0D
                                                                SHA-256:A7504FA17E4037FB79BB638E290005F23C79324784D1E404D58508497E03FD81
                                                                SHA-512:DD38C19B150200E44F8502C87BB426CA77455B7F6546E1F924B2FF02ADEEF2570F4B845141E5450365968E3415F887574768F7946A62AA5101B717F03C92B7AF
                                                                Malicious:false
                                                                Reputation:low
                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="ThreeShape.ErrorHandling" publicKeyToken="215fdb49399d1d6d" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-1.11.0.0" newVersion="1.11.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="ThreeShape.Maths" publicKeyToken="215fdb49399d1d6d" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-3.6.1.0" newVersion="3.6.1.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="ThreeShape.Globalization" publicKeyToken="215fdb49399d1d6d" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-1.4.3.0" newVersion="1.4.3.0" />.. </dependentAssembly>.. <dependentAssemb

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe:Zone.Identifier

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:ASCII text, with CRLF line terminators
                                                                Category:dropped
                                                                Size (bytes):26
                                                                Entropy (8bit):3.95006375643621
                                                                Encrypted:false
                                                                SSDEEP:3:ggPYV:rPYV
                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                Malicious:false
                                                                Reputation:high, very likely benign file
                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DDChange64.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):82432
                                                                Entropy (8bit):5.442270789603355
                                                                Encrypted:false
                                                                SSDEEP:768:N3rgNOqFBs5c5c5M1177z00AbWAsvCn3GWU+ibPABZLpEVp+AAFF3:N3rgbDq50/z00AbWpY26BZWAT3
                                                                MD5:4966A7494C09889FF84B9EBBF7D30ABE
                                                                SHA1:8B370FC5508EB7AB5C8AA0F696F9CEF5D8691CA6
                                                                SHA-256:E9E216051340522B1C69ABBDEABB686E6DE5865C0C7776662544393F9E220168
                                                                SHA-512:58203879B06BE6F97FDE27F66408E64826B07745553339C4C5AA859C1C2736D42284F4DB256CE0CB5BDE62F3D38D13941CCE95D9B8490428E890B75504E8E2CA
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 4%
                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................%.2.......7.......1.......'....... ......]...............-.......6.......0.......5.....Rich............................PE..d...a=.Q.........." ......... .......&....................................................@..........................................:..[....4..P....`.......P..P............p.......2...............................................0...............................text...A........................... ..`.rdata..+....0......."..............@..@.data........@......................@....pdata..P....P.......0..............@..@.rsrc........`.......2..............@..@.reloc..$....p.......@..............@..B........................................................................................................................................................................................................................................

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):155136
                                                                Entropy (8bit):7.0788339205902915
                                                                Encrypted:false
                                                                SSDEEP:3072:SMvpX3SsC3nG1N+h5WJ3fVhBd52axRlPnBu6l9ujFPpSeBgj6:9X3SsC3pqUanlPT9ujFT
                                                                MD5:2CC2A69B314AC892D4A8BB9CDAAB23E5
                                                                SHA1:7784F055E8A89235A904BE189CE790EB4F285E90
                                                                SHA-256:5C0DDB37C55A07E9BFDB07FA9170019959403A451E04696A9708C29FE90F59E4
                                                                SHA-512:C5946192A44C211277952BA451D5C6615167F478AF67DFEDE4DD89DA00BFCE724193DDE03D094B1D2E06D54F9B597B27DDFBC50319EF111BD5F875E9F50471CD
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                • Antivirus: Virustotal, Detection: 3%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..Q...........!.................M..........................................................................................P...................................................................................................................text............................... ..`.rdata..............................@..@.data...|...........................@....idata.. ............>..............@....rsrc................H..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\DinkeyChange64.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):347544
                                                                Entropy (8bit):6.887202952301689
                                                                Encrypted:false
                                                                SSDEEP:6144:DFp8UR3LBS95C0lxCHcheV2zsyYw0LQdhfbVBNbwYtU:nV4+HgFsHdL+VbbwaU
                                                                MD5:7F02F1D9D47079C6ACA87C6D45847F27
                                                                SHA1:FF7C3C0F86EEAA0982582366A0D2AA1788CBA3E0
                                                                SHA-256:7FA97C8C8D445CDE1B803DE8573C56B313C13770D19FA788B174494EF54A2FF0
                                                                SHA-512:D6E2AD8D24B9992EF600F539CCA73FDBA581B78B5F87E8CBD81D34B6CEB0B898A3D53157B016ACA130F6EE747927DF8DA2440EB5A591AF54C1D1820B5694F96F
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 2%
                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................E.d.......v......g.....f.........~.....q......`.......f.......c.....Rich....................PE..d...R..W.........." .....<..........................................................................................................@....... ...d....p.......P.......2..........,....................................................P...............................text....:.......<.................. ..`.rdata..FH...P...J...@..............@..@.data...........|..................@....pdata.......P... ..................@..@.rsrc........p.......&..............@..@.reloc..B............,..............@..B................................................................................................................................................................................................................................................................

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\ddchange.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):97280
                                                                Entropy (8bit):5.746750249310761
                                                                Encrypted:false
                                                                SSDEEP:1536:pRnJRkpl66DY9wO1w2TR8VL1UQxzW+dWCjmzSlurM+gkrApk+9:bnJqplz8OMTRi1UQxzW+dWxzDr9gkrAB
                                                                MD5:37850C457C42E8B48B4B4DD8255FCBAC
                                                                SHA1:39E9AB478096B3186BA99930952339E648A37247
                                                                SHA-256:C4D39FF5B0CE78A885C2247806E72AB21FB3F8F2E2877EB44FFA558DEEDED224
                                                                SHA-512:45E67E00825CE3D7105F4B0C76526A432188D5E8E0E5703EBA1D54B8DC05265342703CEDC05CA39DADC4B9515FAA5DE31EFC7C09E81AD6BE2873D2B478B1B9D8
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 4%
                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!..O...........!....................................................................................................Y....`..<....p...6..........................................................................\a.. ............................text...p........................... ..`.rdata..Y...........................@..@.data...8g.......R..................@....idata..f....`.......*..............@....rsrc....6...p...8...2..............@..@.reloc..0............j..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x64\SQLite.Interop.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):1393664
                                                                Entropy (8bit):6.544795863073343
                                                                Encrypted:false
                                                                SSDEEP:24576:HZX6YaICEIf9YqtdargprkJ/PNJxcqO28zT5foSWFukJOOQseWVQH:HPImxgNkJ/PNJGHx9foSa
                                                                MD5:CBA28AA203CDA640A79323A4128D01EE
                                                                SHA1:4965B61CBB5B3E276474883C487A0003FC1807B9
                                                                SHA-256:F72FA6368938689EF9E4CDBC9E5F8A5EC5E26E13FA469388968034D571641689
                                                                SHA-512:C5A2B990AFE5975E45FBFF034A19D953CB539B8F340B1682D42C5E6559C9ADCB9CD5F4CFE27A46D6D758035BF5A4B5D5231AB567AD800087663641830D88A6C4
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........PLi..Li..Li......Xi......0i......mi.."2..Ki.."2..Yi.."2..\i....?.Ii..Li...i...2..Mi...2..Mi...2..Mi...2..Mi..RichLi..................PE..d.....hV.........." ................................................................^.....`.............................................V%..h...<....p.......p..........................p............................................................................text.............................. ..`.rdata...[.......\..................@..@.data....E... ......................@....pdata.......p.......6..............@..@.gfids.......`.......&..............@..@.rsrc........p.......(..............@..@.reloc...............2..............@..B................................................................................................................................................................................................

                                                                C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\x86\SQLite.Interop.dll

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                Category:dropped
                                                                Size (bytes):1103360
                                                                Entropy (8bit):6.747014327821667
                                                                Encrypted:false
                                                                SSDEEP:24576:NV7gF9HGvvvqzC/bK8tPElbgYK56phZCjX8CvcFL:jgF1S4Otsl8Gp8vcd
                                                                MD5:04D8E8B85E34A561630AF19E85ED178B
                                                                SHA1:D93ABC69F31337FA4C63F405D909FC5B52A407CB
                                                                SHA-256:35E0A4E6F7D8FA54E05524D5C4A58062245AFCB0D8E6A80DC342F855673BA121
                                                                SHA-512:9FBE94D182C55B18386108AD87127F4B2C1AC7E1D43F46363D6BF489E828C10447EB98EDB208AAF92B34F30B513F8F5533937B05886D4CA3BCCE0036C9294412
                                                                Malicious:false
                                                                Antivirus:
                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                Reputation:low
                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8.N.8.N.8.Ni..N.8.Ni..N.8.Ni..N.8.N.c.O.8.N.c.O.8.N.c.O.8.N..4N.8.N.8.NU8.N.c.O.8.N.c.O.8.N.c.N.8.N.c.O.8.NRich.8.N................PE..L.....hV...........!.....*...................@............................... ......?.....@.........................`....&..hB..<...............................lp..0...p...............................@............@...............................text... ).......*.................. ..`.rdata.......@......................@..@.data....)...P.......<..............@....gfids...............X..............@..@.rsrc................Z..............@..@.reloc..lp.......r...d..............@..B........................................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3Shape Unite Installer.exe.log

                                                                Download File
                                                                Process:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                File Type:CSV text
                                                                Category:dropped
                                                                Size (bytes):1687
                                                                Entropy (8bit):5.338930762014548
                                                                Encrypted:false
                                                                SSDEEP:48:MxHKlYHKh3ouHgJHreylEHMHKo/tHo6hAHKzeR:iqlYqh3ou0aymsqwtI6eqzm
                                                                MD5:15E04367C03184DCF6E0D75C17713029
                                                                SHA1:ED1BF186345A11D8B4741F52B9DDCCE8702C8A12
                                                                SHA-256:C10A3B6F0C9F3DA0C85A63F296C3E027E486BC174FFDDA6371B00AE605799D76
                                                                SHA-512:EE9ADFDF176D8171AFB95920C265CBE5AC652D34990CF924E491C06337929BBDBF9EEEADE96EFB7943D07C25D66D634F49FD9C2B4CFFE072747FAD7E40ED4618
                                                                Malicious:false
                                                                Reputation:moderate, very likely benign file
                                                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

                                                                Static File Info

                                                                General

                                                                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                Entropy (8bit):6.693432625099296
                                                                TrID:
                                                                • Win32 Executable (generic) Net Framework (10011505/4) 49.77%
                                                                • Win32 Executable (generic) a (10002005/4) 49.72%
                                                                • InstallShield setup (43055/19) 0.21%
                                                                • Win32 EXE PECompact compressed (generic) (41571/9) 0.21%
                                                                • Windows Screen Saver (13104/52) 0.07%
                                                                File name:3Shape Unite Installer.exe
                                                                File size:7'328'464 bytes
                                                                MD5:857961a5b10497d89090478072408b67
                                                                SHA1:028c4d320002b979c31e4b839091e34688796276
                                                                SHA256:dcd87001dc2761b6b3b66e4c8b7e468ec41375fd9e16ce0e589f4247f480a96c
                                                                SHA512:68ef483f5a20a7e27f0db078598425243548fb1f8964ccba9502f76a948f0f1300ccc9f07fa88e82057a8999d1f2b4f671bd40eeae38cd085a3d987a3049a965
                                                                SSDEEP:98304:f0sRzqGkPXogSatgi4Ot68Gyctt2sucYY7zzd:NEGkPXowcOfGnqczp
                                                                TLSH:D976BF02B790816AD4BA4A7CA0AA1736A734F8034711A7DB338DB6591FF33E15D3B365
                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6d..............0...n...o......Ln.. ...`n...@.. ........................p..... .p...`................................

                                                                File Icon

                                                                Icon Hash:11418533713c0680

                                                                Static PE Info

                                                                General

                                                                Entrypoint:0xae4c8e
                                                                Entrypoint Section:.text
                                                                Digitally signed:true
                                                                Imagebase:0x400000
                                                                Subsystem:windows gui
                                                                Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                Time Stamp:0x6436BE12 [Wed Apr 12 14:20:02 2023 UTC]
                                                                TLS Callbacks:
                                                                CLR (.Net) Version:
                                                                OS Version Major:4
                                                                OS Version Minor:0
                                                                File Version Major:4
                                                                File Version Minor:0
                                                                Subsystem Version Major:4
                                                                Subsystem Version Minor:0
                                                                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                Authenticode Signature

                                                                Signature Valid:true
                                                                Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                Signature Validation Error:The operation completed successfully
                                                                Error Number:0
                                                                Not Before, Not After
                                                                • 27/12/2022 00:00:00 17/02/2026 23:59:59
                                                                Subject Chain
                                                                • CN=3Shape A/S, O=3Shape A/S, L=Copenhagen, C=DK
                                                                Version:3
                                                                Thumbprint MD5:9FBE0928438D2800BE49C56D777FEDAD
                                                                Thumbprint SHA-1:32674150BC01D2AB67D3A46483F2D68605A4C054
                                                                Thumbprint SHA-256:ECD7CE7D93DA5FE343412AA7F7150CBCD4829695316DF4F4AC5D0E9BEA1F97C7
                                                                Serial:0A6E657572761247EF6FBD3A823531DE

                                                                Entrypoint Preview

                                                                Instruction
                                                                jmp dword ptr [00402000h]
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al
                                                                add byte ptr [eax], al

                                                                Data Directories

                                                                NameVirtual AddressVirtual Size Is in Section
                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x6e4c340x57.text
                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x6e80000x177e4.rsrc
                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x6faa000x28d0.rsrc
                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x6e60000xc.reloc
                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x6c579c0x1c.text
                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                Sections

                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                .text0x20000x6e2c940x6e2e0024b5346c1e47cd5bccb6d21bf2736da0unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                .reloc0x6e60000xc0x20023df09bbf74e4ba6c4216829a342bd1aFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                .rsrc0x6e80000x177e40x17800624be28e78a9f3f770cae894c7876661False0.17839926861702127data3.2633885059563266IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                Resources

                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                RT_ICON0x6e82200x1fc3PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9825359734350019
                                                                RT_ICON0x6ea1e40x10828Device independent bitmap graphic, 128 x 256 x 32, image size 00.05554241097835088
                                                                RT_ICON0x6faa0c0x20f8Device independent bitmap graphic, 48 x 84 x 32, image size 00.14324644549763033
                                                                RT_ICON0x6fcb040xf1cDevice independent bitmap graphic, 32 x 58 x 32, image size 00.187693898655636
                                                                RT_ICON0x6fda200x85cDevice independent bitmap graphic, 24 x 42 x 32, image size 00.24345794392523365
                                                                RT_ICON0x6fe27c0x424Device independent bitmap graphic, 16 x 30 x 32, image size 00.3150943396226415
                                                                RT_GROUP_ICON0x6fe6a00x5adata0.7888888888888889
                                                                RT_VERSION0x6fe6fc0x494OpenPGP Secret Key0.4129692832764505
                                                                RT_MANIFEST0x6feb900xc52XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.39949270767279643

                                                                Imports

                                                                DLLImport
                                                                mscoree.dll_CorExeMain

                                                                Network Behavior

                                                                Network Port Distribution

                                                                TCP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Apr 24, 2024 03:34:08.917548895 CEST4973280192.168.2.4142.251.2.139
                                                                Apr 24, 2024 03:34:08.917573929 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:34:09.094002008 CEST8049732142.251.2.139192.168.2.4
                                                                Apr 24, 2024 03:34:09.094193935 CEST4973280192.168.2.4142.251.2.139
                                                                Apr 24, 2024 03:34:09.094484091 CEST4973280192.168.2.4142.251.2.139
                                                                Apr 24, 2024 03:34:09.209733963 CEST804973140.67.232.186192.168.2.4
                                                                Apr 24, 2024 03:34:09.209872961 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:34:09.210005999 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:34:09.270463943 CEST8049732142.251.2.139192.168.2.4
                                                                Apr 24, 2024 03:34:09.498620987 CEST804973140.67.232.186192.168.2.4
                                                                Apr 24, 2024 03:34:09.498676062 CEST804973140.67.232.186192.168.2.4
                                                                Apr 24, 2024 03:34:09.566649914 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:34:09.703747988 CEST8049732142.251.2.139192.168.2.4
                                                                Apr 24, 2024 03:34:09.703782082 CEST8049732142.251.2.139192.168.2.4
                                                                Apr 24, 2024 03:34:09.703835964 CEST4973280192.168.2.4142.251.2.139
                                                                Apr 24, 2024 03:34:09.926403046 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:09.926466942 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:09.926601887 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:09.936762094 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:09.936774969 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:10.435710907 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:10.435796022 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:10.441349030 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:10.441385984 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:10.441818953 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:10.488526106 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:10.515887022 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:10.560127974 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:11.355895042 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:11.355989933 CEST4434973413.107.246.69192.168.2.4
                                                                Apr 24, 2024 03:34:11.356147051 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:34:11.360344887 CEST49734443192.168.2.413.107.246.69
                                                                Apr 24, 2024 03:35:49.504578114 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:35:49.694508076 CEST4973280192.168.2.4142.251.2.139
                                                                Apr 24, 2024 03:35:49.793061018 CEST804973140.67.232.186192.168.2.4
                                                                Apr 24, 2024 03:35:49.793287992 CEST4973180192.168.2.440.67.232.186
                                                                Apr 24, 2024 03:35:49.871232033 CEST8049732142.251.2.139192.168.2.4
                                                                Apr 24, 2024 03:35:49.871354103 CEST4973280192.168.2.4142.251.2.139

                                                                UDP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Apr 24, 2024 03:34:08.757389069 CEST6516653192.168.2.41.1.1.1
                                                                Apr 24, 2024 03:34:08.757947922 CEST6512453192.168.2.41.1.1.1
                                                                Apr 24, 2024 03:34:08.911227942 CEST53651241.1.1.1192.168.2.4
                                                                Apr 24, 2024 03:34:08.911783934 CEST53651661.1.1.1192.168.2.4
                                                                Apr 24, 2024 03:34:09.615031958 CEST5025553192.168.2.41.1.1.1

                                                                DNS Queries

                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                Apr 24, 2024 03:34:08.757389069 CEST192.168.2.41.1.1.10xe714Standard query (0)3shape.comA (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.757947922 CEST192.168.2.41.1.1.10x88a1Standard query (0)google.comA (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:09.615031958 CEST192.168.2.41.1.1.10xe67dStandard query (0)installer.3shapedentaldesktop.comA (IP address)IN (0x0001)false

                                                                DNS Answers

                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.139A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.138A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.100A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.101A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.113A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911227942 CEST1.1.1.1192.168.2.40x88a1No error (0)google.com142.251.2.102A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:08.911783934 CEST1.1.1.1192.168.2.40xe714No error (0)3shape.com40.67.232.186A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:09.925023079 CEST1.1.1.1192.168.2.40xe67dNo error (0)installer.3shapedentaldesktop.comprod-dd-inst-cdnep-neu-ms.azureedge.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 24, 2024 03:34:09.925023079 CEST1.1.1.1192.168.2.40xe67dNo error (0)shed.dual-low.part-0041.t-0009.t-msedge.netpart-0041.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                Apr 24, 2024 03:34:09.925023079 CEST1.1.1.1192.168.2.40xe67dNo error (0)part-0041.t-0009.t-msedge.net13.107.246.69A (IP address)IN (0x0001)false
                                                                Apr 24, 2024 03:34:09.925023079 CEST1.1.1.1192.168.2.40xe67dNo error (0)part-0041.t-0009.t-msedge.net13.107.213.69A (IP address)IN (0x0001)false

                                                                HTTP Request Dependency Graph

                                                                • installer.3shapedentaldesktop.com

                                                                HTTP Packets

                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                0192.168.2.449732142.251.2.139807312C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe
                                                                TimestampBytes transferredDirectionData
                                                                Apr 24, 2024 03:34:09.094484091 CEST61OUTHEAD / HTTP/1.1
                                                                Host: google.com
                                                                Connection: Keep-Alive
                                                                Apr 24, 2024 03:34:09.703747988 CEST1289INHTTP/1.1 302 Found
                                                                Location: http://www.google.com/sorry/index?continue=http://google.com/&q=EgSaEGkkGJHDobEGIjAT51CbVHv-Lwb5oN8JnDIdjiWSlxTWbi0mczsSCWf8DwOO4TkLGcW7ZMtsPIvep84yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
                                                                x-hallmonitor-challenge: CgwIkcOhsQYQtpTfnAISBJoQaSQ
                                                                Content-Type: text/html; charset=UTF-8
                                                                Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-WFVAj56t771BbMoyEH56HQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                Date: Wed, 24 Apr 2024 01:34:09 GMT
                                                                Server: gws
                                                                Content-Length: 392
                                                                X-XSS-Protection: 0
                                                                X-Frame-Options: SAMEORIGIN
                                                                Set-Cookie: 1P_JAR=2024-04-24-01; expires=Fri, 24-May-2024 01:34:09 GMT; path=/; domain=.google.com; Secure
                                                                Set-Cookie: AEC=AQTF6Hw7ACBI-KhNevzwgn7UBIS-ppkkSuLO3q2Aw93iLlBvFRgceLoorA; expires=Mon, 21-Oct-2024 01:34:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                Set-Cookie: NID=513=aKpX7A7_rA6bQyZHG8Yrs3rGutLkW52bWDU7faBCYv0WuPy1b8dMvJuEpvQROTj4BKI4kkqW2dtEiaoXhk95K6Od_0Ih1mCFEdQ4DAszYC7-tBIO4JVHeOMKHqxUectQvoE5oq3jK6Dy0FU2mD9dBrqqgXLsFcLGmzmbnhK-YBI; expires=Thu, 24-Oct-2024 01:34:09 GMT; path=/; domain=.goog
                                                                Data Raw:
                                                                Data Ascii:
                                                                Apr 24, 2024 03:34:09.703782082 CEST19INData Raw: 65 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 0d 0a 0d 0a
                                                                Data Ascii: e.com; HttpOnly


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                1192.168.2.44973140.67.232.186807312C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe
                                                                TimestampBytes transferredDirectionData
                                                                Apr 24, 2024 03:34:09.210005999 CEST61OUTHEAD / HTTP/1.1
                                                                Host: 3shape.com
                                                                Connection: Keep-Alive
                                                                Apr 24, 2024 03:34:09.498676062 CEST220INHTTP/1.1 301 Moved Permanently
                                                                Server: Microsoft-Azure-Application-Gateway/v2
                                                                Date: Wed, 24 Apr 2024 01:34:09 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 195
                                                                Connection: keep-alive
                                                                Location: https://3shape.com/


                                                                HTTPS Proxied Packets

                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                0192.168.2.44973413.107.246.694437312C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe
                                                                TimestampBytes transferredDirectionData
                                                                2024-04-24 01:34:10 UTC102OUTGET /api/versions/latest HTTP/1.1
                                                                Host: installer.3shapedentaldesktop.com
                                                                Connection: Keep-Alive
                                                                2024-04-24 01:34:11 UTC523INHTTP/1.1 200 OK
                                                                Date: Wed, 24 Apr 2024 01:34:11 GMT
                                                                Content-Type: application/json
                                                                Content-Length: 240
                                                                Connection: close
                                                                Cache-Control: max-age=3600
                                                                Last-Modified: Thu, 08 Jun 2023 07:47:39 GMT
                                                                ETag: 0x8DB67F4A23D4CF3
                                                                x-ms-request-id: 7337c656-501e-0000-7e79-952ed1000000
                                                                x-ms-version: 2009-09-19
                                                                x-ms-lease-status: unlocked
                                                                x-ms-blob-type: BlockBlob
                                                                x-azure-ref: 20240424T013410Z-168bb8d798bwn8c9y2paaa9b2s00000004v000000001fe09
                                                                x-fd-int-roxy-purgeid: 0
                                                                X-Cache: TCP_REVALIDATED_HIT
                                                                Accept-Ranges: bytes
                                                                2024-04-24 01:34:11 UTC240INData Raw: 7b 22 72 65 6c 65 61 73 65 44 61 74 65 22 3a 22 32 30 32 33 2d 30 36 2d 30 38 54 30 30 3a 30 30 3a 30 30 2e 30 30 30 5a 22 2c 22 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 6e 73 74 61 6c 6c 65 72 2e 33 73 68 61 70 65 64 65 6e 74 61 6c 64 65 73 6b 74 6f 70 2e 63 6f 6d 2f 61 70 69 2f 64 6f 77 6e 6c 6f 61 64 73 2f 33 53 68 61 70 65 20 55 6e 69 74 65 20 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 22 2c 22 4d 64 35 22 3a 22 38 35 37 39 36 31 41 35 42 31 30 34 39 37 44 38 39 30 39 30 34 37 38 30 37 32 34 30 38 42 36 37 22 2c 22 49 64 22 3a 22 35 34 36 62 36 63 64 36 2d 66 38 61 63 2d 34 39 34 36 2d 38 63 35 38 2d 61 64 31 38 64 32 65 35 63 38 31 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 2e 30 22 7d 0d 0a
                                                                Data Ascii: {"releaseDate":"2023-06-08T00:00:00.000Z","Url":"https://installer.3shapedentaldesktop.com/api/downloads/3Shape Unite Installer.exe","Md5":"857961A5B10497D89090478072408B67","Id":"546b6cd6-f8ac-4946-8c58-ad18d2e5c813","Version":"1.1.0.0"}


                                                                Statistics

                                                                CPU Usage

                                                                Click to jump to process

                                                                Memory Usage

                                                                Click to jump to process

                                                                High Level Behavior Distribution

                                                                Click to dive into process behavior distribution

                                                                Behavior

                                                                Click to jump to process

                                                                System Behavior

                                                                General

                                                                Target ID:0
                                                                Start time:03:34:05
                                                                Start date:24/04/2024
                                                                Path:C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Users\user\Desktop\3Shape Unite Installer.exe"
                                                                Imagebase:0x5a0000
                                                                File size:7'328'464 bytes
                                                                MD5 hash:857961A5B10497D89090478072408B67
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:true

                                                                General

                                                                Target ID:1
                                                                Start time:03:34:06
                                                                Start date:24/04/2024
                                                                Path:C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe" /IsConfigured /originalFilePath="C:\Users\user\Desktop\3Shape Unite Installer.exe" C:\Users\user\Desktop\3Shape Unite Installer.exe
                                                                Imagebase:0xb20000
                                                                File size:7'328'464 bytes
                                                                MD5 hash:857961A5B10497D89090478072408B67
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Yara matches:
                                                                • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\3Shape\DentalDesktop.Bootstrapper\SessionFiles\29e2cc95-69bf-458f-8c1a-fdc52f6f2d2c\3Shape Unite Installer.exe, Author: Joe Security
                                                                Antivirus matches:
                                                                • Detection: 3%, ReversingLabs
                                                                • Detection: 0%, Virustotal, Browse
                                                                Reputation:low
                                                                Has exited:false

                                                                Disassembly

                                                                Reset < >

                                                                  Execution Graph

                                                                  Execution Coverage:19.7%
                                                                  Dynamic/Decrypted Code Coverage:100%
                                                                  Signature Coverage:0%
                                                                  Total number of Nodes:46
                                                                  Total number of Limit Nodes:0
                                                                  execution_graph 4053 13a0c18 4055 13a0c22 4053->4055 4057 13a2eb0 4055->4057 4058 13a2ee1 4057->4058 4059 13a0c36 4058->4059 4062 13a4a98 4058->4062 4065 13a4a88 4058->4065 4064 13a4aad 4062->4064 4068 13a4af9 4062->4068 4064->4059 4066 13a4af9 MoveFileExW 4065->4066 4067 13a4aad 4065->4067 4066->4067 4067->4059 4069 13a4b02 4068->4069 4076 13a4fb8 4069->4076 4081 13a4fd0 4069->4081 4070 13a4bd5 4086 13a5060 4070->4086 4096 13a5050 4070->4096 4071 13a4be2 4071->4064 4077 13a4fd0 4076->4077 4079 13a5060 MoveFileExW 4077->4079 4080 13a5050 MoveFileExW 4077->4080 4078 13a5005 4078->4070 4079->4078 4080->4078 4082 13a4fe3 4081->4082 4084 13a5060 MoveFileExW 4082->4084 4085 13a5050 MoveFileExW 4082->4085 4083 13a5005 4083->4070 4084->4083 4085->4083 4088 13a5073 4086->4088 4087 13a507a 4087->4071 4088->4087 4093 13a50fc 4088->4093 4094 13a5060 MoveFileExW 4088->4094 4095 13a5050 MoveFileExW 4088->4095 4089 13a5129 4090 13a4978 MoveFileExW 4089->4090 4092 13a5135 4090->4092 4092->4071 4093->4089 4106 13a4978 4093->4106 4094->4088 4095->4088 4098 13a5060 4096->4098 4097 13a507a 4097->4071 4098->4097 4103 13a50fc 4098->4103 4104 13a5060 MoveFileExW 4098->4104 4105 13a5050 MoveFileExW 4098->4105 4099 13a5129 4100 13a4978 MoveFileExW 4099->4100 4102 13a5135 4100->4102 4101 13a4978 MoveFileExW 4101->4103 4102->4071 4103->4099 4103->4101 4104->4098 4105->4098 4108 13a5150 MoveFileExW 4106->4108 4109 13a51ec 4108->4109 4109->4093

                                                                  Executed Functions

                                                                  Function 013A4978 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 141 13a4978-13a51a2 144 13a51ad-13a51b1 141->144 145 13a51a4-13a51aa 141->145 146 13a51b9-13a51ea MoveFileExW 144->146 147 13a51b3-13a51b6 144->147 145->144 148 13a51ec-13a51f2 146->148 149 13a51f3-13a5214 146->149 147->146 148->149
                                                                  APIs
                                                                  • MoveFileExW.KERNELBASE(013A5135,00000000,?), ref: 013A51DD
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668766835.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_13a0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID: FileMove
                                                                  • String ID:
                                                                  • API String ID: 3562171763-0
                                                                  • Opcode ID: 20d331561ecf252115bdbb42de6add999be37f71622610449d76132de62dedf4
                                                                  • Instruction ID: 5546c24c8cca083b7b78a25d903c593e98cc0f61d41220cb33ee0a9c121b191f
                                                                  • Opcode Fuzzy Hash: 20d331561ecf252115bdbb42de6add999be37f71622610449d76132de62dedf4
                                                                  • Instruction Fuzzy Hash: D52126B5D012099FDB04CF99D8847EEFBF5EB48314F24806AE908AB341D774AA44CBA4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 013A5149 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 151 13a5149-13a51a2 154 13a51ad-13a51b1 151->154 155 13a51a4-13a51aa 151->155 156 13a51b9-13a51ea MoveFileExW 154->156 157 13a51b3-13a51b6 154->157 155->154 158 13a51ec-13a51f2 156->158 159 13a51f3-13a5214 156->159 157->156 158->159
                                                                  APIs
                                                                  • MoveFileExW.KERNELBASE(013A5135,00000000,?), ref: 013A51DD
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668766835.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_13a0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID: FileMove
                                                                  • String ID:
                                                                  • API String ID: 3562171763-0
                                                                  • Opcode ID: 5264f094ce14d25aa722b4ebd110031c34292efc4826ed57f737f6d5088142d4
                                                                  • Instruction ID: 95702e56cd47df92a0b1a9eccaaf5f059a5266153c353db2d882b42dd32203b0
                                                                  • Opcode Fuzzy Hash: 5264f094ce14d25aa722b4ebd110031c34292efc4826ed57f737f6d5088142d4
                                                                  • Instruction Fuzzy Hash: 6D2126B5C012099FDB04CF99D8847EEFBF5EB48314F24806AD918A7241D774AA44CBA4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0124D06C Relevance: .1, Instructions: 77COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668358312.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_124d000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5162e1a72b10f3907cf4b83093d0f6b12a9099ac50d57f0216155f4cd283d898
                                                                  • Instruction ID: 4998275c9bbbfa94b068322d2accce3d7abb40d64828bb1871a5bd5f62b1c0d4
                                                                  • Opcode Fuzzy Hash: 5162e1a72b10f3907cf4b83093d0f6b12a9099ac50d57f0216155f4cd283d898
                                                                  • Instruction Fuzzy Hash: 51213671110208DFCB0ADF94C9C4B16BFA5FB98314F20C269EE090B256C33AD416CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0125D01C Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668507087.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_125d000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a91c7cc28511680063751f0f6c207ae6e52534a81925dfc59c76696b876efaba
                                                                  • Instruction ID: b19b12d9ab0989d6be67036f02f1cbc906a246f81b5d0416aa32da94d0db8090
                                                                  • Opcode Fuzzy Hash: a91c7cc28511680063751f0f6c207ae6e52534a81925dfc59c76696b876efaba
                                                                  • Instruction Fuzzy Hash: 43214270214208DFCB51DF68D9C0B26BFA1EB84314F20C56DDD0A4B256C37AD407CA61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0125D006 Relevance: .1, Instructions: 60COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668507087.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_125d000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e563794630f549067dcb6a8c441a60529d20a9fd6f4cf1a62ac90ef3231477e2
                                                                  • Instruction ID: d72c03bd0912ecfb5b9a86a252578b4bd197306b213ac2107cc62bb2812eb1d6
                                                                  • Opcode Fuzzy Hash: e563794630f549067dcb6a8c441a60529d20a9fd6f4cf1a62ac90ef3231477e2
                                                                  • Instruction Fuzzy Hash: 52219A755093848FDB03CF24D9D4B15BF71EB46314F28C5EAD9498B2A7C33A980ACB62
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0124D067 Relevance: .1, Instructions: 58COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668358312.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_124d000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
                                                                  • Instruction ID: 66c124b71ad020de74de310f0895c8c708442291bf4b45ece3b3aff60b6f18b0
                                                                  • Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
                                                                  • Instruction Fuzzy Hash: A6219D76504284DFDB0ACF54D9C4B16BF72FB98314F24C6A9DE490B256C33AD426CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Non-executed Functions

                                                                  Function 013A5A37 Relevance: 14.8, Strings: 11, Instructions: 1052COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1668766835.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_13a0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$c^q$c^q
                                                                  • API String ID: 0-3459267885
                                                                  • Opcode ID: 13dfb851df17c702ddd2e7b4c4f3d6bf80e97518b38409c123e788b6db369665
                                                                  • Instruction ID: d79bf1762ddebbfd360e86b6806e25200a313a1179533bd1815126b9f992875b
                                                                  • Opcode Fuzzy Hash: 13dfb851df17c702ddd2e7b4c4f3d6bf80e97518b38409c123e788b6db369665
                                                                  • Instruction Fuzzy Hash: 4E727660B801284BCB6DEB7D446037E69E7BFCC744B6499ADD006DB394EE25CC864BD2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Executed Functions

                                                                  Function 0B03D698 Relevance: 4.3, Strings: 3, Instructions: 536COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$(bq$\;^q
                                                                  • API String ID: 0-208789800
                                                                  • Opcode ID: a6d3fba6d4d3c421713dcdb48ce8206bdf0cce42472a39d2866c040dc754acfa
                                                                  • Instruction ID: bcc9e4e30161322ced15e495ae34c973c11fbc8757f89890530534d0e6a32a58
                                                                  • Opcode Fuzzy Hash: a6d3fba6d4d3c421713dcdb48ce8206bdf0cce42472a39d2866c040dc754acfa
                                                                  • Instruction Fuzzy Hash: 95326E30E10219CFCB19DF78C85869DBBB6FF85300F1586A9D446AB251EB71E989CF90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B036100 Relevance: 21.0, Strings: 16, Instructions: 991COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
                                                                  • API String ID: 0-3238858861
                                                                  • Opcode ID: 64da1f1cdaa66629a07d85fd6ef7bd0d04e83a3db9bdff2ceab9537c942985fe
                                                                  • Instruction ID: 784e039605b51ea0c23b51f3fabf9dd7cf648dd83c0c1139f28b1e12564f7f6a
                                                                  • Opcode Fuzzy Hash: 64da1f1cdaa66629a07d85fd6ef7bd0d04e83a3db9bdff2ceab9537c942985fe
                                                                  • Instruction Fuzzy Hash: 02B2D674A40218CFCB259F60C954ADDBBB6FF8A300F1045EAD5096B3A4DB369E85CF91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B036120 Relevance: 21.0, Strings: 16, Instructions: 981COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
                                                                  • API String ID: 0-3238858861
                                                                  • Opcode ID: fc36f75d50e9d95348a04edf0fce8ac4c3ca45cdc79890aaa71793c05ca6ebd8
                                                                  • Instruction ID: 9913f13c8902a84c4a9e775f5e52b6e32f10dbfd43fe162bd96135fceb91e3f2
                                                                  • Opcode Fuzzy Hash: fc36f75d50e9d95348a04edf0fce8ac4c3ca45cdc79890aaa71793c05ca6ebd8
                                                                  • Instruction Fuzzy Hash: CAB2C674A40218CFCB259F60C954ADDBBB6FF8A300F1045E9D50A6B3A4DB369E85CF91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038B08 Relevance: 6.4, Strings: 5, Instructions: 182COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$\;^q$l;>p$?>p$|]q
                                                                  • API String ID: 0-2096663882
                                                                  • Opcode ID: b72fa528d8022fab51fe01655c3264fe3af97ac6488eb21e1bf3d5dc1b46a2e6
                                                                  • Instruction ID: aff1bbf4515c623faff778ed1c3deb68458295fe40e88e519e82711db322894d
                                                                  • Opcode Fuzzy Hash: b72fa528d8022fab51fe01655c3264fe3af97ac6488eb21e1bf3d5dc1b46a2e6
                                                                  • Instruction Fuzzy Hash: 9B51E774F502168BDB0C9B7A895827FA6EB7FC4A80B14C46AE906D7398EE35CC028755
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E0760 Relevance: 5.2, Strings: 4, Instructions: 205COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $^q$$^q$$^q$$^q
                                                                  • API String ID: 0-2125118731
                                                                  • Opcode ID: ba2002f60f78b784c7472894f83818a22fd57efa8286b16c2a7c8672664d7046
                                                                  • Instruction ID: d4670e0c1bd1294797a19337afeeea37672bd77cc8fa749ff1f6d488e77b0046
                                                                  • Opcode Fuzzy Hash: ba2002f60f78b784c7472894f83818a22fd57efa8286b16c2a7c8672664d7046
                                                                  • Instruction Fuzzy Hash: 0E6169307501259FDB999F69D85892A7BBAFB89B10B104069F506CB3A1CB75DC22CFE0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471C10 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: PH^q$$^q$$^q$$^q
                                                                  • API String ID: 0-1351197249
                                                                  • Opcode ID: fbfbcc28948e64c83f6d86d36b141d3ef32b63ffaee4a6ae1f73fffc052cbb73
                                                                  • Instruction ID: ae8483a8b8bb1b36ff89a50cebee35e273c04c0106a85a179b4a340b4418357e
                                                                  • Opcode Fuzzy Hash: fbfbcc28948e64c83f6d86d36b141d3ef32b63ffaee4a6ae1f73fffc052cbb73
                                                                  • Instruction Fuzzy Hash: 53312A70B002098FDB29DF65D558AAEBBF9BF48640F14446AE806EB354EB34EC41CF54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E3010 Relevance: 4.3, Strings: 3, Instructions: 520COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$(bq$(bq
                                                                  • API String ID: 0-2716923250
                                                                  • Opcode ID: 7ae7e83ae99de644c52b960023b75774eaf6c1d65c520f771154eded61dcc779
                                                                  • Instruction ID: 7c7525535105f351eb00b9876e61631216b26cd835be7fe15f96d6614f6919a5
                                                                  • Opcode Fuzzy Hash: 7ae7e83ae99de644c52b960023b75774eaf6c1d65c520f771154eded61dcc779
                                                                  • Instruction Fuzzy Hash: CF227074A10219CFDB55DF64C884AAEBBB6FF88310F108159E916A73A4DB31EC45CFA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E1568 Relevance: 4.2, Strings: 3, Instructions: 492COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$(bq$(bq
                                                                  • API String ID: 0-2716923250
                                                                  • Opcode ID: 9844d378f2d75a1e6e468148740b2c8f1492f80d3589ed8cc7e4218d0230fad7
                                                                  • Instruction ID: 848ea07596258ff0c29f94d1a9ff3a3b5fd6cb404a2086cce3be1c5526e04621
                                                                  • Opcode Fuzzy Hash: 9844d378f2d75a1e6e468148740b2c8f1492f80d3589ed8cc7e4218d0230fad7
                                                                  • Instruction Fuzzy Hash: 7F123D74E002198FCB54DF69C5846AEBBF6FF88300F24851AE846E7794DB35AD41CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03CAE8 Relevance: 3.9, Strings: 3, Instructions: 130COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$,bq$,bq
                                                                  • API String ID: 0-4208516594
                                                                  • Opcode ID: 4a7879a3959b91673cd5e4a34e16f898d8372db7c392995726113e71a50bc50e
                                                                  • Instruction ID: e1e4be8ba53094e9687eb8bfb65aa2ec06ce0beee0e0f62404191af9a8ddadab
                                                                  • Opcode Fuzzy Hash: 4a7879a3959b91673cd5e4a34e16f898d8372db7c392995726113e71a50bc50e
                                                                  • Instruction Fuzzy Hash: 3F4180347002058FD728DF69C89896EB7F6FF89741B258069D406EB3A5DB34EC41CB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E44D0 Relevance: 3.0, Strings: 2, Instructions: 460COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$d
                                                                  • API String ID: 0-3334038649
                                                                  • Opcode ID: 7618290c63bcc8ff92120d15626ef6059c867d856e006e1313dd3183532b784f
                                                                  • Instruction ID: 9b2bca1c4bbaef36594ed9373d7ca12dbfd00e8f1e45f2b7620e7ecf07f3fb57
                                                                  • Opcode Fuzzy Hash: 7618290c63bcc8ff92120d15626ef6059c867d856e006e1313dd3183532b784f
                                                                  • Instruction Fuzzy Hash: 8A029B34A006158FCB50CF19C58496ABBF6FF88314B15CA69D46A9B7A6DB30FC45CBE0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E4BF8 Relevance: 2.8, Strings: 2, Instructions: 310COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $&_q$4c^q
                                                                  • API String ID: 0-290277841
                                                                  • Opcode ID: 11fa829964d4c6647653927812b11b882a4cf55d0b029b6da3ce60aa58259bac
                                                                  • Instruction ID: c07323eabe36b2d40b7751a79d48eae6686a4be4f3a0a582e41387ee6611deb2
                                                                  • Opcode Fuzzy Hash: 11fa829964d4c6647653927812b11b882a4cf55d0b029b6da3ce60aa58259bac
                                                                  • Instruction Fuzzy Hash: 34B15234B146208FDB989B28D49462E73EBEB88B05F108819D547877C6CF79EC468BF5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E4A88 Relevance: 2.6, Strings: 2, Instructions: 123COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $&_q$(bq
                                                                  • API String ID: 0-1346867293
                                                                  • Opcode ID: d0a391dd72b8fc00118d555bbacdaa19cd943344578a6c3381bfc6333d916aea
                                                                  • Instruction ID: f7a3e4a118aab705adb619c50d0d9d28ff6eedfa384c61698f1f2ea8ff7a9b49
                                                                  • Opcode Fuzzy Hash: d0a391dd72b8fc00118d555bbacdaa19cd943344578a6c3381bfc6333d916aea
                                                                  • Instruction Fuzzy Hash: 2D418B75E005268FCB40CF59D484A6EF7E5FF88320B258655E929AB792C730EC51CBD4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471C00 Relevance: 2.6, Strings: 2, Instructions: 80COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: PH^q$$^q
                                                                  • API String ID: 0-3643753056
                                                                  • Opcode ID: e7a197e5a0134a74480ff9001041747ea0b15e375bcd65cc0ef13d550000fe65
                                                                  • Instruction ID: 38ca4441d5a049447e5faeb593cabc4651d8ef11e762170e3e9e61b438614a79
                                                                  • Opcode Fuzzy Hash: e7a197e5a0134a74480ff9001041747ea0b15e375bcd65cc0ef13d550000fe65
                                                                  • Instruction Fuzzy Hash: E6314974A002088FDB29DF64D498A9EBBF5BF4C740F14446AE806EB355EB34AC41CB54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E0040 Relevance: 2.6, Strings: 2, Instructions: 60COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $^q$$^q
                                                                  • API String ID: 0-355816377
                                                                  • Opcode ID: afee17883a1af01a96691302bbff0c8960876b6e8f53621e5a56084ea011d1a5
                                                                  • Instruction ID: 2b55b4270455d2ad4bcbf020364822df6372670d6706c53d5fb5431539f9c8e0
                                                                  • Opcode Fuzzy Hash: afee17883a1af01a96691302bbff0c8960876b6e8f53621e5a56084ea011d1a5
                                                                  • Instruction Fuzzy Hash: D7118134628228CFE76C1FA4D96872A76AEAB84704F10441ED0438FAC9CBF58D158BF1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E561D Relevance: 1.7, Strings: 1, Instructions: 446COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (
                                                                  • API String ID: 0-3887548279
                                                                  • Opcode ID: fb6c0eb1153e50056ad5a7bf276db5d8a9d4dffe04d3a5be38b03156bf035730
                                                                  • Instruction ID: f54e372030757b68e1c605381ee0c8c3c1727a15867e277d7c087e4737939f03
                                                                  • Opcode Fuzzy Hash: fb6c0eb1153e50056ad5a7bf276db5d8a9d4dffe04d3a5be38b03156bf035730
                                                                  • Instruction Fuzzy Hash: 4951E7366002199FCF118F65DC849DABBB6FF89324F148166F505871A1D732D8A5DBF0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0348F0 Relevance: 1.6, Strings: 1, Instructions: 355COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 1981727421bce545c668252f3f2e356828745e0f01bb4d299d92c762fac02770
                                                                  • Instruction ID: 6719126837e4131bf903e0b2d31fb6a061e29bf099bbb9b83ad1e01cb6233565
                                                                  • Opcode Fuzzy Hash: 1981727421bce545c668252f3f2e356828745e0f01bb4d299d92c762fac02770
                                                                  • Instruction Fuzzy Hash: 11E1A375A102068FCB49DF68C584AADBBF6FF89700F1581A5E905AF365EB30ED41CB50
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03C168 Relevance: 1.6, Strings: 1, Instructions: 336COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (Acq
                                                                  • API String ID: 0-1548273396
                                                                  • Opcode ID: 7ddab9bbf1d8770d317f578d348c87b853a653a2b4b761fd17990638d4ab8ebf
                                                                  • Instruction ID: 27fce4daab2774990a3423bcabc0495dc270754bf34e27cc34a3cdff6a89c488
                                                                  • Opcode Fuzzy Hash: 7ddab9bbf1d8770d317f578d348c87b853a653a2b4b761fd17990638d4ab8ebf
                                                                  • Instruction Fuzzy Hash: 83C13C70B003099FDB69DFA9D5986AEBBFAFF88640F144029E406EB354DB709C45CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034722A8 Relevance: 1.6, Strings: 1, Instructions: 322COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: XX^q
                                                                  • API String ID: 0-1315485225
                                                                  • Opcode ID: ad6c6865570195bb905fb70df5b833089464dd3e077187e34ca8f0f65cb4a24c
                                                                  • Instruction ID: 6dad0d94da23781cf62fcbec1bafc6b4b386202e35207df0f3e0f38509ff1177
                                                                  • Opcode Fuzzy Hash: ad6c6865570195bb905fb70df5b833089464dd3e077187e34ca8f0f65cb4a24c
                                                                  • Instruction Fuzzy Hash: 01C10475B002148FD754DB69C898A6AB7F6FF88710F2581A9E906EF3B1CA70EC44CB54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03472292 Relevance: 1.5, Strings: 1, Instructions: 258COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: XX^q
                                                                  • API String ID: 0-1315485225
                                                                  • Opcode ID: f2fffd5b98e71956bbe7d63fd5de02739920cab208bb062ee765c0074d71e591
                                                                  • Instruction ID: 6e24febe90c129ca8e7826e141a97a60dd0dabfe805b6bb8ce07211950d9fc5c
                                                                  • Opcode Fuzzy Hash: f2fffd5b98e71956bbe7d63fd5de02739920cab208bb062ee765c0074d71e591
                                                                  • Instruction Fuzzy Hash: 88A11174B002158FD754DB69C898A69BBF6FF88710F2581AAE906DF3B1CA70EC40CB54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477418 Relevance: 1.5, Strings: 1, Instructions: 235COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: PH^q
                                                                  • API String ID: 0-2549759414
                                                                  • Opcode ID: 521f105973618908d605b81684589674dec4b24efaafae37ec9a8f2d3ed996bf
                                                                  • Instruction ID: 148548a59e9e4a4b11770c208f73fbed3deb4a740237c4105760a44cf8a0c92e
                                                                  • Opcode Fuzzy Hash: 521f105973618908d605b81684589674dec4b24efaafae37ec9a8f2d3ed996bf
                                                                  • Instruction Fuzzy Hash: ABA15934B00204CFCB44DF78D5989ADBBF6EF89214B6485A9E406EB365EB31EC45CB50
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477428 Relevance: 1.5, Strings: 1, Instructions: 230COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: PH^q
                                                                  • API String ID: 0-2549759414
                                                                  • Opcode ID: f4c1d1157decfb68d5497c9693cd0a22ab4dfb519dece98ec7e0a95e8008d503
                                                                  • Instruction ID: b1b594d15068c1157d2161ff99717f5d72966a2a3ede2b3694980691bbea102d
                                                                  • Opcode Fuzzy Hash: f4c1d1157decfb68d5497c9693cd0a22ab4dfb519dece98ec7e0a95e8008d503
                                                                  • Instruction Fuzzy Hash: 85915734B00204CFCB44DF78D5989AEBBF6EF89250B6485A9E40ADB365EB31EC45CB50
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033567 Relevance: 1.5, Strings: 1, Instructions: 226COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: ,bq
                                                                  • API String ID: 0-2474004448
                                                                  • Opcode ID: 24084ca54513cc45cae8c5541d070cde72934685c985b65bb6720a026a107799
                                                                  • Instruction ID: 8044a680bfdb6f0628bf7647cff09e5bf3d78ea5ba850a38f71b3bd96de4eda3
                                                                  • Opcode Fuzzy Hash: 24084ca54513cc45cae8c5541d070cde72934685c985b65bb6720a026a107799
                                                                  • Instruction Fuzzy Hash: D3718374B44209CFDBAD5B39C59C53D36EB6F85E0071084A6C416CF3A4EE25CC868BAA
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037EE7 Relevance: 1.5, Strings: 1, Instructions: 225COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: ,bq
                                                                  • API String ID: 0-2474004448
                                                                  • Opcode ID: b07bcea88198df98e0745139cd0e8a928935d76d739dd1f121e19542af9032f3
                                                                  • Instruction ID: 7bd25ac37e38bb92b91acb9860808ad24759157e688b04362762ee6d6f996fcc
                                                                  • Opcode Fuzzy Hash: b07bcea88198df98e0745139cd0e8a928935d76d739dd1f121e19542af9032f3
                                                                  • Instruction Fuzzy Hash: EB713034B403058FCB9C9A39895C53A6AEF7FC5E5171484E5E516CF3B4EE21CC468B62
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B034DE8 Relevance: 1.5, Strings: 1, Instructions: 220COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: e6e99b8833b77eff54e535ec8efec3f265db26e63581c1b6e55ae413e590e0c7
                                                                  • Instruction ID: b5397f0853a603e58c7afa9e34a5b0dcbbcadd5d407daa28a0d7846573a23fba
                                                                  • Opcode Fuzzy Hash: e6e99b8833b77eff54e535ec8efec3f265db26e63581c1b6e55ae413e590e0c7
                                                                  • Instruction Fuzzy Hash: 93718035B102149FDB589F69C848B6E7BFAEF88B10F258069E506DB394DB31DD41CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E50D8 Relevance: 1.4, Strings: 1, Instructions: 187COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: 4c^q
                                                                  • API String ID: 0-396817635
                                                                  • Opcode ID: 1888e2190c91c78585ea70f528eef28c95c807cbf5e066459362aed5bc01a3d4
                                                                  • Instruction ID: 2e9ff53d1dcde6ca4667a084f84efa7816272a800e881b94d9860a17379cbb16
                                                                  • Opcode Fuzzy Hash: 1888e2190c91c78585ea70f528eef28c95c807cbf5e066459362aed5bc01a3d4
                                                                  • Instruction Fuzzy Hash: 4D618F31A002159FDF44DFA4C880BAAB7B6FF88314F148669D809DB295DB72DD45CBE0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03C6C0 Relevance: 1.4, Strings: 1, Instructions: 187COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: L<>p
                                                                  • API String ID: 0-3426176556
                                                                  • Opcode ID: bf012bd532fe72792b841257ee692aeca1b9fe839eadb1c70a4e81433dbbc2dc
                                                                  • Instruction ID: 039cdcc04913840d7301615f9baa6595bf8c138a940f241717bee97da2af2554
                                                                  • Opcode Fuzzy Hash: bf012bd532fe72792b841257ee692aeca1b9fe839eadb1c70a4e81433dbbc2dc
                                                                  • Instruction Fuzzy Hash: 1C619231B002059FDB29EB65D5986AEB7FBEF88A40F208029E416E7394DF749C05CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E6C79 Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $^q
                                                                  • API String ID: 0-388095546
                                                                  • Opcode ID: 32f1217ab58f1b4f91a9d5851becf4fa1f1ed68d7cd03e7a9dd1fb48593a5e0d
                                                                  • Instruction ID: d4bc444cba7eaa91958594cf243c3a31665a7be4dbbcdefe9c5bad06ee8b3a1c
                                                                  • Opcode Fuzzy Hash: 32f1217ab58f1b4f91a9d5851becf4fa1f1ed68d7cd03e7a9dd1fb48593a5e0d
                                                                  • Instruction Fuzzy Hash: 0E41F179F00525DFDB908E68D9416AAB7A6FF9A700F10842AD902DB784D730DC56CBF1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038E98 Relevance: 1.4, Strings: 1, Instructions: 142COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 7265c355fcf5189d4111aa2f69716c968a20a705081f4192c57d260a9d2df92a
                                                                  • Instruction ID: dc80263b1f8bc4155d73888897974ee9a46896a21df2ebd0b58cf8805acdb1b5
                                                                  • Opcode Fuzzy Hash: 7265c355fcf5189d4111aa2f69716c968a20a705081f4192c57d260a9d2df92a
                                                                  • Instruction Fuzzy Hash: 7941D531B001149FDB18EE78D8586AE7BEAEF85750F1440BAE50ACB390DE35DD05C791
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B039D30 Relevance: 1.4, Strings: 1, Instructions: 140COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 2f34b7ab5f7a40eed89824681fd9129abd2c34ea44e57670be1553fcb5e931e6
                                                                  • Instruction ID: 0680ba7955022367691ce58290bac6b362bd21e82fa04fbb7aa9a04c0ecacbb9
                                                                  • Opcode Fuzzy Hash: 2f34b7ab5f7a40eed89824681fd9129abd2c34ea44e57670be1553fcb5e931e6
                                                                  • Instruction Fuzzy Hash: 7D51E3357047408FC729DB39D458A66FBEBEF85700B088A69D48B8B766DA70EC45CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0327E0 Relevance: 1.4, Strings: 1, Instructions: 128COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 6d682830866050f6d8913febccb95d0ff8f1d37966c7cb79b3c7132bd191d346
                                                                  • Instruction ID: 705ee8794dc77e6ea4b0d027abc7c2d7ae7ecbe5c6d890c97bc96f53690dd635
                                                                  • Opcode Fuzzy Hash: 6d682830866050f6d8913febccb95d0ff8f1d37966c7cb79b3c7132bd191d346
                                                                  • Instruction Fuzzy Hash: 2A41F030B00249DFCB159B38E454ADABFE6EB89710F148566D401DB365DE39EC49CBD1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E44BF Relevance: 1.4, Strings: 1, Instructions: 117COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 98dc6944410a1f4053926cc1d84a25515f6f81875711cda19966f6645e40bee1
                                                                  • Instruction ID: 5baf617ae620eb8cde0040e6d0cafb6a1ebff4c604b403a040d078659c753582
                                                                  • Opcode Fuzzy Hash: 98dc6944410a1f4053926cc1d84a25515f6f81875711cda19966f6645e40bee1
                                                                  • Instruction Fuzzy Hash: 5C417B35A006158FCB54CF59C48496AB7F6FF8D310B25C969D45AEB392DB30E841CFA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03CAE7 Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: ,bq
                                                                  • API String ID: 0-2474004448
                                                                  • Opcode ID: b59ff056d91d74af06d7ba838f6475bcdfedd082979396cf3c9188e85d626d52
                                                                  • Instruction ID: c1a6a3eb8f4ffdc4b5e82e163dc639294db12aa5fb3fe5c23966bf66513b3b95
                                                                  • Opcode Fuzzy Hash: b59ff056d91d74af06d7ba838f6475bcdfedd082979396cf3c9188e85d626d52
                                                                  • Instruction Fuzzy Hash: 1E4160347002058FD728DF69D98896EB7FAFF88754B218068D50AEB365DB31EC41CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037D87 Relevance: 1.3, Strings: 1, Instructions: 84COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: 6531bf3434ddefd82b8dba720be5667d3c052ec46f1bfd8b8e01da64f5fe4798
                                                                  • Instruction ID: fd990f0e65449698fc7ea4e7fe642e2650077cf8cd6fd22b27ceffaab8581e73
                                                                  • Opcode Fuzzy Hash: 6531bf3434ddefd82b8dba720be5667d3c052ec46f1bfd8b8e01da64f5fe4798
                                                                  • Instruction Fuzzy Hash: AE213771304242AFC715AB3CE8449AA7BEAEFCA350B14407AE189CB395DE35DC478791
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E0006 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $^q
                                                                  • API String ID: 0-388095546
                                                                  • Opcode ID: 9bac923f8d2385478dd0a3828e4b7143b07712a8a540a6bd198b5f89f56b789b
                                                                  • Instruction ID: 6863a061d201e145cb4cc27d69f92de52910b1420f856de2649f4bedc6760b9a
                                                                  • Opcode Fuzzy Hash: 9bac923f8d2385478dd0a3828e4b7143b07712a8a540a6bd198b5f89f56b789b
                                                                  • Instruction Fuzzy Hash: DD215E346193688FE76E5F64D8647663BBA9F42304F04405ED0828BA96CBB54D19CBF2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038780 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: \;^q
                                                                  • API String ID: 0-2342212615
                                                                  • Opcode ID: 536410ac4fd58bcdb0be6174bdca5685bad955252c3214483cbb88d9166285b9
                                                                  • Instruction ID: 4f460cd446f47971ad83c738960578037cef001f4e9aff25fa9ba5c0a48f8020
                                                                  • Opcode Fuzzy Hash: 536410ac4fd58bcdb0be6174bdca5685bad955252c3214483cbb88d9166285b9
                                                                  • Instruction Fuzzy Hash: EA1160327042015F9B589A7EA88896BE7DFEBC4664714C47BE50EC7758EE71EC024790
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E8040 Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: 4'^q
                                                                  • API String ID: 0-1614139903
                                                                  • Opcode ID: a678f7ae19992e50b836f52c879429852ce62dd26e0ddd2a2057974ff7dfdfc2
                                                                  • Instruction ID: d26c64ce17b4051414ee6ea6b7796a7c7e0259d0d24710a51baeace84dd403aa
                                                                  • Opcode Fuzzy Hash: a678f7ae19992e50b836f52c879429852ce62dd26e0ddd2a2057974ff7dfdfc2
                                                                  • Instruction Fuzzy Hash: 3521C034B412189FC748DB7CC854A6F7BEABF89210B1408A9E145DB3B5CE31DC4187A1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033420 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: bdeac3fdcddbca05983a923f70ae701cd8bf4fba09ac3b20f2d7db44cedc60b8
                                                                  • Instruction ID: 3d067219cf74fe71ae4e5659482bc9deb07cb2fe6f6ddae936a4dd7b322558d0
                                                                  • Opcode Fuzzy Hash: bdeac3fdcddbca05983a923f70ae701cd8bf4fba09ac3b20f2d7db44cedc60b8
                                                                  • Instruction Fuzzy Hash: C4110171301205AFC714AB6DE448A2E7BDFEFCA710B144079E549CB355CE71EC068BA5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E7858 Relevance: 1.3, Strings: 1, Instructions: 66COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: 4'^q
                                                                  • API String ID: 0-1614139903
                                                                  • Opcode ID: 5d4887ef21193ee5b890067226b482214c82ca784df732549c2924e6384c2ab9
                                                                  • Instruction ID: 1fcd35b189cc3a0418f16a2c6e6add4dfd69060e8d56e1a4508bd703266e2a98
                                                                  • Opcode Fuzzy Hash: 5d4887ef21193ee5b890067226b482214c82ca784df732549c2924e6384c2ab9
                                                                  • Instruction Fuzzy Hash: 3F01B533B192240F675896A97C454AFA3EEEBD46B1710443BE605C3280EA32D805C2F4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E8050 Relevance: 1.3, Strings: 1, Instructions: 66COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: 4'^q
                                                                  • API String ID: 0-1614139903
                                                                  • Opcode ID: 306b6fe2a812b558f833a61497cc58a02d52a0fb09d8c596bbd905b37ad371a0
                                                                  • Instruction ID: b2d1e39685657e3687dbf4450e39df9bdc27e030da362317f7e69926e5ca73a4
                                                                  • Opcode Fuzzy Hash: 306b6fe2a812b558f833a61497cc58a02d52a0fb09d8c596bbd905b37ad371a0
                                                                  • Instruction Fuzzy Hash: 4E115E35B401199FCB48DB7DC894A6E77EABFCD610B104869E10ADB3B5DE31DC418BA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031120 Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: `Q^q
                                                                  • API String ID: 0-1948671464
                                                                  • Opcode ID: aefe721bb24a50076342831af434a74a5eebd1fd44f0b2f05b5ba516e0827541
                                                                  • Instruction ID: 7b1bc4caf9d8af54c3212f958bf51db74414540e029a9ed44a1139ae9bff5f54
                                                                  • Opcode Fuzzy Hash: aefe721bb24a50076342831af434a74a5eebd1fd44f0b2f05b5ba516e0827541
                                                                  • Instruction Fuzzy Hash: C801D436B402215FD71A92756815BFB679ADBC9E90F05816AE845EB391ED64CC0203E1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031130 Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: `Q^q
                                                                  • API String ID: 0-1948671464
                                                                  • Opcode ID: e769cc8a3fc1381681c3ed44d34f693108b1455af6d231fe0fa4ce67788f2d17
                                                                  • Instruction ID: 2eeaabb41bb2bb013110ad0043addcc5f0cc454a4bba7a8f444192c8bd9c3466
                                                                  • Opcode Fuzzy Hash: e769cc8a3fc1381681c3ed44d34f693108b1455af6d231fe0fa4ce67788f2d17
                                                                  • Instruction Fuzzy Hash: 8D01B135B402156BE75A9625AC19B7F62DFDBC8F90F10802DE80ADB394ED64DC0203D1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0341B8 Relevance: 1.3, Strings: 1, Instructions: 49COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: da0c05f14e7e7cf306cadf8cbef9532bad4019daec76f3e214368e3aba8313ba
                                                                  • Instruction ID: 8f66cc6a8dbb67cf7258842c68ff765bcfbe24cf293ca7dfe5847b0a953a2b5e
                                                                  • Opcode Fuzzy Hash: da0c05f14e7e7cf306cadf8cbef9532bad4019daec76f3e214368e3aba8313ba
                                                                  • Instruction Fuzzy Hash: A701D1B53002019FCB08AB7DD894A6E77EBEFC96107648479E40ADB758DE35EC068791
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035030 Relevance: 1.3, Strings: 1, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq
                                                                  • API String ID: 0-149360118
                                                                  • Opcode ID: fa75ff853267c046e731c44d4a976287caa44752973c594b41121e0d38b139ee
                                                                  • Instruction ID: 83f29cf4fd3997805b80b0dc2b5a1d571b89702fd0363290abf57fda7d2481a7
                                                                  • Opcode Fuzzy Hash: fa75ff853267c046e731c44d4a976287caa44752973c594b41121e0d38b139ee
                                                                  • Instruction Fuzzy Hash: 09017D62B092D08FD70A57789829119BFA7DFB355035840DEC8898F66ADD17DC03CB92
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035CD2 Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: 9
                                                                  • API String ID: 0-2366072709
                                                                  • Opcode ID: 5654f3578eaba340b8bb71960bbf6515287e6a4b5387488555f067fe05f5cda7
                                                                  • Instruction ID: 887e2d7f97c9a1bcf9f5210823b6eb0c345f883abf39463c67eb198c5b53f693
                                                                  • Opcode Fuzzy Hash: 5654f3578eaba340b8bb71960bbf6515287e6a4b5387488555f067fe05f5cda7
                                                                  • Instruction Fuzzy Hash: E8F096717242108FD75C9F34E88865D77E9EB45655F1504AED04ACB291DB35C840C751
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031031 Relevance: 1.3, Strings: 1, Instructions: 31COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: DjHl
                                                                  • API String ID: 0-215398142
                                                                  • Opcode ID: 0629f551f37555a56b2a83cadb68c262407851b9f26d82a78cd840b50efe4872
                                                                  • Instruction ID: 5ff90fbff288a7523d01528cf43feb1a489a4db97ee10152c37fce09c4f34d8c
                                                                  • Opcode Fuzzy Hash: 0629f551f37555a56b2a83cadb68c262407851b9f26d82a78cd840b50efe4872
                                                                  • Instruction Fuzzy Hash: C2E0E5353052910FC30243AC5519AA6BBD6CFC7551B0A44BBD504CF7A6CD25CC0143A2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031040 Relevance: 1.3, Strings: 1, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: DjHl
                                                                  • API String ID: 0-215398142
                                                                  • Opcode ID: da6b7f84d7c9abb6324f0066c80b2b6a17304b66da6245eea8d32568c79f0b92
                                                                  • Instruction ID: f26e6afc491849509df0a7b61496c8884420a1c76074cccc11feecabf7007d19
                                                                  • Opcode Fuzzy Hash: da6b7f84d7c9abb6324f0066c80b2b6a17304b66da6245eea8d32568c79f0b92
                                                                  • Instruction Fuzzy Hash: C8E086353000114FC204535D9419D6AB7DFDBCAA60B16407AD605CB765DD62DC0043A6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03FA80 Relevance: .3, Instructions: 326COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fb1f474fb3baa004a478b138eb00af79c30000b83d9245a443cf6ab90201de96
                                                                  • Instruction ID: 26ec11e8d7b10db64f5c9a527c8eec9576a44a4bf3efeb125f1ce52629ce6a7a
                                                                  • Opcode Fuzzy Hash: fb1f474fb3baa004a478b138eb00af79c30000b83d9245a443cf6ab90201de96
                                                                  • Instruction Fuzzy Hash: C3B14D31B146128FDB6C9B28C49C72E77EBEB84F05F14841AE953C7685CBB9DC818B91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470860 Relevance: .3, Instructions: 281COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 705df3277d5e83c35afbce9c1f04087e0117fab9ccaa8cafa44e347e9fffa22e
                                                                  • Instruction ID: ab96607d13a83c36c067da62facd1ad3a072e0fca36117badf3d439d460960d4
                                                                  • Opcode Fuzzy Hash: 705df3277d5e83c35afbce9c1f04087e0117fab9ccaa8cafa44e347e9fffa22e
                                                                  • Instruction Fuzzy Hash: 4CB16E30A012499FCB14DF68C488AADBBF2FF88314F2585AAD445AF391DB35EC41CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E59D0 Relevance: .3, Instructions: 279COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 34af704ff434faf442fc14bbccbbfb01b5b640dcd0d597c70fe68005360864ab
                                                                  • Instruction ID: 77345e1017afe989f3dee7ebbbf5a901a1e8e315b6b25f6c4abd5180016db6bb
                                                                  • Opcode Fuzzy Hash: 34af704ff434faf442fc14bbccbbfb01b5b640dcd0d597c70fe68005360864ab
                                                                  • Instruction Fuzzy Hash: B2C16C36E102598FCF11CFA4C840ADDFB72FF88320F248656D915BB294EB71A956CB81
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0396F0 Relevance: .3, Instructions: 266COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 9de353242a0a91765bcbb0b180dbabd1408f37daff20417adbc6da3bc40b6c6a
                                                                  • Instruction ID: cc601a692fcb7c5dc8b226e69bd8b198ad25d8c19de5ba58c7884e182d93a2cc
                                                                  • Opcode Fuzzy Hash: 9de353242a0a91765bcbb0b180dbabd1408f37daff20417adbc6da3bc40b6c6a
                                                                  • Instruction Fuzzy Hash: 7EB18734B006018FCB19DF29D99896ABBF6FF89700B008569D95A8B365DB71EC06CF91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470CD0 Relevance: .3, Instructions: 263COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3e007570726601fc23fa02b45018977c10ab5248131a1c4ac79d3398a095028c
                                                                  • Instruction ID: b425df74b6fd40db5b04daca8cbffc6263eb6e01f325824d0b41f93ae01e056e
                                                                  • Opcode Fuzzy Hash: 3e007570726601fc23fa02b45018977c10ab5248131a1c4ac79d3398a095028c
                                                                  • Instruction Fuzzy Hash: EDA1B331F40706ABDB20DB64CC51B9EB7B2EF95710F148616E6497F2C0EBB0A985C785
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A620 Relevance: .2, Instructions: 246COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b7eea31c489b3960376e0d3a7a81bec8d764820baf5ebe68100517ff33cadc3e
                                                                  • Instruction ID: 73a742d5cdb592a037e376704a359bfb027c1fd00117208296741601ab3b28ca
                                                                  • Opcode Fuzzy Hash: b7eea31c489b3960376e0d3a7a81bec8d764820baf5ebe68100517ff33cadc3e
                                                                  • Instruction Fuzzy Hash: 97918C31A002058FCB11CF68C98499EBBF6EF88310B19856AE855AF354EB74ED46CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477B88 Relevance: .2, Instructions: 233COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0301f7e60d5a4179fd1afcee27840cff335df60b251aa7ac0e9ed2dbeb31d46c
                                                                  • Instruction ID: 8297fc866c567c6bdacdacaf324b0c52d7b8c91339242c7fc0cbdf8299b5a65f
                                                                  • Opcode Fuzzy Hash: 0301f7e60d5a4179fd1afcee27840cff335df60b251aa7ac0e9ed2dbeb31d46c
                                                                  • Instruction Fuzzy Hash: C4917D357002049FCB05DF68D5849AEBBF6FF88310B5684AAE909DB362DB31EC41CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034769B0 Relevance: .2, Instructions: 219COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fb924655ececf1186b7c8f1f4066ef9032c8454c9b521959813d273cbdf6bd36
                                                                  • Instruction ID: 7a38707a37e94a962da0b06141170d9c47ce5c5f49103d953c325e04510824d1
                                                                  • Opcode Fuzzy Hash: fb924655ececf1186b7c8f1f4066ef9032c8454c9b521959813d273cbdf6bd36
                                                                  • Instruction Fuzzy Hash: FA81BD30A007099FDB14DF64D4556EEBBB6FF89300F15446AE406AB381DB79AC42CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03EE68 Relevance: .2, Instructions: 211COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 978e9d325bc36e52a981bebad4a698c4bab87afec3e71dd8a79f86d6b58b7d88
                                                                  • Instruction ID: 859fe2de0544363c593eec3130936b22b4721afed9eea0ac79b3da37e263ef69
                                                                  • Opcode Fuzzy Hash: 978e9d325bc36e52a981bebad4a698c4bab87afec3e71dd8a79f86d6b58b7d88
                                                                  • Instruction Fuzzy Hash: A571D4307042069FCB28DF29D984A6BFBFAFF85700B14866AD445CB355DB31E846CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0396D0 Relevance: .2, Instructions: 197COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fa8df078f459f0ba531b22bbfe976506d13de23d80a84cc9bedaf37fde21b3b6
                                                                  • Instruction ID: d20fdae07688d256f6c2ddf25e4ef56c193501db8d159da0ac7b3d856e8d897f
                                                                  • Opcode Fuzzy Hash: fa8df078f459f0ba531b22bbfe976506d13de23d80a84cc9bedaf37fde21b3b6
                                                                  • Instruction Fuzzy Hash: C8719A34A006018FCB09DF38D5985AEBBF6FF89200B048569D55A8B369DB70EC46CFA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035AD8 Relevance: .2, Instructions: 183COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4504616b0376112986f8ed757e90e9149996f45c023106383139cc5b12e7422f
                                                                  • Instruction ID: 2f0044404e411bb8bc9878eb871c2ed74d6a379639d10d58895edc1baedfd7e9
                                                                  • Opcode Fuzzy Hash: 4504616b0376112986f8ed757e90e9149996f45c023106383139cc5b12e7422f
                                                                  • Instruction Fuzzy Hash: B45129347201018FDB58DF29C89892A77FBAFA9A5572884A9E006CF3B5DB75DC42CB50
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E7481 Relevance: .2, Instructions: 179COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6247ac44ac6415e6cacd3464e4e7dba01b9c98f896133b4cb7d2aab2a5a2107a
                                                                  • Instruction ID: 9586ebebf01ec65ef0fcefc6668cadff75175e381ad3faaf46d7eda29b1210f1
                                                                  • Opcode Fuzzy Hash: 6247ac44ac6415e6cacd3464e4e7dba01b9c98f896133b4cb7d2aab2a5a2107a
                                                                  • Instruction Fuzzy Hash: 5E5191307047218FE7A88B2CC49476A77F6EB85749F14881AD4478BAD1D7B8D886CBE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033E40 Relevance: .2, Instructions: 174COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 9e53e97b110df22f05737318ab1b9293ad0894654c09d83194066cc92e115ee4
                                                                  • Instruction ID: fe7fc8802415e7c0cd0a5769f5b21b4644b0097204546be797a6f5aec5297fd6
                                                                  • Opcode Fuzzy Hash: 9e53e97b110df22f05737318ab1b9293ad0894654c09d83194066cc92e115ee4
                                                                  • Instruction Fuzzy Hash: B1616E74900249EFDB05EFA4E9546AEBFB7FF89300F004469D106A73A5CA355C49CFA2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473DCB Relevance: .2, Instructions: 169COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 41bb72b5254b7ea331c4b6e7c1c90f41e9d8206592664d1d58259186655d52ce
                                                                  • Instruction ID: 57e9a0437bc4c6fb5b3dc03c740988044a6269f4e9cae0e7c6bdc0923cf9c374
                                                                  • Opcode Fuzzy Hash: 41bb72b5254b7ea331c4b6e7c1c90f41e9d8206592664d1d58259186655d52ce
                                                                  • Instruction Fuzzy Hash: 3251A039B003049FDB14DF28D8947BAB7BAEB88340F14846BE8168F394DA35DC46DB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E6810 Relevance: .2, Instructions: 168COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: cd15ca126981bf7dee2be85af9b4e2a081ae97f03fb4f5b6ce37e3caf7d44d5b
                                                                  • Instruction ID: 761eb920656429724956efb48ed0b98489e6ff2c16af9930fbd6e0c893e35b40
                                                                  • Opcode Fuzzy Hash: cd15ca126981bf7dee2be85af9b4e2a081ae97f03fb4f5b6ce37e3caf7d44d5b
                                                                  • Instruction Fuzzy Hash: C8518D71A001199FCB54CFA5D984AAFBBFAFF89300F10802AE919D7290D731E955CBB0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E5F18 Relevance: .2, Instructions: 166COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 271b462c3b364b557429eadbdd6e4b19260457e60792dff595d66e20def75ccd
                                                                  • Instruction ID: 34cc48794dbd0ae4083b3fba7cbf4d5d699e7b09fb586495bd53bfdddff58e20
                                                                  • Opcode Fuzzy Hash: 271b462c3b364b557429eadbdd6e4b19260457e60792dff595d66e20def75ccd
                                                                  • Instruction Fuzzy Hash: 3951D6356056318FCB60CB25C88096AB7E6EFC2338B15C95AD055872C5DB36F89BC7E0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471471 Relevance: .2, Instructions: 163COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 140063e60b1afa9ca00e0d5a74e9bb70992b7f805a2e7ff61302da80100269b9
                                                                  • Instruction ID: 2c479185b6abab33846ab2a7ad4f12d6a30b68bcd2a10036d5da55b56c05160c
                                                                  • Opcode Fuzzy Hash: 140063e60b1afa9ca00e0d5a74e9bb70992b7f805a2e7ff61302da80100269b9
                                                                  • Instruction Fuzzy Hash: 8A514070E002099FDB14DFA9D990AEEBBF6EF88704F18406AD005E7364EB359D41CB54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E4C0A Relevance: .2, Instructions: 160COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8b560378706fe3eba0d620f6920e08a20a7a50cfc9c32ad3b602713c5ba0e85a
                                                                  • Instruction ID: 7f6396732f37e03d747db880e7e58cbd55fa7c80c126d709666949354547184f
                                                                  • Opcode Fuzzy Hash: 8b560378706fe3eba0d620f6920e08a20a7a50cfc9c32ad3b602713c5ba0e85a
                                                                  • Instruction Fuzzy Hash: DB517334B10620CFDB549B28D48462EB3F6FB88705F108819D957877C2CB79EC468BE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03F863 Relevance: .1, Instructions: 147COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5b32eba20d0696b051e098ea810f93d582293b621e002f53ef11cfb81bf9e933
                                                                  • Instruction ID: 332cf7f312838f6c7d4b44d20b10838a7a97a75da0f1dd7596f2fdd495845d5d
                                                                  • Opcode Fuzzy Hash: 5b32eba20d0696b051e098ea810f93d582293b621e002f53ef11cfb81bf9e933
                                                                  • Instruction Fuzzy Hash: B1519270F14202AFDB189B24D4A876EBBFBEF85B00F108469D5428B395DB75EC81CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0348A0 Relevance: .1, Instructions: 147COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b8aa46c4b53e75591d15ebe7ee120bfd5b16db130be681084755bb97a4a63f57
                                                                  • Instruction ID: f6a9236e6e13e7d7267f9f8e5aeaff12ec1761a8129662d07d5ce9b2594087a5
                                                                  • Opcode Fuzzy Hash: b8aa46c4b53e75591d15ebe7ee120bfd5b16db130be681084755bb97a4a63f57
                                                                  • Instruction Fuzzy Hash: BA51C571A10218DFCB05EFA8D8949DEBBF9FF49310F10416AE541EB361EB309845CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E2620 Relevance: .1, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 68566bf4b3a6ac764d4396a25e7c871440bf08822132b0e0912fae2a7fcdad29
                                                                  • Instruction ID: 623e36e888a7adbd1435f73c313a3671bc6e46bb614b9aefb131e5ff998e4fc5
                                                                  • Opcode Fuzzy Hash: 68566bf4b3a6ac764d4396a25e7c871440bf08822132b0e0912fae2a7fcdad29
                                                                  • Instruction Fuzzy Hash: 2F51F531B042149FEB559F69C894A6BBBEAFF89310F144519E9468B3E1DB71EC01CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E5E81 Relevance: .1, Instructions: 143COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 991b2d906e48b634bd4d5ef3fa9312b39c27722041a710c7bb3f64f309eaf6a0
                                                                  • Instruction ID: 117784858205622773d0285093adfdf6375f9124e9c15c81efa53c3f0ca980f7
                                                                  • Opcode Fuzzy Hash: 991b2d906e48b634bd4d5ef3fa9312b39c27722041a710c7bb3f64f309eaf6a0
                                                                  • Instruction Fuzzy Hash: 434112317046618FC760CB29C84496ABBEAAFC1364718C96AE485C75D1DB35F98AC7F0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03DDE8 Relevance: .1, Instructions: 142COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 461c39e134aca28e88eeb0f338f5bb85ef3826aefa3e46f1d17d0455949bd098
                                                                  • Instruction ID: da171bb9e8e5bfc1f51438f18e0b1e06d00d59b0cd477465cb675cd6e71fdc95
                                                                  • Opcode Fuzzy Hash: 461c39e134aca28e88eeb0f338f5bb85ef3826aefa3e46f1d17d0455949bd098
                                                                  • Instruction Fuzzy Hash: 8941827AB001058FDB18DB69D584AAEF7FAEF88750B1181B5E909D7355DB31EC02CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E3000 Relevance: .1, Instructions: 138COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f19f7de9760cde2052ecf0fd788657672fee297e10443e23f7bee25b51ba33f2
                                                                  • Instruction ID: a97ccc821b6c17d0f9471660c9e7386c17ca698f99ccf0c9f1e7846fcee26489
                                                                  • Opcode Fuzzy Hash: f19f7de9760cde2052ecf0fd788657672fee297e10443e23f7bee25b51ba33f2
                                                                  • Instruction Fuzzy Hash: FE513174E10219DFEF25CFA5C884ADDBBB6FF88300F208559E911A7250D771A895CFA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033E90 Relevance: .1, Instructions: 136COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b5d173b0aacc2352804b14a0d9cb9718121871610d71f3f658879ed6750d7f89
                                                                  • Instruction ID: 9b668aca53f4245b6b11f1e433ac83f12f7a6166b80064494cd68fa933e06399
                                                                  • Opcode Fuzzy Hash: b5d173b0aacc2352804b14a0d9cb9718121871610d71f3f658879ed6750d7f89
                                                                  • Instruction Fuzzy Hash: 2551C774A00209EFDB04EBE4E9586AEBBB7FF88300F104428D516773A4CA365D45CFA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03472EB8 Relevance: .1, Instructions: 135COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: ed088458d8f056108bf9d2797b9cc6bd16409735c224477334dec9759e4d3c08
                                                                  • Instruction ID: 6682b108359e4b56a5ec8d9e555a2d059fad84508ab799f6d1fa222ee12184bd
                                                                  • Opcode Fuzzy Hash: ed088458d8f056108bf9d2797b9cc6bd16409735c224477334dec9759e4d3c08
                                                                  • Instruction Fuzzy Hash: B5419331B002159FCF05EB78C85866EBBE6EFC8300B108969E50ADB394EF759C468B95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347AA7A Relevance: .1, Instructions: 134COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 72150d27df4c7f2ccdcda1585657f362fb6309863bc6408f91596cc9dbd09e52
                                                                  • Instruction ID: e0f6ca89fa8897d8f4423b5cd7fbeaf2b700eeb846e55162a1befc010d11852b
                                                                  • Opcode Fuzzy Hash: 72150d27df4c7f2ccdcda1585657f362fb6309863bc6408f91596cc9dbd09e52
                                                                  • Instruction Fuzzy Hash: 51518031E00249CFDB15DFA8C4446DEBBB2BF89310F198256E811BB355DB74AD86CB84
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A5F2 Relevance: .1, Instructions: 133COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: acfe6452b9d87433ba63190a8334fa3928db04560d8523463f1361df5dbd7c71
                                                                  • Instruction ID: d817cc70b04b14d97f511ec7323506af5ed16ffeccd6a383b36db08561388eb9
                                                                  • Opcode Fuzzy Hash: acfe6452b9d87433ba63190a8334fa3928db04560d8523463f1361df5dbd7c71
                                                                  • Instruction Fuzzy Hash: E941E275B003058FDB15CB68C950A9EBBF6EF94310B1980AAD8469F365EB30ED07CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471D51 Relevance: .1, Instructions: 131COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c666a95fcff9bae59d4cd5928e0d626df6422f8305047788e04f6e1843744173
                                                                  • Instruction ID: afcdebfac9dd835a392ca4ff58cfe1df28a2a48fad2d3d5e82fb82853af1e0bf
                                                                  • Opcode Fuzzy Hash: c666a95fcff9bae59d4cd5928e0d626df6422f8305047788e04f6e1843744173
                                                                  • Instruction Fuzzy Hash: 6A510874A10219DFDB14CF65D598AAEBBF2FF48700F148069E416AB361DB30AC42CF94
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471F90 Relevance: .1, Instructions: 130COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 28fb7aeb5fa1840969f9bb3d901cff67c22bd0f78c0e1a02ab657ba9148e4180
                                                                  • Instruction ID: e42b22000c717141eb38cd6ff5dd0202a3cf316cacab73b2250609375d1045bb
                                                                  • Opcode Fuzzy Hash: 28fb7aeb5fa1840969f9bb3d901cff67c22bd0f78c0e1a02ab657ba9148e4180
                                                                  • Instruction Fuzzy Hash: AE415C71E002599BD710CBA8C484BDEF7F6FB88300F18C56AD515AB245DBB1D886CBA5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476D90 Relevance: .1, Instructions: 127COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0e03e5d43016b3dc5fcdc87d013b4839fa48a51d87fb125440851bbff9117200
                                                                  • Instruction ID: c1212c2869982d36880c122194acc3a6b8b12d088c3e71e42f4674a984693209
                                                                  • Opcode Fuzzy Hash: 0e03e5d43016b3dc5fcdc87d013b4839fa48a51d87fb125440851bbff9117200
                                                                  • Instruction Fuzzy Hash: 2B4123753043844FC346DB34C8246AFAFE7AFD5200B1584AAC449CB3A2DE39DD0ACBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347B188 Relevance: .1, Instructions: 125COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 033afcbd88ad7d650551e8782542be1223620016f90324e8691fd56496cd1c53
                                                                  • Instruction ID: 50dc6331a37996369625cc9a2af2ca79103af2c77177d781d7c2e30b95b582f2
                                                                  • Opcode Fuzzy Hash: 033afcbd88ad7d650551e8782542be1223620016f90324e8691fd56496cd1c53
                                                                  • Instruction Fuzzy Hash: FE417E30B003089FDB18DBB5D854AAEBBB7EF89314F144429E806AB344DF35AD41CBA5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471A44 Relevance: .1, Instructions: 120COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 17c2b1183866f3f5158f2a4914a1b410da8bad9cdf594b331ff51310e18b0af2
                                                                  • Instruction ID: f8d94c20ffbf2e92abdad15a79f0f7a41a34ed0f4242d526b1708e25c3494915
                                                                  • Opcode Fuzzy Hash: 17c2b1183866f3f5158f2a4914a1b410da8bad9cdf594b331ff51310e18b0af2
                                                                  • Instruction Fuzzy Hash: 2D4124B0D10258DFCB10CFA9D885BDEFBF5AF48710F14812AE859AB250E7749846CF94
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477BC8 Relevance: .1, Instructions: 118COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 847a54107875634be4c39c46302fff5efffd83255dc8330c8288ea319fca0da3
                                                                  • Instruction ID: d87603f72b7f86112e77b46e9b30be33f41c374555b1f2525a47a0ce6c27ddb9
                                                                  • Opcode Fuzzy Hash: 847a54107875634be4c39c46302fff5efffd83255dc8330c8288ea319fca0da3
                                                                  • Instruction Fuzzy Hash: F2410935600204DFCB05CF68D5849AABBF6EF88711F5680AAE9059F362DB31ED42CB55
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471A50 Relevance: .1, Instructions: 117COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f1b02bdfcec1b93c9bcdaf8a3c2491b2e7146b704f4bf5987fecbf9ae825862e
                                                                  • Instruction ID: e70d805c110bd350eabe7fb32d66deca424b3a3fa2720e380d2c2bc97b1c1bcc
                                                                  • Opcode Fuzzy Hash: f1b02bdfcec1b93c9bcdaf8a3c2491b2e7146b704f4bf5987fecbf9ae825862e
                                                                  • Instruction Fuzzy Hash: 3F4127B0D102589FCB10CFAAD985BDEFBF5AF48710F14852AE859AB344E7749845CF84
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E1198 Relevance: .1, Instructions: 111COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 46bff1d484013b4980e5109bf2eaee84475bd929b05bf49354647d95a9eb5ab0
                                                                  • Instruction ID: 3115db81c9bb5712fa8076e30df683a8b8b4d6349f39f10411807a589e1f308c
                                                                  • Opcode Fuzzy Hash: 46bff1d484013b4980e5109bf2eaee84475bd929b05bf49354647d95a9eb5ab0
                                                                  • Instruction Fuzzy Hash: BF31C1307187208FE7788A98D88477AF3F5EB56705F10892AD947C6AC1C7B5E8858BE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03B070 Relevance: .1, Instructions: 111COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 7c6987413e601d2719ac033926e0d0b6dbf23050f76a93937171b6c86dcfd962
                                                                  • Instruction ID: 4f1a3b4eb03c0a40b8a8e0bff7608dd3387fe8f3a137942c176fe82d22dff193
                                                                  • Opcode Fuzzy Hash: 7c6987413e601d2719ac033926e0d0b6dbf23050f76a93937171b6c86dcfd962
                                                                  • Instruction Fuzzy Hash: 8B41B4319006099FCB64DB54D849BEEB7FAEF80305F44452DD116972A8CB74A989CFE2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03479690 Relevance: .1, Instructions: 109COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 08e182439426ef6db18d3df0d3bdeccb50866516a8213ac800f1678bd51ef881
                                                                  • Instruction ID: 1fa3b5f4215e193ad27ed027b39dd0f74d1555eeda158e79c9cc18b4841f1278
                                                                  • Opcode Fuzzy Hash: 08e182439426ef6db18d3df0d3bdeccb50866516a8213ac800f1678bd51ef881
                                                                  • Instruction Fuzzy Hash: 3631E374B002419FCB15DB38D8549AFBBF6EF8A200B044569E40ACB391EF38ED05CB92
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0388F8 Relevance: .1, Instructions: 109COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3ee7d8fae686041944d0ca0dd9a54832a1586145e7303fbed40f814c7b8f74c6
                                                                  • Instruction ID: df766fc4879bfee13fd39ba03d3d6230f10e476fb538d4ec03a19f7e1fe7b863
                                                                  • Opcode Fuzzy Hash: 3ee7d8fae686041944d0ca0dd9a54832a1586145e7303fbed40f814c7b8f74c6
                                                                  • Instruction Fuzzy Hash: 1431C536B002059FCB04CB69D894AAAFBEAFF84610B18C1A7E508D7755DB71E8018BA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03D3B0 Relevance: .1, Instructions: 107COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a5b89dbbd9f43ebd5bac53e15458cce9e13f1adaa6fafa310980fa1278dc97ad
                                                                  • Instruction ID: 5f6eb667fd89d7a51cca68dffb58b04d32f8d04bdb2dfc6b18c9bc073ac5740d
                                                                  • Opcode Fuzzy Hash: a5b89dbbd9f43ebd5bac53e15458cce9e13f1adaa6fafa310980fa1278dc97ad
                                                                  • Instruction Fuzzy Hash: 7241AD707002558FCB54DF69D888A6EBBFBEF89200B048569E546CB365DB31ED06CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03474DA8 Relevance: .1, Instructions: 105COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 85b2ee9b408019e1eb7b24b42288f9a4fe3bc89b23043e38922c04279891735a
                                                                  • Instruction ID: 93118d60eb2784e5bafee33b77ffbed6dffb3227d96a21554f038fcc0c417d7d
                                                                  • Opcode Fuzzy Hash: 85b2ee9b408019e1eb7b24b42288f9a4fe3bc89b23043e38922c04279891735a
                                                                  • Instruction Fuzzy Hash: 1541707470020A9FCF15AB74E5995AEBFB3FF85301B448429E516AB344DF385D06CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034772F8 Relevance: .1, Instructions: 104COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: db6b9feec5ce0d007a99155e82446adf8e1f4fae7a3d61f9d92e9497ca16a6da
                                                                  • Instruction ID: 4b40debc7eca9f1b60c6427c6c18b1ce15959d180a426cae71a61d1c691b9b65
                                                                  • Opcode Fuzzy Hash: db6b9feec5ce0d007a99155e82446adf8e1f4fae7a3d61f9d92e9497ca16a6da
                                                                  • Instruction Fuzzy Hash: BC4104B53002108FC748DF3AC998A6DBBB5FF8961579145A9E41ADB372CB30DD05CB50
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473FC8 Relevance: .1, Instructions: 104COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 63afedbf64fa8f244a6989b1875baaf1545ad8791ac2111ac07e5ae0ac929d6c
                                                                  • Instruction ID: 21b6c625707721253c1a2ceb55f23bd427606349c81e54d944d751fe80863722
                                                                  • Opcode Fuzzy Hash: 63afedbf64fa8f244a6989b1875baaf1545ad8791ac2111ac07e5ae0ac929d6c
                                                                  • Instruction Fuzzy Hash: 36417134A002598FDB18DF6AD4947FEBBF6AF88314F18402AE415EB3A0DB709C41CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475AF8 Relevance: .1, Instructions: 103COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 23f19d60f0a583a3f7e6c9361cc0b219084111c137922406d8c938a0d1c7db01
                                                                  • Instruction ID: acc40f918b7a7fcbf1ebabf679c8e09a286889d779a0f8950d2a359485419f35
                                                                  • Opcode Fuzzy Hash: 23f19d60f0a583a3f7e6c9361cc0b219084111c137922406d8c938a0d1c7db01
                                                                  • Instruction Fuzzy Hash: 7D419E70A007498FDB21CF68C9446DEBBF2BF89300F18469AD496AB795C734A845CB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03D3C0 Relevance: .1, Instructions: 103COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2689261c25062431fd87d32f3fce2bcc66b7fa7dc2362bef0c46ccfce2d9cda3
                                                                  • Instruction ID: a7b84a8c467e739b847d29fef59db6d862c232bdd88f157bac83ab858d021c46
                                                                  • Opcode Fuzzy Hash: 2689261c25062431fd87d32f3fce2bcc66b7fa7dc2362bef0c46ccfce2d9cda3
                                                                  • Instruction Fuzzy Hash: 3F41CE707002558FCB54DB69C888A6EBBFBEF89300F044569E646C7365DB71E805CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034769A0 Relevance: .1, Instructions: 102COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 46a523fd45248184ca564ea609750e2df197672fef67ade0c2d42281e7b1758a
                                                                  • Instruction ID: 57643ed6eca37997c0a9fd437a226817f67773d3c8669d19ab649c2368b7a2f1
                                                                  • Opcode Fuzzy Hash: 46a523fd45248184ca564ea609750e2df197672fef67ade0c2d42281e7b1758a
                                                                  • Instruction Fuzzy Hash: 8E310F307006448FDB04DF34E4596AEBBEBEB88710F518969E4069B381DF38EC42CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03C15A Relevance: .1, Instructions: 98COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8e086852381130bc1d40b346c6864cde0f2244f5b3b0498358502baef994d2e5
                                                                  • Instruction ID: 494474367f0ef55c7e53315fe4c643aaeb4f171a6e3fe6e0fa767557b04801db
                                                                  • Opcode Fuzzy Hash: 8e086852381130bc1d40b346c6864cde0f2244f5b3b0498358502baef994d2e5
                                                                  • Instruction Fuzzy Hash: DC413B75E102099FCB18CFE9D58499EBBF6FF89700F248029E801EB354DB70A846CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03474DB8 Relevance: .1, Instructions: 96COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4142bd512c5645da6fc8c328c7c43ee6bad590f6573d5ccaa3a7aa289375d29b
                                                                  • Instruction ID: 2adaccb37974437a2b9f903c1b3322f703811be9dcd3173d4a75e2b88201f38d
                                                                  • Opcode Fuzzy Hash: 4142bd512c5645da6fc8c328c7c43ee6bad590f6573d5ccaa3a7aa289375d29b
                                                                  • Instruction Fuzzy Hash: B3313E7470020A9FCF18ABB4E59D5AEBBB7FF84301B444429E516A7344DF34AD068B95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E6E48 Relevance: .1, Instructions: 94COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d487facfc2f77ae0dac31248b11a1df10fb7879a1bea84d5c829b2172991ea3e
                                                                  • Instruction ID: 844323da6f5028f66b50e89d31b9c6c97862718287da5188e37d596b1e47bfb4
                                                                  • Opcode Fuzzy Hash: d487facfc2f77ae0dac31248b11a1df10fb7879a1bea84d5c829b2172991ea3e
                                                                  • Instruction Fuzzy Hash: 8A31F431A006259FCB50CB64DE426AABBB6FFA6320F14943AE545D72C1C330D905CBE0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475D68 Relevance: .1, Instructions: 93COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 9fb61bf1229dcd64d92b617404c918e7e61f0b78cc23b5d5c630edfbc685f31d
                                                                  • Instruction ID: ac85600172043533865589e9db5faa4875d33bcadee25334097cc6b1f1115812
                                                                  • Opcode Fuzzy Hash: 9fb61bf1229dcd64d92b617404c918e7e61f0b78cc23b5d5c630edfbc685f31d
                                                                  • Instruction Fuzzy Hash: EA317271A007058FCB25DF28C5806DAB7F1FF89210F248AAAD4999F3A5D731AD45CB94
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034771F0 Relevance: .1, Instructions: 92COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3d581f3d6aa048a8581a25ce591e1cd1a9d36002312ecc1c1aeb2a1495edebe8
                                                                  • Instruction ID: 30d17fe2c946eb05716b809ef4cf183f44c67c8ae14f6682f8c06352c807ac08
                                                                  • Opcode Fuzzy Hash: 3d581f3d6aa048a8581a25ce591e1cd1a9d36002312ecc1c1aeb2a1495edebe8
                                                                  • Instruction Fuzzy Hash: 5B310B762047845FC302DB38EC545DABFB2EF8621074545EAE449CF6A2DB249D0AC796
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A3D5 Relevance: .1, Instructions: 90COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: add4572282632cdd37a9d9a3707f359175e23dffcdd1674831d5b1fd312f1ac0
                                                                  • Instruction ID: 72e0d1df69f5c963a0af8fd7026243abd9ca10145aa5ecc29e7647742e0a23d3
                                                                  • Opcode Fuzzy Hash: add4572282632cdd37a9d9a3707f359175e23dffcdd1674831d5b1fd312f1ac0
                                                                  • Instruction Fuzzy Hash: 4D314132C0E7DA9FCB03DB68E8600CDBF71AE97214B0A05D3D490AB1A3E664555AC7A5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477080 Relevance: .1, Instructions: 89COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 13ce3a64198f5317e5633d960eac2ba133e0b3836705d0b97cfe735a818dd315
                                                                  • Instruction ID: f45b1647ab5ef27a01cecbb18ba8214f530f2aecce294e371f6e1530cad49aa7
                                                                  • Opcode Fuzzy Hash: 13ce3a64198f5317e5633d960eac2ba133e0b3836705d0b97cfe735a818dd315
                                                                  • Instruction Fuzzy Hash: 7A21F4327141145BCB062E69585507EBFE7FBCC260754806BFC66DB380CE398C169795
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E1148 Relevance: .1, Instructions: 89COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 1293c74a8a2bce0a08c9f4c37f7bcb329bee86c31afb97b070664f566b84d313
                                                                  • Instruction ID: 001d9e4f60456f34e85de5a3b6d9480307ca09082899d6d2a278d989b076f8c7
                                                                  • Opcode Fuzzy Hash: 1293c74a8a2bce0a08c9f4c37f7bcb329bee86c31afb97b070664f566b84d313
                                                                  • Instruction Fuzzy Hash: F731B130619761CFD7648B69C89097AB7F9FF16304B10899AD883C7B91C7B4E841CBE5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03AD48 Relevance: .1, Instructions: 88COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5458e40a205a8d42ee3b93c0d4f949c81068c63ee01a80028bb4a288b337b377
                                                                  • Instruction ID: afc5dbeb648de3b9039628d0ca18d2030a930305a8d7e3f8d93721b3248dceb8
                                                                  • Opcode Fuzzy Hash: 5458e40a205a8d42ee3b93c0d4f949c81068c63ee01a80028bb4a288b337b377
                                                                  • Instruction Fuzzy Hash: 2F31D175B401059FCB48DF68C094AAEBBF7EFC8310B108069E8469B364CB35EC42CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473FB7 Relevance: .1, Instructions: 83COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 61e780b46bac300eeb7dba1d7470b6fa860671ce1b50b24955d6c7567545e39c
                                                                  • Instruction ID: 08496981398c7a14293c06b273726e0e39c3d1fb9a77312461b09777b3b50369
                                                                  • Opcode Fuzzy Hash: 61e780b46bac300eeb7dba1d7470b6fa860671ce1b50b24955d6c7567545e39c
                                                                  • Instruction Fuzzy Hash: 9F316434A002549FDB18DF69D494AEDBBF1BF88310F18806AE405EB360DB719C41CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470C98 Relevance: .1, Instructions: 83COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: bfd7037459b1949f17e3f5d1730aba45dc2cf4d9f8b14f2583d6834fa8ea8c67
                                                                  • Instruction ID: 6af2dead272cc4230c50c7ede0b790c62d66fb7ac1db569fd8077d8e0aa19cfa
                                                                  • Opcode Fuzzy Hash: bfd7037459b1949f17e3f5d1730aba45dc2cf4d9f8b14f2583d6834fa8ea8c67
                                                                  • Instruction Fuzzy Hash: C221D230A027059FCB25CB78C9446EEFBF1AF48214F1880ABD449DF252D730E886CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019EEE8C Relevance: .1, Instructions: 83COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3e014c317aff8393c2cd46b9d5e5bc4d1e28c30d0ced02872d10d3dda37189b3
                                                                  • Instruction ID: 771ad4e08f118232018777eaa0d800a6ada2feb7e931184e016d6ce2d7c85ac1
                                                                  • Opcode Fuzzy Hash: 3e014c317aff8393c2cd46b9d5e5bc4d1e28c30d0ced02872d10d3dda37189b3
                                                                  • Instruction Fuzzy Hash: 5631D572104240EFDF079F54D9C4F26BFA6FB88314F2489A9ED0D4A26AC336D455CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03AD58 Relevance: .1, Instructions: 83COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c3b9d908d5df37e0af713861aa291f4b5aeb37c40b683ebd392db49c001d456a
                                                                  • Instruction ID: 1acc8c045d4484cbf1a350d602bdabed7f9b1ed3e28ae5539d815f742ecf67e1
                                                                  • Opcode Fuzzy Hash: c3b9d908d5df37e0af713861aa291f4b5aeb37c40b683ebd392db49c001d456a
                                                                  • Instruction Fuzzy Hash: E7316F75B405059FCB58DF68C094A6EBBF6EFC8710B14806AE946DB364DB35EC02CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034789CD Relevance: .1, Instructions: 81COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 936d30e83f5c076ea86afc7bdf65f61f3970e9396d8c714ec731b9fcbf9c0d7f
                                                                  • Instruction ID: 2eefa742f1ac7739af44cb663c473e2783a36746f3f05f4000e8c7693e330e88
                                                                  • Opcode Fuzzy Hash: 936d30e83f5c076ea86afc7bdf65f61f3970e9396d8c714ec731b9fcbf9c0d7f
                                                                  • Instruction Fuzzy Hash: D931DD393046109FCF06DF68E854D9D7BB2FF88304B158055E5169B376EB39AE06CB89
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476F90 Relevance: .1, Instructions: 80COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b3b22fe22f4f726f084bc061dc35769830faa274625b54a16b926d9ab1a2180f
                                                                  • Instruction ID: 3ad969a94a993bf593c5125762178112aec1665d9211a0b0ad5fec7e6ad27a56
                                                                  • Opcode Fuzzy Hash: b3b22fe22f4f726f084bc061dc35769830faa274625b54a16b926d9ab1a2180f
                                                                  • Instruction Fuzzy Hash: 5E21D7353002008FC748DB38E45856E7BF6FF8966031444AAE40ACF365DF36DC0A8B51
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019EED90 Relevance: .1, Instructions: 80COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: ef1e622a46e4792a58a5b145668d97acc882bc1fe0a459cec80dfa2f73fde302
                                                                  • Instruction ID: 078e859ba2b2e4862b5a6acb5ffc8a78d783c1fdc599e02e809dea8e74a98f2b
                                                                  • Opcode Fuzzy Hash: ef1e622a46e4792a58a5b145668d97acc882bc1fe0a459cec80dfa2f73fde302
                                                                  • Instruction Fuzzy Hash: FB21D372500200EFCF079F58D9C8F26BFA6FB88314F2486ADE90D0A256C336E456CB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347C6B5 Relevance: .1, Instructions: 79COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c0ab952a2b1d1b0321f1707a99b1157650c1fc149c02750fddcceeb10f315ce3
                                                                  • Instruction ID: d578d192b0787aab7ac7e9395cc98d0e11f9c13799700ac9e6cc78dd9d4c74a7
                                                                  • Opcode Fuzzy Hash: c0ab952a2b1d1b0321f1707a99b1157650c1fc149c02750fddcceeb10f315ce3
                                                                  • Instruction Fuzzy Hash: 4F21EF4140E7E05FD703AB3C69B81DA7F759E5322470A01DBD4D0CF5A7E6088A6AC3AA
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347B409 Relevance: .1, Instructions: 79COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 88e85390f2eeab55107dca382695c4dacc7d141fcde625500e4d14cea0268eb0
                                                                  • Instruction ID: 5b437df1c438e0342f7b1d56f33ece7dcac4632e14e7b20acd61037349b2e5e5
                                                                  • Opcode Fuzzy Hash: 88e85390f2eeab55107dca382695c4dacc7d141fcde625500e4d14cea0268eb0
                                                                  • Instruction Fuzzy Hash: 2B318D34E01308EFDB05DFB4D554B9DBB76EB85300F1085A9D81067358EA3AAE85CB51
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD06C Relevance: .1, Instructions: 77COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6d737855df91803cd3e476a7fb6921c159d4431cd7381d1290f4d3eb8b963e2e
                                                                  • Instruction ID: cf0c7726b0e1fd7d9c31f725d56bc2d70f19dbce552e1321d532b4ad28e94243
                                                                  • Opcode Fuzzy Hash: 6d737855df91803cd3e476a7fb6921c159d4431cd7381d1290f4d3eb8b963e2e
                                                                  • Instruction Fuzzy Hash: 5221F771504248DFDB259FA4D9C4B16FFB5FB88314F2481A9E9090A296C33BD416CB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038A18 Relevance: .1, Instructions: 75COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4d7811b37d9cb65bef7333fc5f2017aaa17671a21f3b4aa6c4caec889d204119
                                                                  • Instruction ID: 893a25433707c5cfb3cc027de2ab7978e237a17a71c6ec1e2f25d2ce5d85150d
                                                                  • Opcode Fuzzy Hash: 4d7811b37d9cb65bef7333fc5f2017aaa17671a21f3b4aa6c4caec889d204119
                                                                  • Instruction Fuzzy Hash: 9E21C534B01309DFDB189B75D8486AA77BAFB84B05F10C5B5E9018B240DB76DC45CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A462 Relevance: .1, Instructions: 74COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 86d4ef5813d722469390435a348d350b6ffa8f85fb4dd07329d623194751ffb9
                                                                  • Instruction ID: b6e591fa2ec99b8c67a06c7ef033279cb4bd590325558222f64bd94508e6082a
                                                                  • Opcode Fuzzy Hash: 86d4ef5813d722469390435a348d350b6ffa8f85fb4dd07329d623194751ffb9
                                                                  • Instruction Fuzzy Hash: F721AA32C097996FCB02DFA8DC100DDBF75EE87310B194693E450BB161E674154AC7A1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347B418 Relevance: .1, Instructions: 74COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d853aebebd5d9773a37a76751846d82e4f57e01ad521a6254d2abd2db6368e4b
                                                                  • Instruction ID: 5207d6b40a44d479572972140561aba44f24d2b5bfdfc1b8a8189bd55d956b3a
                                                                  • Opcode Fuzzy Hash: d853aebebd5d9773a37a76751846d82e4f57e01ad521a6254d2abd2db6368e4b
                                                                  • Instruction Fuzzy Hash: B0314A34E01308EFDB05DFB4D554BADBB76EB89300F1085A9D81567398EB3AAE85CB40
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034789E7 Relevance: .1, Instructions: 74COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e1d2691f40464f52d0076a4d239402a3a5a6ce5fd4f733d9ed439180b1428c29
                                                                  • Instruction ID: 08b62e64d38ccec0c65f79ff04114780760f7006b627551e0279a00502ad4e89
                                                                  • Opcode Fuzzy Hash: e1d2691f40464f52d0076a4d239402a3a5a6ce5fd4f733d9ed439180b1428c29
                                                                  • Instruction Fuzzy Hash: FB21CC393042009FCF05DFA8E854D9E77B2FF88214B158054E6169B376EF39AD06CB85
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E8C97 Relevance: .1, Instructions: 74COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 7f7f8ff8fcf7469b9053d30f2203af0811fbdcf8947408a2a745e8705245f11c
                                                                  • Instruction ID: 86f5feb679309bd49a63d41289fcdfaccb9387dd9f94f8c39fc400a381092805
                                                                  • Opcode Fuzzy Hash: 7f7f8ff8fcf7469b9053d30f2203af0811fbdcf8947408a2a745e8705245f11c
                                                                  • Instruction Fuzzy Hash: 85214C79B001158FCB44DF69D888A6AB7F9FF89715B114069E506DB370DB30EC45CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470CC1 Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c4ddf2f7d615a0b45ef61b76e2b171ae79324f88c2cdfd57c4a59b3a6608cc80
                                                                  • Instruction ID: a6c42c51d8c94d13c34e060f59aea2c29cbe373c54a6682a1077287da3792817
                                                                  • Opcode Fuzzy Hash: c4ddf2f7d615a0b45ef61b76e2b171ae79324f88c2cdfd57c4a59b3a6608cc80
                                                                  • Instruction Fuzzy Hash: 0A218930A027099FCB24DF68C9447EEFBF1EF48314F1881AAD4099F255D730A881CBA9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019ED4F8 Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 900e5bd636d6f700e7c309aca4ed43339159e9a29d2ae7d759fd3e8de49e9872
                                                                  • Instruction ID: 34811ab0ebf9e0e635f9fd0e955eac99a996a93a0a60e703f6506b969dfc256e
                                                                  • Opcode Fuzzy Hash: 900e5bd636d6f700e7c309aca4ed43339159e9a29d2ae7d759fd3e8de49e9872
                                                                  • Instruction Fuzzy Hash: 3F21F571504204DFDB06DF58D5C8F26BBE5EB88318F20C96DE80D4B25ACB36D446CA61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019ED01C Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6f7cb6f94eac9308c9131264a8ee94751632790725cd029bcba101bdbea27df7
                                                                  • Instruction ID: 3b4ebc1f61a2f11d59024efe49f01916118e7775ea3483f625b033c032c1d1ae
                                                                  • Opcode Fuzzy Hash: 6f7cb6f94eac9308c9131264a8ee94751632790725cd029bcba101bdbea27df7
                                                                  • Instruction Fuzzy Hash: FA212271604200DFDB16DF58D988B26BFE5FB84316F28C96DD80E4B256C33AD447CA61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038DE0 Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: cc0dde89e874a6a2fa8651664ff94cd5381d1bd8716986a53091eda9349d359b
                                                                  • Instruction ID: 2afedfb246b6fc3055b50a94b09541c02c199eb19686dd0892800a8293f5ed3a
                                                                  • Opcode Fuzzy Hash: cc0dde89e874a6a2fa8651664ff94cd5381d1bd8716986a53091eda9349d359b
                                                                  • Instruction Fuzzy Hash: 32118E767443009FDB58DA2DD484A2AA7DAEFC8A60714C47BF80AC7754EE71EC018390
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0327C0 Relevance: .1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8bd34e2bf670d8e8162831119551bcd23799f4fbbc1a09d5eb9344370b9eafb5
                                                                  • Instruction ID: c2c6a4edeb3c485642bf56dddbcdcd0a604ac2eac26d5702d1aae6e1955779cd
                                                                  • Opcode Fuzzy Hash: 8bd34e2bf670d8e8162831119551bcd23799f4fbbc1a09d5eb9344370b9eafb5
                                                                  • Instruction Fuzzy Hash: 1021C234E012548FCB199B79C4586EE7FF6AF8A710F1440AAD401EB3A1CB759C45CBE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E8CA8 Relevance: .1, Instructions: 70COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 52182bd27bf65784b1c009721f2b472fabd4c760f25ba3649fdb9c9842bcfa42
                                                                  • Instruction ID: 0439451a7db5c8ce514ddae16a3586a30505827cd5524dd7744533e905891a87
                                                                  • Opcode Fuzzy Hash: 52182bd27bf65784b1c009721f2b472fabd4c760f25ba3649fdb9c9842bcfa42
                                                                  • Instruction Fuzzy Hash: 68213779B005158FCB44DF69D98896EB7BAFF89610B11406AE606DB3B1DB30EC01CBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03474137 Relevance: .1, Instructions: 69COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 12b2e397e226fe45806fbda88a32b1b0dddc97eeb89bc228063a9f97c9d165f9
                                                                  • Instruction ID: 8b02eabc07955e3f74046cbb2b3f43e1e9bddd7ee6ad270758a735786314ce7a
                                                                  • Opcode Fuzzy Hash: 12b2e397e226fe45806fbda88a32b1b0dddc97eeb89bc228063a9f97c9d165f9
                                                                  • Instruction Fuzzy Hash: 77214F30A40159CFDB14DB6AD498BFDBBB5AF48314F28406AD411EF3A1CB759D40CB95
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038A07 Relevance: .1, Instructions: 68COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 00286babf31385a5ec9690befd0b73eb743780ce28a0e2f249d654aa35f208b4
                                                                  • Instruction ID: 541276c8784babd88afd88eee333f2559f0063098ffda71a91b593ba6cc8d22c
                                                                  • Opcode Fuzzy Hash: 00286babf31385a5ec9690befd0b73eb743780ce28a0e2f249d654aa35f208b4
                                                                  • Instruction Fuzzy Hash: 6D21C630701305DFEB189F35D8486AA77AAEB84705F10C5F5E9008B294DB76EC45CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035ACA Relevance: .1, Instructions: 66COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2ecb13bc88690636e2ae1f0dd857eeae333243e5e54de6049c143c0078974e01
                                                                  • Instruction ID: 2402ab7a2ae8a19e6302290885b534d2e9946524af528d77e358369f58d82e01
                                                                  • Opcode Fuzzy Hash: 2ecb13bc88690636e2ae1f0dd857eeae333243e5e54de6049c143c0078974e01
                                                                  • Instruction Fuzzy Hash: 8511B271B001069FCB189B68DC9896EB7BBEFE5A11F1440A9E4098B374DF35DC42CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03479FA8 Relevance: .1, Instructions: 65COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 374297e5789f3324f33c409ec039d9f87c60e45ea0ba5d7625f8634d7be598d3
                                                                  • Instruction ID: bd96b3ba258665ad8fa42f852665ca79f233acdd0f05f89ddecde9b4af695c46
                                                                  • Opcode Fuzzy Hash: 374297e5789f3324f33c409ec039d9f87c60e45ea0ba5d7625f8634d7be598d3
                                                                  • Instruction Fuzzy Hash: 31115B313493948FD7066B34A8102AE7FA3DBC6240F0885BAE845CB3D9CE39CC0687A1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019EEE87 Relevance: .1, Instructions: 64COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 7cfb7dd041e002c130cd1539feb2bbdfd134433b7a32c8f6d204d752fbd68790
                                                                  • Instruction ID: ae2cc2cd36932a50e7e833ca51785f32991feeb3b8a04af3f7df6a32e70f0471
                                                                  • Opcode Fuzzy Hash: 7cfb7dd041e002c130cd1539feb2bbdfd134433b7a32c8f6d204d752fbd68790
                                                                  • Instruction Fuzzy Hash: A7217C76404240EFCF178F54D9C4B56BFB6FB88324F248699EE090A26AC336D466DB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E0BBE Relevance: .1, Instructions: 62COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 63d8cbc45f96a9e2a03427a05747b651bca20cbb59adf3cd175d060465c1f876
                                                                  • Instruction ID: 911bda505f13096229888419020d22649e31d74727dd0258308da68335460043
                                                                  • Opcode Fuzzy Hash: 63d8cbc45f96a9e2a03427a05747b651bca20cbb59adf3cd175d060465c1f876
                                                                  • Instruction Fuzzy Hash: FD212934B0012ADFDF49DE94D8809AE7BB6FF98350F104015E9159B2A0D775D9A6CBF0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019ED006 Relevance: .1, Instructions: 62COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d7d2cdfd2ae3aadffa2745fcc17d2e4f693cf5ff75a6bf21353e7daf6867383e
                                                                  • Instruction ID: 5e4726272ede24120636dee6fad3d30e49a4033b38143b5aab168325e8cd0e51
                                                                  • Opcode Fuzzy Hash: d7d2cdfd2ae3aadffa2745fcc17d2e4f693cf5ff75a6bf21353e7daf6867383e
                                                                  • Instruction Fuzzy Hash: 2121A1755093808FDB03CF24D994715BFB1FB46215F28C5EAD8498F2A7C33A980ACB62
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473D30 Relevance: .1, Instructions: 61COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: bded55b4a497a6f8b13c875c7f9eb74abbc289b6a1786a539532da2b9a5377c5
                                                                  • Instruction ID: 791cfb6828733136d0d27fd47541b0a0661a1d6dae9b530caa932ae7b3c0c660
                                                                  • Opcode Fuzzy Hash: bded55b4a497a6f8b13c875c7f9eb74abbc289b6a1786a539532da2b9a5377c5
                                                                  • Instruction Fuzzy Hash: 2C11A53A304214ABD720DD49E884AE7F79DEBC5665F18812BED198B344D736D805DB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019EED8B Relevance: .1, Instructions: 61COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4b8d3571c4b9cc2845d5b9732b44ba54f756556ea458328d5f45100f7847987e
                                                                  • Instruction ID: e0f525a7e2d19b0c11910cdf25b6ee698ecca12cde88b78aec208c4f9821fa1f
                                                                  • Opcode Fuzzy Hash: 4b8d3571c4b9cc2845d5b9732b44ba54f756556ea458328d5f45100f7847987e
                                                                  • Instruction Fuzzy Hash: D7218E72404240DFCF16CF54D9C4B56BFB2FB88314F24C699ED080A266C336D426DB51
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035A09 Relevance: .1, Instructions: 60COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: ce58f8cca56d957cd41769b41ada196bf727ce6bb606c32c3d16377a3f03d294
                                                                  • Instruction ID: 9bf0ef849def64e177883c55c69a51db06a7d69156d8905c3191ab6c6e238b59
                                                                  • Opcode Fuzzy Hash: ce58f8cca56d957cd41769b41ada196bf727ce6bb606c32c3d16377a3f03d294
                                                                  • Instruction Fuzzy Hash: 43212EB4E00209EFCB04EFA8C984AAEBBF6FF98310F514099D405A7364DB349E45CB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034788F0 Relevance: .1, Instructions: 58COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0bf7ef55ad354f52786485d44efda6a60fa9fa12094f305debf49a65a7b33242
                                                                  • Instruction ID: c32cc7db2ec89631f458341eef0cc997b5d9f1c2921e43e6d70222133b644cd6
                                                                  • Opcode Fuzzy Hash: 0bf7ef55ad354f52786485d44efda6a60fa9fa12094f305debf49a65a7b33242
                                                                  • Instruction Fuzzy Hash: 95118EB02007189FC716AB74D8186AFB7A6FF85700F50496DD05A4B358DF35A809CBD6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD067 Relevance: .1, Instructions: 58COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
                                                                  • Instruction ID: f37509b8bd716db3afb7008275c4fbc395c88f6f79e65fe298fe75aec1aa54f5
                                                                  • Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
                                                                  • Instruction Fuzzy Hash: 49219D76504284DFDB16CF54D9C4B16BF72FB88314F24C6A9D9490B256C33AD426CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E40FD Relevance: .1, Instructions: 57COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 355171ad038fc61f3eb9840a358dcd11e8979e297baa29b65cfec186a8525c83
                                                                  • Instruction ID: 9d8bb14b78f2d302107e6e2d228b130bd1f1a86f1676d4513feba4a75f6f3ad1
                                                                  • Opcode Fuzzy Hash: 355171ad038fc61f3eb9840a358dcd11e8979e297baa29b65cfec186a8525c83
                                                                  • Instruction Fuzzy Hash: 6001AD1270E2E42FC7032A2D6CB40DBBF698E8755471904E7D0C5CB263D815880B83F6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476728 Relevance: .1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: de82d793d5b5c3238e2355514b6da1a0969d4ba30c1ee4bf2fee3e64fb262ede
                                                                  • Instruction ID: 92ff2212cd358824c0c011f83d775cc198bfefd5fe4c363f937eb336eb3140be
                                                                  • Opcode Fuzzy Hash: de82d793d5b5c3238e2355514b6da1a0969d4ba30c1ee4bf2fee3e64fb262ede
                                                                  • Instruction Fuzzy Hash: 3A117C75300A018FD714DB29CA44AEBB7EAEF84685F05C56AD05ECF754EB38E809CB94
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347F51D Relevance: .1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2e61ffa44d8c7b67318389d86c2e03e3d1957787b0830c8287bf2c2655f988ae
                                                                  • Instruction ID: 06c9afb00219c111cff1f85ddb35eee903bad83eac3e94a2961d709e03ccad91
                                                                  • Opcode Fuzzy Hash: 2e61ffa44d8c7b67318389d86c2e03e3d1957787b0830c8287bf2c2655f988ae
                                                                  • Instruction Fuzzy Hash: BD118C35304214AFCF06DF98E850D9EB7B7FF88214B148444E6152B366EF39AD06DB89
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034795D8 Relevance: .1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3323965fa6087cf44907922a930c69d3aefe13c43ffb07317f7f11972399dc4a
                                                                  • Instruction ID: 272e2d2708cce3dacb9fad9223cd865966cd6935970e16edb8ada90e5a099a31
                                                                  • Opcode Fuzzy Hash: 3323965fa6087cf44907922a930c69d3aefe13c43ffb07317f7f11972399dc4a
                                                                  • Instruction Fuzzy Hash: B611E0B1609388DFCB82DFB4E8142A9BFB5EB46200B1045EFD048CB252EB354E06C762
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A95A Relevance: .1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 474bcb4fc43d21a61ee0c2b586e549d8aa6a7e03c708cdaead4b639462c28f03
                                                                  • Instruction ID: 72cafba3bd2f7ba8bb746849de4e0717c30376db07c9d983f0529b1b208d4d53
                                                                  • Opcode Fuzzy Hash: 474bcb4fc43d21a61ee0c2b586e549d8aa6a7e03c708cdaead4b639462c28f03
                                                                  • Instruction Fuzzy Hash: 3E11A072C0474E9BCB01CFA4DC000DDBB76EF96310F0A4693E510BB260EB70258ACBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B035A18 Relevance: .1, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 438b914af52ea25d87679dd85a89070e27d10a87acffe042d5ab337e97cf34b2
                                                                  • Instruction ID: 79212929b65e18dd05595bbacb4bc08b943674e6c175167dda92e0a032c252f2
                                                                  • Opcode Fuzzy Hash: 438b914af52ea25d87679dd85a89070e27d10a87acffe042d5ab337e97cf34b2
                                                                  • Instruction Fuzzy Hash: 9C21EAB4E00209EFCB04EFA8C9849AEBBF6FF58310F514499D455AB364DB30AE40CB81
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476718 Relevance: .1, Instructions: 55COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3829b71c401aa74870c9f1afdc0356ebd4dcd16d83e461f450e58166c21cad1a
                                                                  • Instruction ID: eb487f3823a55bc558fc59eaaa7d91ca49fcd9f3ac38ec93b401d08146b63eda
                                                                  • Opcode Fuzzy Hash: 3829b71c401aa74870c9f1afdc0356ebd4dcd16d83e461f450e58166c21cad1a
                                                                  • Instruction Fuzzy Hash: 8A1108B53007018FC311D635CA006E6FBEBEF80681B058A6BC05ACFB45EB38E809CB55
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 019ED4F3 Relevance: .1, Instructions: 53COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2911466070.00000000019ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 019ED000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_19ed000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                  • Instruction ID: 0c09e58f94b8b78dd291e4503660709921720cab31d8965d75913e0131a60d14
                                                                  • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                                  • Instruction Fuzzy Hash: 1C119D75504284DFDB06CF54D5C8B15BFA1FB88318F24C6AAD84D4B69AC33AD44ACB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B039FD3 Relevance: .1, Instructions: 53COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: dc60302820ee810e7ac2b52ed8b8d13e159275dd5a3c0da979d6372f9319562c
                                                                  • Instruction ID: cc5061bb3153121d2c6024556b62d7b527c53017dca2da98db30aeab359e3f77
                                                                  • Opcode Fuzzy Hash: dc60302820ee810e7ac2b52ed8b8d13e159275dd5a3c0da979d6372f9319562c
                                                                  • Instruction Fuzzy Hash: 5D01A7353042154F8B698A6DE898A6FB7FEEFC5A64314816BE409C7351DB72DC02C791
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034760B0 Relevance: .1, Instructions: 52COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 54b574679ff8b796fcd3231713fb3929c722045987d2c12cb24439264f3831d3
                                                                  • Instruction ID: 983d7e2be9625b36ccf9aefcde1ee9add78e6ca603592358251d034c4e6a3889
                                                                  • Opcode Fuzzy Hash: 54b574679ff8b796fcd3231713fb3929c722045987d2c12cb24439264f3831d3
                                                                  • Instruction Fuzzy Hash: 3D019E343412048FCB49AB38E96986E7FE6EFC921430405ADE10BCB3A1DE25CC058B92
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347F52D Relevance: .1, Instructions: 52COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f36798c74d809acdf07602f37c151d2702ed07c389dc8af07c6adb7ce8542ba2
                                                                  • Instruction ID: 59cc93c587cf5cd0ab499c98ff3054c931b96596bf895730f3a6943d6fe61b9f
                                                                  • Opcode Fuzzy Hash: f36798c74d809acdf07602f37c151d2702ed07c389dc8af07c6adb7ce8542ba2
                                                                  • Instruction Fuzzy Hash: ED115E357042149FCF05DB54E850D9E73B7FF88614B148444D6261B365EF39AD16CB89
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347CA4F Relevance: .1, Instructions: 52COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d74d3b6445a473983353e9cbd1ed6601183e9962d4c54e128f64018463a5bd4e
                                                                  • Instruction ID: 849aeae99c360835423699d9359e86e69dbd315f93f33b09a1498b8b4731d1ea
                                                                  • Opcode Fuzzy Hash: d74d3b6445a473983353e9cbd1ed6601183e9962d4c54e128f64018463a5bd4e
                                                                  • Instruction Fuzzy Hash: F911ED37C1060A9ACB40CFA4D8001DDF7B2EF85300F154696E8207B560EBB52A4ECB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475AE8 Relevance: .1, Instructions: 52COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 9d15c1f71e3becaf04bd32941dd0bb3464cbbbecedb2794ceb9741e9370db605
                                                                  • Instruction ID: b294095f10193d1dc401f7fdf8b33aacebc759454aed6c592a5b53192ff766be
                                                                  • Opcode Fuzzy Hash: 9d15c1f71e3becaf04bd32941dd0bb3464cbbbecedb2794ceb9741e9370db605
                                                                  • Instruction Fuzzy Hash: 0311E135A002498FCF55CFA8D5042EEBBF2FF89310B1849AAD841AB755C734AD09CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347C715 Relevance: .0, Instructions: 49COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 781cde29e0e0df5829b5009dae76a2957b34885bdd7502ac9b9c6b1446bfeda2
                                                                  • Instruction ID: ceb4600f19a30b04ba8cf170dba6bd62f14d62ce4fed16f585b963fdd6e93b0e
                                                                  • Opcode Fuzzy Hash: 781cde29e0e0df5829b5009dae76a2957b34885bdd7502ac9b9c6b1446bfeda2
                                                                  • Instruction Fuzzy Hash: 4501804005F7E02FD7036B3C5DB45D63F665E43214B0A05D7E0D0CE8A7D64849ACC3AA
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A51A Relevance: .0, Instructions: 49COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 075f1a7aff266dd1c126412d05f063696087ba5b6d814f9e929b11be26c02a8c
                                                                  • Instruction ID: 6e10c55fe5fdcb3a75bed3b926d1c52f3af31436367c651bbdfb1a5d5deed6b2
                                                                  • Opcode Fuzzy Hash: 075f1a7aff266dd1c126412d05f063696087ba5b6d814f9e929b11be26c02a8c
                                                                  • Instruction Fuzzy Hash: 36012136A002498BCF8ADB64C4222FFBFB58F84211F054977C522AF740DE341A0B8BC6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476B8C Relevance: .0, Instructions: 48COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 95d48373e22b4983eb402b12428c0e6554b6a6f85157ccc85f45a9e29f927a4b
                                                                  • Instruction ID: fa60bf4f0452fd6765605b1d4eef4649a89b0d8be1c0d483e009e90e1c000e9b
                                                                  • Opcode Fuzzy Hash: 95d48373e22b4983eb402b12428c0e6554b6a6f85157ccc85f45a9e29f927a4b
                                                                  • Instruction Fuzzy Hash: D3115E30700A558FCB00DF68D1895ADBBF6FB88321B55895AE5199B741CB39FC41CB85
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038D60 Relevance: .0, Instructions: 48COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 53ecf52b3da0d1c106172310fbc68622782579e91a0e8daf4c51f85d0b297b82
                                                                  • Instruction ID: 848768c1dce22328c5461eeb4cc970419f537a0a56e2b0fd97670feaf0216b60
                                                                  • Opcode Fuzzy Hash: 53ecf52b3da0d1c106172310fbc68622782579e91a0e8daf4c51f85d0b297b82
                                                                  • Instruction Fuzzy Hash: 57F0DC73708224AF5758DA6EA84496AF7DEEBD56A0314C02BF908C7340DA31EC0087E4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A490 Relevance: .0, Instructions: 47COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 09ff07cb64e358fd25e5e85e5cd75be897fe46c857581bdc0521a79b655fe785
                                                                  • Instruction ID: 9f4dc510f848e526fd03adeac79ddb9b643fe6c2290113ee3ce641b1ce0321d5
                                                                  • Opcode Fuzzy Hash: 09ff07cb64e358fd25e5e85e5cd75be897fe46c857581bdc0521a79b655fe785
                                                                  • Instruction Fuzzy Hash: C3014C32D1061E9BCF00DFA9D8404DEFBB6EFC9310F194626E52177260EBB0258ACB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038DD0 Relevance: .0, Instructions: 47COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fb7faa99f95bd22f7ee4bbe623d5ff481a9d119789c24e4fc7ee0edafe1b8f09
                                                                  • Instruction ID: 86a73bd20e1c1b7a5d0830269e1e8be93c683524823ad758b297c6da2153d031
                                                                  • Opcode Fuzzy Hash: fb7faa99f95bd22f7ee4bbe623d5ff481a9d119789c24e4fc7ee0edafe1b8f09
                                                                  • Instruction Fuzzy Hash: D201A2B17443016FD758DB2DD894A6ABBEAEB88760714847EF849C7350EB75DC01C750
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347CA60 Relevance: .0, Instructions: 46COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 99055174c498c52cc013338fc500c38a2af79bcb16b9e440fac54e878ca25123
                                                                  • Instruction ID: f8a5b543969e61f569139483ef30de1a2cd6a701a2a225f4bc591da90c7ecfa2
                                                                  • Opcode Fuzzy Hash: 99055174c498c52cc013338fc500c38a2af79bcb16b9e440fac54e878ca25123
                                                                  • Instruction Fuzzy Hash: A0017C32D5061AA7CF04DFA8D8004DEF7B6EFC5310F158656E92177560EBB1294ACBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03471E5B Relevance: .0, Instructions: 46COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3714d2eb63f1ac2548f9977162b1f0e55878eef328a15c53b9aa64c9f13db353
                                                                  • Instruction ID: 9851e286358a2632f3721939015e2e0779e40ceb34ea91b7f5d64457b754108a
                                                                  • Opcode Fuzzy Hash: 3714d2eb63f1ac2548f9977162b1f0e55878eef328a15c53b9aa64c9f13db353
                                                                  • Instruction Fuzzy Hash: 0A11D235914219DFDB14CFA4E898AEDBBB6FF48310F14406AE816AB360CB746C81CF54
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475C5A Relevance: .0, Instructions: 46COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 60e906d3f990d1afb41cb7611309e74ddc5b1d72f004fb40e646245a5091dee0
                                                                  • Instruction ID: 82d2af0f12f8400cd5368d4a22cbaee7b19bf5fff4b9749771847b3ec2041d49
                                                                  • Opcode Fuzzy Hash: 60e906d3f990d1afb41cb7611309e74ddc5b1d72f004fb40e646245a5091dee0
                                                                  • Instruction Fuzzy Hash: C301B532D1574A9ACB01DFB4D9401CDFBB6EF8A310F2A47A7E011B71A0E7742A4AC751
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477AF9 Relevance: .0, Instructions: 45COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 05b691f44935d219cb228199926640a8b9ee7d5155e8bbfa122bd7a92cc24c49
                                                                  • Instruction ID: d571ea8d4fd835b24be75e9ace5b94f9f637927df80baa5525e756c853dc7729
                                                                  • Opcode Fuzzy Hash: 05b691f44935d219cb228199926640a8b9ee7d5155e8bbfa122bd7a92cc24c49
                                                                  • Instruction Fuzzy Hash: 9D01F2317007004FCB45DB7EC98069ABBEEEF98254B4580ABD5098B391FB299E08C795
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B039FE0 Relevance: .0, Instructions: 45COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 82a01b4d810f18ca36f04c4e1602d1378d5f288f7074694807ed8654f71db7c1
                                                                  • Instruction ID: 56c2172d415a6c25cc182e25410ad089b50556fcbd3e792cfb1c5770958705e9
                                                                  • Opcode Fuzzy Hash: 82a01b4d810f18ca36f04c4e1602d1378d5f288f7074694807ed8654f71db7c1
                                                                  • Instruction Fuzzy Hash: 29F030363141144F57699A6DA888A6FB7EEFBC8AA5314413BF50AC3350DF62DC028790
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD825 Relevance: .0, Instructions: 45COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: efdcf1981b7e9c7d8f2170839370cf53a48bc030eacccf814f3dbc1bf4bd5de3
                                                                  • Instruction ID: f943fb536e1ae7c13274f2fee059047221e3cebf1cae40d7e0c420282960a153
                                                                  • Opcode Fuzzy Hash: efdcf1981b7e9c7d8f2170839370cf53a48bc030eacccf814f3dbc1bf4bd5de3
                                                                  • Instruction Fuzzy Hash: 1A01F7714483489AE7224AA9CD85767FFA8DF41324F18C46AED4D5A2C6C279D840C6B1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032067 Relevance: .0, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2753dffb027145178808e25522aa8d3dd16decee263a7eb476b1787625791aa3
                                                                  • Instruction ID: 694bf3383312f047c6316390c12492fcb8700303ced30e945d4585511f7c5500
                                                                  • Opcode Fuzzy Hash: 2753dffb027145178808e25522aa8d3dd16decee263a7eb476b1787625791aa3
                                                                  • Instruction Fuzzy Hash: 1BF028313493045FC309CA28E864ABFBBEEDBC9320B04006BE809C7352CA27AC41C3A0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033400 Relevance: .0, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b8a7cf2165358fd900bef1b1803835d099a1a2557f54e782145171e9ba3d74ff
                                                                  • Instruction ID: 7d8ced15ffbd9f9d9242ac198cd47cb4a15538f5139226e7812252d9c709ebf0
                                                                  • Opcode Fuzzy Hash: b8a7cf2165358fd900bef1b1803835d099a1a2557f54e782145171e9ba3d74ff
                                                                  • Instruction Fuzzy Hash: EF01D1312093825FC7129B3CE89489A7FEA9FC721030900ABE084CF266DA60EC4987A1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034759D7 Relevance: .0, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 1a2e5ca7519ae91187f92445ac4a4b07982ae2c3a5c475a5eaf5aaa9d2b260f7
                                                                  • Instruction ID: ef5a3641a019f2aaa612716fd5f6393fee523f5dad9085b73fe012d433a24bf9
                                                                  • Opcode Fuzzy Hash: 1a2e5ca7519ae91187f92445ac4a4b07982ae2c3a5c475a5eaf5aaa9d2b260f7
                                                                  • Instruction Fuzzy Hash: EB018432D1064A8ACF00DFB8D9001DDFBB2EFD9311F158A66D511B7560EB74259ECB91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E9908 Relevance: .0, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c661d34c21b746411b99a06b40e9bab3a96869fd01fc5506a3aac305e0c82935
                                                                  • Instruction ID: bc05376e497cf5a07d7470e76207a6bb3672cff0cdcecefd86e95b947a0ce57d
                                                                  • Opcode Fuzzy Hash: c661d34c21b746411b99a06b40e9bab3a96869fd01fc5506a3aac305e0c82935
                                                                  • Instruction Fuzzy Hash: 5CF0F4367005209FCF289B29900025AB366EB89229F10817AD40587B80CB35EC97CBE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD967 Relevance: .0, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: de26e12112b2b91868d71f7c9dd87bee9fcbc7f793156d8c3d58c07759ad9554
                                                                  • Instruction ID: 740dd430bb3d040983d5b5cf71c7f3f80cb2850d190411934fed5e756434dfd6
                                                                  • Opcode Fuzzy Hash: de26e12112b2b91868d71f7c9dd87bee9fcbc7f793156d8c3d58c07759ad9554
                                                                  • Instruction Fuzzy Hash: C5011A76200A04AFD7219F4AC940C23FBBAFFC8720315845DE98A4BA21C372F851DFA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0340C0 Relevance: .0, Instructions: 42COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0b811d186d878dedf05f9094b9592830d3f93118aa88a48633cbd2c2c351395d
                                                                  • Instruction ID: 2b4f7a60a7d3dc5639035b993f82801d18a1405e5adb3f3fc53b9528245de534
                                                                  • Opcode Fuzzy Hash: 0b811d186d878dedf05f9094b9592830d3f93118aa88a48633cbd2c2c351395d
                                                                  • Instruction Fuzzy Hash: 7E01F2702003096FDB10A769D40466EBAE7EBC1314B00452DD16E8B715CF72AC4A8FF2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347CAE8 Relevance: .0, Instructions: 41COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 34a93f3956fa0f0743c83662a3c7b32f3dc02901678907a0671058c234ad5b48
                                                                  • Instruction ID: 6723bde82e75f30beaa22a17a6927ba619f38f89a7d6e2d2a90d8fdd026fcca7
                                                                  • Opcode Fuzzy Hash: 34a93f3956fa0f0743c83662a3c7b32f3dc02901678907a0671058c234ad5b48
                                                                  • Instruction Fuzzy Hash: 41F0BB729101099BDF54DB74D5695EFFFAA9B44700F004926D512BB340DE71690B86D2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD958 Relevance: .0, Instructions: 41COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 39861b3d5fb6be5e18c1e49b77e0ebb10e12bb24c1c86a335c19d4124965ca45
                                                                  • Instruction ID: 2e0b8f4c610bea5553325dea409fc9b7d557d0c5abe59331ba72b10f34a96c0f
                                                                  • Opcode Fuzzy Hash: 39861b3d5fb6be5e18c1e49b77e0ebb10e12bb24c1c86a335c19d4124965ca45
                                                                  • Instruction Fuzzy Hash: 47010C75104740AFD7229F55C940C62BFBAFF89720719948DE9864BA62C272F812DF60
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477280 Relevance: .0, Instructions: 40COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f4ec73244387fe74020b68d21e1204e1fc84afd60e7ca4580637ba6a52ee2af1
                                                                  • Instruction ID: 2c50f228e79849a337e73852d1f745fb4caca8d109c554e294d91e3c3885954f
                                                                  • Opcode Fuzzy Hash: f4ec73244387fe74020b68d21e1204e1fc84afd60e7ca4580637ba6a52ee2af1
                                                                  • Instruction Fuzzy Hash: 180181752002049FC704EB7DD94989EBBF6FF892107418669E51A9B364DF30EC04CBD1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475A60 Relevance: .0, Instructions: 40COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 37b929449321b2c1eab1296d7599e0adf8a79fa1e1dcc40f6adfd14b06669b50
                                                                  • Instruction ID: 9ee01b6d04e7b6377e09a1b134a1785160911ad60a1e781078d7907f40e79597
                                                                  • Opcode Fuzzy Hash: 37b929449321b2c1eab1296d7599e0adf8a79fa1e1dcc40f6adfd14b06669b50
                                                                  • Instruction Fuzzy Hash: 83F046B3D1010A8BDF88DBB4C4515EEBBA2DF84B00F144D6AC042BB280DE70660B8782
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034759E8 Relevance: .0, Instructions: 40COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c18fcdbd2a13804780dc9f7fc9b259b47b389c64fa546071840ab2c391a06c98
                                                                  • Instruction ID: aa60a83f3e623749be5b259ac56e9d12b1a6b6a2866b4dc194f399421e650f1f
                                                                  • Opcode Fuzzy Hash: c18fcdbd2a13804780dc9f7fc9b259b47b389c64fa546071840ab2c391a06c98
                                                                  • Instruction Fuzzy Hash: D5016D32D1060A97CF00DBB9D8004DEFBB6EFC9310F158666D121B7160EB70259ACBA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E78E0 Relevance: .0, Instructions: 40COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3b6a71c6b78119b9248ec364cd1571079c865cbdf89e4a701b896de7ae0b596a
                                                                  • Instruction ID: b70ac9536f0c836d44597b153b14dc9e462f41d442e9e543ac6de1eed4afa153
                                                                  • Opcode Fuzzy Hash: 3b6a71c6b78119b9248ec364cd1571079c865cbdf89e4a701b896de7ae0b596a
                                                                  • Instruction Fuzzy Hash: 0CF03CB2D05125AFDB41EF7AD8005EE7FB5EF99710B118165F809EB210E3319A51CBE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0320CC Relevance: .0, Instructions: 40COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0e053bed0416d64695b239b15e9df972193fe9342118e44b65c5dc7748f573a4
                                                                  • Instruction ID: df9cb1ba687951a835a9e4da080c083e92bf8f17741882ec50f95ac0e60281b8
                                                                  • Opcode Fuzzy Hash: 0e053bed0416d64695b239b15e9df972193fe9342118e44b65c5dc7748f573a4
                                                                  • Instruction Fuzzy Hash: 0FF046F2A0A2804BD30E4B28947C3BA6F96DB96A11F0800DAC8069B1A6E717D84BC201
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B038772 Relevance: .0, Instructions: 39COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a9ff46ca73ebb10d287653c8e029672d5636726aaaa544f79ab8cf38a9288c7c
                                                                  • Instruction ID: 4ad57ba44a7a3861072c6be45b9938b061e4430b2256f27ed61acad2a2149056
                                                                  • Opcode Fuzzy Hash: a9ff46ca73ebb10d287653c8e029672d5636726aaaa544f79ab8cf38a9288c7c
                                                                  • Instruction Fuzzy Hash: 58F0E2367042001F9758967EA8449ABEBDFEFC4AA0720C03AB109C7368EE75DC0643E0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034797D0 Relevance: .0, Instructions: 38COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d3f3b62ee0cab39b0d8faa2e62b17a72aa9842da912602fef1fb2d2eac85c409
                                                                  • Instruction ID: 9abf0083ab82841a87635f9589c351d953278be50445cb14dbcdbd1249d10038
                                                                  • Opcode Fuzzy Hash: d3f3b62ee0cab39b0d8faa2e62b17a72aa9842da912602fef1fb2d2eac85c409
                                                                  • Instruction Fuzzy Hash: 90F05931F041508FCB01573824642FEBF62DFDB950708809FE44ACF685DB188D078382
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475CE0 Relevance: .0, Instructions: 38COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2e739220742ea7a7db43a16ce93149f06a980aaabcb1889a05f58dab48bde9e1
                                                                  • Instruction ID: e429053d584598727623a508ce972ccd54fda4a3126771d4b067ac2c7bb29a48
                                                                  • Opcode Fuzzy Hash: 2e739220742ea7a7db43a16ce93149f06a980aaabcb1889a05f58dab48bde9e1
                                                                  • Instruction Fuzzy Hash: ABF046329202489BCB06DB70C4295EFBFB69F45300F04882AC052BF250EEB02A0787D6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E6F00 Relevance: .0, Instructions: 38COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: dcf0d9568f99e12a5721e339dbe19a1e35dcb8d548f64eb474e17356603628b5
                                                                  • Instruction ID: d917c1122a6d4a105718f43e3fe8029dfbe31970013e524d6b3487a2df352c6d
                                                                  • Opcode Fuzzy Hash: dcf0d9568f99e12a5721e339dbe19a1e35dcb8d548f64eb474e17356603628b5
                                                                  • Instruction Fuzzy Hash: 7C011634D00218DFCB50CFA5D8419DEBBF6EB49310F20C92AD559A7244D735AA42CFD0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A9F2 Relevance: .0, Instructions: 37COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5a2545f67cfb8655334bfee359105c7860078b377290ac9469147e2043d32048
                                                                  • Instruction ID: c05c4735606c0e60fd74797ec1e3aafe0df82126e6330d8cfe47695eb1a5e03c
                                                                  • Opcode Fuzzy Hash: 5a2545f67cfb8655334bfee359105c7860078b377290ac9469147e2043d32048
                                                                  • Instruction Fuzzy Hash: 0DF0F036A102898BCB05DB70C6266FFBFB68B44300F04482AC512BB780DE701A078FC6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD163 Relevance: .0, Instructions: 37COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: bc9fc3f5e177fccebe70be88072b44102547d0829382ed8be7ba748e52db5aa9
                                                                  • Instruction ID: 253db87b7a33bdbbd4c68674cb41626b3a0a7b5d1b796fde7b14cda23aa3f7f9
                                                                  • Opcode Fuzzy Hash: bc9fc3f5e177fccebe70be88072b44102547d0829382ed8be7ba748e52db5aa9
                                                                  • Instruction Fuzzy Hash: 48F04976200604AFA320DF0AC884C23FBBDFBC4730315C19AE84A4B652C272EC42CEA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476F18 Relevance: .0, Instructions: 36COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5c7e565a276ffa5e3340f6f0ea9e80e17ed406bd79b971b0ce90b2a000bc4fc8
                                                                  • Instruction ID: edefa1064a05892a95ddd67008bba1d2598637d7f38652e088b0131579c1da9b
                                                                  • Opcode Fuzzy Hash: 5c7e565a276ffa5e3340f6f0ea9e80e17ed406bd79b971b0ce90b2a000bc4fc8
                                                                  • Instruction Fuzzy Hash: DD01DC35A002198FCB80DFA8C9417DABBF1FB48311F50446AD909AB340D779AA4ACB80
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0328AF Relevance: .0, Instructions: 36COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f6af1d2d39b927b9a1d6a53051671485092ed8e987f947c11c3dab30bbe1dce5
                                                                  • Instruction ID: f005b2b55ea042206833aabc6da390859b31c56dde56b1bfb2c40c0626fe9c33
                                                                  • Opcode Fuzzy Hash: f6af1d2d39b927b9a1d6a53051671485092ed8e987f947c11c3dab30bbe1dce5
                                                                  • Instruction Fuzzy Hash: 39F0E57670426C57C2251639A8381AEBFDB9BC26627148067E801C7B85CD2ADC0743E6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD824 Relevance: .0, Instructions: 36COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4a41a5edf769b5b93c549e489f01db7f21fbeb62eaae3003342ab4c8e1d25695
                                                                  • Instruction ID: 239ece75b7da8ec83f6180a034ae03a285137e09a4afd7a1597faf4f122ebc54
                                                                  • Opcode Fuzzy Hash: 4a41a5edf769b5b93c549e489f01db7f21fbeb62eaae3003342ab4c8e1d25695
                                                                  • Instruction Fuzzy Hash: C2F06D71448344AEE7258E1ADC84B62FFA8EB81724F18C45AED4C5E2C6C279A844CAB1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03472219 Relevance: .0, Instructions: 35COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5b9632f66f5f624b72ec407fd805188b13b62e790397174a069bf244b2085fc2
                                                                  • Instruction ID: d93e98e79e0c43be0bd130ee84ca2b233349f731fc7fbdfae4d8b7b7c7788f6a
                                                                  • Opcode Fuzzy Hash: 5b9632f66f5f624b72ec407fd805188b13b62e790397174a069bf244b2085fc2
                                                                  • Instruction Fuzzy Hash: A5F06930A402599BDB10EB68C516B9EBBF1AF48700F14046AD801EB291DBB50D10CBA5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032A5C Relevance: .0, Instructions: 35COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 038304edb70653e482d01164e9bdeb0ce750afc53eef79843ee4030f0b54787f
                                                                  • Instruction ID: 7211367743a8c92cabe681fd889b5a9f69f302fa4fd8c3443463d48b1ae7e614
                                                                  • Opcode Fuzzy Hash: 038304edb70653e482d01164e9bdeb0ce750afc53eef79843ee4030f0b54787f
                                                                  • Instruction Fuzzy Hash: 2EF0C071D0E244EFC715CB74DC142597FF9DF06204B0141DDD004EB226E531AD06CBA1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032FA8 Relevance: .0, Instructions: 35COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 191cc32da24fdabb27948bc74d370fecd247e36f44133ba6ccae5a0c8a57b565
                                                                  • Instruction ID: d53f742837dd8b815bdf3dda21b97e537d2a167fd9bfd6b1c1821ce28355edb2
                                                                  • Opcode Fuzzy Hash: 191cc32da24fdabb27948bc74d370fecd247e36f44133ba6ccae5a0c8a57b565
                                                                  • Instruction Fuzzy Hash: 48F027323401072FC614A66EE84854EFBEBFFC52607404139E11EEB704DE31B8458BE5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032078 Relevance: .0, Instructions: 35COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6025dbad30fb3bb0c3e4a25ebced0f0baeb4acf53ee72381af3ebcde423d9899
                                                                  • Instruction ID: 093af337f0348aa7124e49bca9c2d28c17ba3f4960b592732e0225bea653a774
                                                                  • Opcode Fuzzy Hash: 6025dbad30fb3bb0c3e4a25ebced0f0baeb4acf53ee72381af3ebcde423d9899
                                                                  • Instruction Fuzzy Hash: C2F05E717042045FD358CA1DD4A8B7ABBEAEBC8760B14406AE909C7351DB77EC41C694
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031B8A Relevance: .0, Instructions: 34COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: d5001d9fe8ecfc9904e9575e457866b1c0aa7920c0ca3ee648a5469dd948f24a
                                                                  • Instruction ID: c9ad722d301f896b954c4adecbd648957d8c62da269af9ee0771fd2a312468b1
                                                                  • Opcode Fuzzy Hash: d5001d9fe8ecfc9904e9575e457866b1c0aa7920c0ca3ee648a5469dd948f24a
                                                                  • Instruction Fuzzy Hash: 5FF09671A00118CBCB19DA98D5197FE77FA9F8CA00F24442BD011B7384DF754E4187E5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347B178 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 55553f739e4a5bbe1b9615bd5d5465989c09557401ae3b27faf6536cead563e6
                                                                  • Instruction ID: 22ed0c9ed7e53e9204fe1d64229d3f13d6a4812092989399180ce7611e8cb7fd
                                                                  • Opcode Fuzzy Hash: 55553f739e4a5bbe1b9615bd5d5465989c09557401ae3b27faf6536cead563e6
                                                                  • Instruction Fuzzy Hash: 5BF02035B11304EBDB049EB9E884AEFB7AAEFC42A4F04002AE942A3300DF3088058790
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347AA00 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2734f8e9933a98d2e4418a67bbfcb6aeb9bbf0c4d0aba31641ffa3a648334f11
                                                                  • Instruction ID: 421189ce0ad27fd07d7a56f874d5c4606dfd0056cc1cceaeb2401e45fc50a316
                                                                  • Opcode Fuzzy Hash: 2734f8e9933a98d2e4418a67bbfcb6aeb9bbf0c4d0aba31641ffa3a648334f11
                                                                  • Instruction Fuzzy Hash: DEF0E232E101499BCF04DB64C5559EFFFBA9F88300F048826D012BB380EEB06A078BC6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03475CF0 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f7f3a5a9242afb0220bf70dc4c8db17dab6ce5b60f0b757c3457adb23414bc0c
                                                                  • Instruction ID: 9b811bb081c144b80942a108cc53103f68dbaeda9063fd75906f06a133e4b275
                                                                  • Opcode Fuzzy Hash: f7f3a5a9242afb0220bf70dc4c8db17dab6ce5b60f0b757c3457adb23414bc0c
                                                                  • Instruction Fuzzy Hash: 2BF0E232E101099BDF04EB64C4199EFBFB69F84300F008826D412BB250DEB06A0786D2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B039EE0 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a6645b9cf5d3af4be1d51502d083e32991580e41c322de3e151561e558aef12f
                                                                  • Instruction ID: 01dd9ef37b5a9abab76edbf0e47e380dce92b891fda2559363040fb99b2be588
                                                                  • Opcode Fuzzy Hash: a6645b9cf5d3af4be1d51502d083e32991580e41c322de3e151561e558aef12f
                                                                  • Instruction Fuzzy Hash: 12F02B397002128FC748DBB9E940966F7DEAF8869030485B5D90AC7738EEB1CC02DBD0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0341A8 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: eb8c83ec8452655500a7854ba7173e76954e94fba1e36d91ca063989d21b30bb
                                                                  • Instruction ID: 28b67bf1e9da39608396a7b1562fd49be8058add291cd63c92beace53e3f3b58
                                                                  • Opcode Fuzzy Hash: eb8c83ec8452655500a7854ba7173e76954e94fba1e36d91ca063989d21b30bb
                                                                  • Instruction Fuzzy Hash: 90F0EC353042029FC724EB6CD89096EB7EAEFC83107048479E088CF729EB25EC81CB94
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 017DD158 Relevance: .0, Instructions: 33COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2910804272.00000000017DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017DD000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_17dd000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 10e24785a0cc27e4e5e0beb33b949357c53a12818ad5fa30498f674a5ff282aa
                                                                  • Instruction ID: 43f7a955f52b7e084e225be05176caf951e6e19abe3511048d45ab166dbb7f4c
                                                                  • Opcode Fuzzy Hash: 10e24785a0cc27e4e5e0beb33b949357c53a12818ad5fa30498f674a5ff282aa
                                                                  • Instruction Fuzzy Hash: CDF0F975104A44AFE725CF16C984C23BBB9FBC5720719848DE84A5B352C671FC42CFA0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034795E8 Relevance: .0, Instructions: 32COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3b8a8260e069bdce085e42372e16bc6f43134d368f939d5182b793463015afea
                                                                  • Instruction ID: 7d4fee2955d82b207cd6a8fc778e342b3b152b54b2c565faab62776d8db12233
                                                                  • Opcode Fuzzy Hash: 3b8a8260e069bdce085e42372e16bc6f43134d368f939d5182b793463015afea
                                                                  • Instruction Fuzzy Hash: 43F0E2707002189FDB15CF68E4146AA3FFEEB4A250F20506AD00DC7394EF349D42C795
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E6F10 Relevance: .0, Instructions: 32COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 1e9c3134e8cfd7a39aa5a38b3c83e2163aa827432d9a046d79dc1d6aaf7a349a
                                                                  • Instruction ID: 5be2c9de2c6956fab53a112b52c73c9c7df3c6f6952167e50d67d4c5505a91e0
                                                                  • Opcode Fuzzy Hash: 1e9c3134e8cfd7a39aa5a38b3c83e2163aa827432d9a046d79dc1d6aaf7a349a
                                                                  • Instruction Fuzzy Hash: 9E01EF70D00219DFCB44DFA9D8419AEBBB6FF49310F10C529D559A7240D735AA02CF90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031B98 Relevance: .0, Instructions: 32COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 086f3a71d307e5372d46e427402032e6ba067e79d5204883283ce04d815a358e
                                                                  • Instruction ID: cce894d75b93ba59de5551507cc2e14f577d1d732d7bc0ce81c89b389c46a82a
                                                                  • Opcode Fuzzy Hash: 086f3a71d307e5372d46e427402032e6ba067e79d5204883283ce04d815a358e
                                                                  • Instruction Fuzzy Hash: E1F05431A001198BCB19EA59C5297FE7AFA9B8CA40F14446AD042B7380DF754D0587E5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347DDBA Relevance: .0, Instructions: 31COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 63458fd3dab4f8a7ec1b4d2b1ae8b54664a74a9e425104faa292b0ff7b8360f1
                                                                  • Instruction ID: 50664bf355c15816ecca983d7693133a75ee99415fb2f34fbb9551494dc2030f
                                                                  • Opcode Fuzzy Hash: 63458fd3dab4f8a7ec1b4d2b1ae8b54664a74a9e425104faa292b0ff7b8360f1
                                                                  • Instruction Fuzzy Hash: 95F03A6560D3C15FD303437875143E97FA2ABC3219F0D00EBC988AB2E7CA9A5819C7A6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E98F0 Relevance: .0, Instructions: 30COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c17048ae4d393e0e55992dbbf5bbf143d3c7253bce23eda7688502078d1a639e
                                                                  • Instruction ID: bf22d5ea2241238a693a2f0b036ac5edb4f7303d4a9c995e6277aa628e623bdb
                                                                  • Opcode Fuzzy Hash: c17048ae4d393e0e55992dbbf5bbf143d3c7253bce23eda7688502078d1a639e
                                                                  • Instruction Fuzzy Hash: 41E02B313091606BC7159635900595BBB17FBC6218F1405BFE4814BEC2DB355C97C3E1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03476F28 Relevance: .0, Instructions: 29COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 037cc01a020c05522cb339282b494bd4e64934fd1a8635ca7c56709d4fbf1d3c
                                                                  • Instruction ID: 4bd7db633fed17ec440f81ef354e4d071479943465824a2ddda9f6f72cd9b238
                                                                  • Opcode Fuzzy Hash: 037cc01a020c05522cb339282b494bd4e64934fd1a8635ca7c56709d4fbf1d3c
                                                                  • Instruction Fuzzy Hash: 9BF03A35A002199FCB50DFA9D805BDABBF4EB48320F104469E95DA3741D7756941CB90
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347CE50 Relevance: .0, Instructions: 29COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f924d459770d3e504863b8664fa42d3b6f8d3bf3b6b53754269e516089153f6e
                                                                  • Instruction ID: 17326911e959bedfcc7ff16c75495dd347035ff6101d7f7cb691a08efeeb9487
                                                                  • Opcode Fuzzy Hash: f924d459770d3e504863b8664fa42d3b6f8d3bf3b6b53754269e516089153f6e
                                                                  • Instruction Fuzzy Hash: D9E022313401218FC210D62CD84086AB3EDEFC5620318817AE90ADF324CE62DC85CBD9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477070 Relevance: .0, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5ff3f9a700e893fe039ddeeb26c17b73922284da147794e87f00d3e852787342
                                                                  • Instruction ID: c67a087d5c999b66f25bb20e26f4dffc05b37a69c4b35a93db9f26a8e38a5dd7
                                                                  • Opcode Fuzzy Hash: 5ff3f9a700e893fe039ddeeb26c17b73922284da147794e87f00d3e852787342
                                                                  • Instruction Fuzzy Hash: FFE0D87660E3E42F97225A363C508AB7FE8D9C617070941A7F894C7241D9688E1587F1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347CE41 Relevance: .0, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a7573da9196b34aa97821b2170d978f77af187da54cfe609707d112aacd91adb
                                                                  • Instruction ID: b0d467ddad25c4c5897b00afa5c70e0fe9a2bb372cb0608dc39313d39a48d09b
                                                                  • Opcode Fuzzy Hash: a7573da9196b34aa97821b2170d978f77af187da54cfe609707d112aacd91adb
                                                                  • Instruction Fuzzy Hash: 77F0E5392052918FC301D728D85065ABBE5EF8123130943BBE466CF3E6C726DC49C799
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470C50 Relevance: .0, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 9ee880f49f700bcde538c6898a157299e3fa48ca7b0da987815ddeb3b8ec1e2f
                                                                  • Instruction ID: 9b9ff2ab68ff0be7084671f884b8d6e80f730966a46d860c5f8fdb9a9ab75286
                                                                  • Opcode Fuzzy Hash: 9ee880f49f700bcde538c6898a157299e3fa48ca7b0da987815ddeb3b8ec1e2f
                                                                  • Instruction Fuzzy Hash: F2E06D301093A1DFEB266B74A4191D87BB8EA4632670980EBD00ADB262D62548028B56
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03477B79 Relevance: .0, Instructions: 27COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2d9e38aa849b33840682f7a1a02e9fcc585eadf08e930eb91d240348daf61d23
                                                                  • Instruction ID: 748e748535018a18b28bef149d6bcd17ea1e6dd3fc554909b95db388316d5cea
                                                                  • Opcode Fuzzy Hash: 2d9e38aa849b33840682f7a1a02e9fcc585eadf08e930eb91d240348daf61d23
                                                                  • Instruction Fuzzy Hash: B9E065325045509FC754EB18D9448D4FB76FF8131478681A7D099AF651D721AC05CBD5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347ACD7 Relevance: .0, Instructions: 26COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: f5c7f25b1db0aadaef4ba6c80d5bb253a410a639a8f5b36bad8d55ee5666aa28
                                                                  • Instruction ID: c26b675fe92d2770f476ad9d4297def7b4813546fffe5334a0af4c0b5af457cc
                                                                  • Opcode Fuzzy Hash: f5c7f25b1db0aadaef4ba6c80d5bb253a410a639a8f5b36bad8d55ee5666aa28
                                                                  • Instruction Fuzzy Hash: D5E0E50050C7C12EE712D2B465082CA6F928D8300471949EBDCA28E3EBDA51D946C2A6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034721BF Relevance: .0, Instructions: 25COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 699878f8febe9ed3d4eb55506052d1c27dea149f55e17d039178464c792ef0b0
                                                                  • Instruction ID: b1760b30851b24f6039229672cab0a37bea521bfa491281a987b87c2cad91867
                                                                  • Opcode Fuzzy Hash: 699878f8febe9ed3d4eb55506052d1c27dea149f55e17d039178464c792ef0b0
                                                                  • Instruction Fuzzy Hash: BCF01571C00269DF8B90EFA9E8846DDBBF0FF18740B204866C959EB200E3304A16CBC1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A025 Relevance: .0, Instructions: 25COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3ac378ffab5ef1c719c69553453c6b4ae1207ca28b49f0a5aee1d49859d25767
                                                                  • Instruction ID: 6194d8e929914daa6854b2c58cd5cd5cc08071bab7e1f8cce9719e9b13fe9199
                                                                  • Opcode Fuzzy Hash: 3ac378ffab5ef1c719c69553453c6b4ae1207ca28b49f0a5aee1d49859d25767
                                                                  • Instruction Fuzzy Hash: A4E0DF30311214DBDB0A2B3CA8543AD699BFBC8310F148129E4059339CDE3A8C821780
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03AB1A Relevance: .0, Instructions: 25COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 0465baf61c9ededff56596e1206b88666b3d5adec91f4af7023b90ae97a60dcb
                                                                  • Instruction ID: 5d47e6d9b0b644712a9fc144e96b8ff8338715ea4e48a43b57c43ece4b397f06
                                                                  • Opcode Fuzzy Hash: 0465baf61c9ededff56596e1206b88666b3d5adec91f4af7023b90ae97a60dcb
                                                                  • Instruction Fuzzy Hash: 57F0E5B4A09108EFCB14CB65D91864DFBFADF81202F1040ADD04887254EA315E059BE2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A5A0 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 590d81ee7d567ac6df896d59e461dcd22eb6d21c3c57fa1a90895839f9b47fb5
                                                                  • Instruction ID: d30dc1ffc5f3c9d8bde59c5f592d7367d5e0298c4d0350ed9d2d2eee7eb53825
                                                                  • Opcode Fuzzy Hash: 590d81ee7d567ac6df896d59e461dcd22eb6d21c3c57fa1a90895839f9b47fb5
                                                                  • Instruction Fuzzy Hash: 9DE0DFB2A45209AFCB81CBA4DA411AEBFB0EF45200B1006D6D488E7305EA315F058B42
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473948 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 77ef46d679069c6fcf0726af849728b6b11c3f94f711dba6d6459e868feea3a5
                                                                  • Instruction ID: a8e74aecf8e8231c3d80f8bde8478d85065b1752e4cc48027ed41aa719ab2f75
                                                                  • Opcode Fuzzy Hash: 77ef46d679069c6fcf0726af849728b6b11c3f94f711dba6d6459e868feea3a5
                                                                  • Instruction Fuzzy Hash: E4F05475404342AFC707CF28FA649053B79FB86604B056292D4A0473B6EB3C6CCADB05
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470C08 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: aebd0dd20aa16c44caca4448262a03c0f6be392a5d0320ed652b055bb38c127f
                                                                  • Instruction ID: 4f112fff6d7ca3647fe81a023c95871f69e30eb9ea83056b97109674e4393c50
                                                                  • Opcode Fuzzy Hash: aebd0dd20aa16c44caca4448262a03c0f6be392a5d0320ed652b055bb38c127f
                                                                  • Instruction Fuzzy Hash: 3BE0D8753093649FCB175B70902826DBF72AF8620570480AFD405DB359CF364C05C392
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0329D9 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2548141eef64029e519797fc80b05e90f0299e96574ee8ad7696bb4a97d8deb9
                                                                  • Instruction ID: c3abb897ffd2e7e98cb56dab7c05362d15c91edafea5a255baf5131fa70133fc
                                                                  • Opcode Fuzzy Hash: 2548141eef64029e519797fc80b05e90f0299e96574ee8ad7696bb4a97d8deb9
                                                                  • Instruction Fuzzy Hash: D5E0CD3930415457C255227DB4282EDBFAADFC792170C007FE909C7B43CE565C0643D5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03F6B0 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: cf5a422797c336eab39bba82df3381a7bdb46164614cdd4878a98e6192296216
                                                                  • Instruction ID: 3cb64c1eaeb0fd21ec6f8822d340478ff5a3e36c74457f18ee2eb58993156706
                                                                  • Opcode Fuzzy Hash: cf5a422797c336eab39bba82df3381a7bdb46164614cdd4878a98e6192296216
                                                                  • Instruction Fuzzy Hash: 85E09237B50101CFCB05CB64E8A97A8B3B5EF54B05F0440AAC5528B211CB259415CB61
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0306B0 Relevance: .0, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 95abea092f7381b46877d0302a95dd19cad809c12aed0d1485ba691f672674ce
                                                                  • Instruction ID: 23e706b99fed95941a24aea364ef3fcac51da80d5724b13e2ac1ef8c95b66753
                                                                  • Opcode Fuzzy Hash: 95abea092f7381b46877d0302a95dd19cad809c12aed0d1485ba691f672674ce
                                                                  • Instruction Fuzzy Hash: FED05B7314A660AFC2161254BC1A8F7BF7DCD475723014067F605C2B93DD552D4083F5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E9988 Relevance: .0, Instructions: 23COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 659b58cf826f0057c3087a5cd005f44a55e7b01bcc98052999f339fe9ae582f8
                                                                  • Instruction ID: 191a0cb09964d4bfa73ed9942c2f87bb3e27827dfb3ce4efc0fd362ca7bfbe56
                                                                  • Opcode Fuzzy Hash: 659b58cf826f0057c3087a5cd005f44a55e7b01bcc98052999f339fe9ae582f8
                                                                  • Instruction Fuzzy Hash: F4E08C32614028AFCE54BA89E044AA9775ADB90362F004037FA058B6C0DB76C9D48BE9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B031B40 Relevance: .0, Instructions: 23COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8ccb021651bd6a1cbdbfed2310c69f233f1134f81dc6e673cea7f2437b00c759
                                                                  • Instruction ID: 49e551b08b123dbc12a55c2a64a87e1f00e49e6c8c61041e26b3f38c8e184e32
                                                                  • Opcode Fuzzy Hash: 8ccb021651bd6a1cbdbfed2310c69f233f1134f81dc6e673cea7f2437b00c759
                                                                  • Instruction Fuzzy Hash: EAE06874300B09CFC720EB35E464AA37BE1EF84622700852DE85E839F5DB34E800D704
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E4148 Relevance: .0, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8b61366a291c1abca5c28a316dc2def97c164a2ecc04df6342a60de74876c509
                                                                  • Instruction ID: d7b5c2cf7b0397f278c8ebf7bfdee1e2af35a82e28d86183a4d345ec2f8ec1f7
                                                                  • Opcode Fuzzy Hash: 8b61366a291c1abca5c28a316dc2def97c164a2ecc04df6342a60de74876c509
                                                                  • Instruction Fuzzy Hash: 4ED0A922700524270A08219F789886FEACFEBCEAB1360043AE20EC3300CC728C0287F6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037E38 Relevance: .0, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4d4e8def70094beebc4128eeb13531d3fde73d390ed8d8a908db5b8f361576ba
                                                                  • Instruction ID: 3c11ff4ec68ed82ab8d5ef3a9da8a33546c1e9b6514d923f1d439a830459d74e
                                                                  • Opcode Fuzzy Hash: 4d4e8def70094beebc4128eeb13531d3fde73d390ed8d8a908db5b8f361576ba
                                                                  • Instruction Fuzzy Hash: 0DE0C2323102186FC300979DE408D9ABBEEEB8D720F0400A6F309C7352CAA19C018BE0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0311D0 Relevance: .0, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a1267a00d2e10a2b27984e3dd9c139137f010a276d5c24ef338a0b362a2c06ea
                                                                  • Instruction ID: f8097f7dd71b82646c75033094a0997ae62e3667d73bf32c0141650a17586410
                                                                  • Opcode Fuzzy Hash: a1267a00d2e10a2b27984e3dd9c139137f010a276d5c24ef338a0b362a2c06ea
                                                                  • Instruction Fuzzy Hash: 41E08C3015A284AF82028348A808CE2BFECFA066703198186F404C6122C621EC0287A2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032A17 Relevance: .0, Instructions: 21COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fadab763514fdba6084b2f69c828ea3d8b364caf811515a2d938540cf2bf0117
                                                                  • Instruction ID: d8ebf90dd60644ab554eaa1d1fba9715ea97f16710ce77393ed6ee879aae09f1
                                                                  • Opcode Fuzzy Hash: fadab763514fdba6084b2f69c828ea3d8b364caf811515a2d938540cf2bf0117
                                                                  • Instruction Fuzzy Hash: D1E01A31905209EFCB04DFA4E90468DBBBAEF45209B1141E9D409EB216EA312E059FE2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03AADA Relevance: .0, Instructions: 21COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: bad8260b4ded4bf510bc48a0050e9eacf3476ee4e0444349709f52b31d132be8
                                                                  • Instruction ID: ae73a236028a6e368b31601353c071447abea4c0dae89e4c89b9279c5b7b68ca
                                                                  • Opcode Fuzzy Hash: bad8260b4ded4bf510bc48a0050e9eacf3476ee4e0444349709f52b31d132be8
                                                                  • Instruction Fuzzy Hash: 45D02E327092546BDB1032AEA80183A7A9FCFC2722B29803AE405C3341CDB98C028BE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347412E Relevance: .0, Instructions: 20COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 27866da1c081b2658203eee93b54fd037d270ce74cccac6751456ebff94d9cdd
                                                                  • Instruction ID: 100125f81888818828be50f3bf21c8cc1022846ce9ea5200b9857ebb010b391d
                                                                  • Opcode Fuzzy Hash: 27866da1c081b2658203eee93b54fd037d270ce74cccac6751456ebff94d9cdd
                                                                  • Instruction Fuzzy Hash: B7F0C970944209DFDB54DF95D498BEDBBB1FF08314F20445AE421AB360C7705985CF51
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473958 Relevance: .0, Instructions: 20COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: ed8dd3f2db4acb0aa0f822c838c1c5122f44919b58bea3d68fa5cc353d30938d
                                                                  • Instruction ID: 643ca517d3175d3136dc96d706139ad02d7c8c7bd58e29f94b25daa94d340b9f
                                                                  • Opcode Fuzzy Hash: ed8dd3f2db4acb0aa0f822c838c1c5122f44919b58bea3d68fa5cc353d30938d
                                                                  • Instruction Fuzzy Hash: 03E0ED70540306AFCB0ADF18F9A4A19776EE784B44F10B160980106365BB3C7CC6DF49
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0329E8 Relevance: .0, Instructions: 20COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 797d5d9e71a5e4ea940a5fd00d1c3b314899708f4f4630a2483ed2e7705a3be7
                                                                  • Instruction ID: 3e2d78753df486b2bbe5ae968a0799e3a8430efd353ddeafe167b2f7c8a7a37e
                                                                  • Opcode Fuzzy Hash: 797d5d9e71a5e4ea940a5fd00d1c3b314899708f4f4630a2483ed2e7705a3be7
                                                                  • Instruction Fuzzy Hash: 6FD0A732300224134155315D74284AEB6EFDBC6D62304002FEE09C3380DF665C0603D5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 034721D0 Relevance: .0, Instructions: 19COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 613c001fba7cf83193bc0ee5ebb5693413567917b398040b6b846b3c9855fd58
                                                                  • Instruction ID: e5b6c0326be9af3be26d3298f2cc5e0cca2436b2550a38a84fc84fceaa4bcaaf
                                                                  • Opcode Fuzzy Hash: 613c001fba7cf83193bc0ee5ebb5693413567917b398040b6b846b3c9855fd58
                                                                  • Instruction Fuzzy Hash: FDE0B671D0421DDF8B90EFE9E9055EEBBF4EB08650B20446AD929E7200E2305B11CFD1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347082F Relevance: .0, Instructions: 18COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a86fd66bf0d2791b92b269510cf4aa5ef632bbce45e208e11bcb260e1210daa4
                                                                  • Instruction ID: 24dbe1153831be00a15d0fc3a15b5ca62b65a94b3055c1ec1c3132fc82bd7639
                                                                  • Opcode Fuzzy Hash: a86fd66bf0d2791b92b269510cf4aa5ef632bbce45e208e11bcb260e1210daa4
                                                                  • Instruction Fuzzy Hash: 12D0C73185D384AFCB8247706D560847FB8EB56514B1DC1EFD04597163D6765506CB11
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470C18 Relevance: .0, Instructions: 18COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3a2b8f9418cc22f39bfd11f958442f71307853fbd7f42dd97e192b0d922a101b
                                                                  • Instruction ID: 0deaa9650b85461bea71a5b70d56117de60f8b562ed7ae88e17e42284d172eff
                                                                  • Opcode Fuzzy Hash: 3a2b8f9418cc22f39bfd11f958442f71307853fbd7f42dd97e192b0d922a101b
                                                                  • Instruction Fuzzy Hash: 5AD0A7B570433857C71A7771E01C26DBA9BEBC5625B04442DDA0AD7348CF368C0143D6
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473908 Relevance: .0, Instructions: 17COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 5ad8949859a388a30e46e1249319ff9fe51633fb15e0b7acc61b1cee2bee2b44
                                                                  • Instruction ID: 7b292d699d0e1abeb599f1285da72e3869c1fb054932e37084378b9464d67d68
                                                                  • Opcode Fuzzy Hash: 5ad8949859a388a30e46e1249319ff9fe51633fb15e0b7acc61b1cee2bee2b44
                                                                  • Instruction Fuzzy Hash: 65E012344143849FC7459F34E9A65A93F69EB91500F0496A7D4A593262EF354D029F21
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347FF67 Relevance: .0, Instructions: 17COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 10c09ec441557aeb8cc4cad54602bd6e0268cb61cb32f84a18f32b4321c4a8e3
                                                                  • Instruction ID: 3895fca51c253bf942218ef147fc65d0d1f54d19de2d886c4bf709ea15a2ff91
                                                                  • Opcode Fuzzy Hash: 10c09ec441557aeb8cc4cad54602bd6e0268cb61cb32f84a18f32b4321c4a8e3
                                                                  • Instruction Fuzzy Hash: A6D0A7302082816FC70F4B2588901457FB6AA423007154C9E5084C76C3D72C8405C690
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0329A0 Relevance: .0, Instructions: 17COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6a03bcc418c2eb414d6702e6a06f49faa7f85c2c13ffbbe4468cac41dc35a40b
                                                                  • Instruction ID: 826d1b74020b227d99cf507641409cbc257d44169fe468128fe1531f713ad0df
                                                                  • Opcode Fuzzy Hash: 6a03bcc418c2eb414d6702e6a06f49faa7f85c2c13ffbbe4468cac41dc35a40b
                                                                  • Instruction Fuzzy Hash: 85D0A732719308DBDF4C5A70B879AF6379EDB84911700046AE55697940EE19FC4456A1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03479658 Relevance: .0, Instructions: 16COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 37dcb831ae6e0d903ae6f74266298174d0be72160c8f47046281b45db75bbf5f
                                                                  • Instruction ID: c8754e6b757d2e7b5b75e3a83ba6fd5f692cc13e65534892bee8c4c047d3a76f
                                                                  • Opcode Fuzzy Hash: 37dcb831ae6e0d903ae6f74266298174d0be72160c8f47046281b45db75bbf5f
                                                                  • Instruction Fuzzy Hash: C0D05EB0A0020DEFCB00DFA8EA4155DFBB9EB44200B6082E9D808E3300EB356F049B82
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347A5B0 Relevance: .0, Instructions: 16COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 8df5c13ea046bd5666c43443e158519e22f3ebb86f36963ae75da0a1caef83c5
                                                                  • Instruction ID: cfa9fc30fc2512f57fe0887176c1ea4409af04a66d11a3b70e4fc931bac4fbb1
                                                                  • Opcode Fuzzy Hash: 8df5c13ea046bd5666c43443e158519e22f3ebb86f36963ae75da0a1caef83c5
                                                                  • Instruction Fuzzy Hash: 75D05E70A0120DEFCB40DFE8EA4659DBBF9EB44200B1051A9D448D3304EE316F00DB81
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03AB28 Relevance: .0, Instructions: 16COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 76d0d1728b6e0ae051b1077f9b4f4e4bb88596e2705906cef03e67ca66297e08
                                                                  • Instruction ID: c06e4d7c2c2a80d581abc9212747d500066e97a36de51d93140672460486b65f
                                                                  • Opcode Fuzzy Hash: 76d0d1728b6e0ae051b1077f9b4f4e4bb88596e2705906cef03e67ca66297e08
                                                                  • Instruction Fuzzy Hash: 2CD05E70A0120DEFCB40DFA9EA4959DBBFAEF45205F1041A8D509D7300EA326F049F92
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B032A28 Relevance: .0, Instructions: 16COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: dd44d31b94953bf508eaac58aeeac1db55e3cd6344896c2bb75ba6e29b93d520
                                                                  • Instruction ID: 86f63518b1be2073197b704bd95f768839091581ed5084f3363efa90a64e6e8d
                                                                  • Opcode Fuzzy Hash: dd44d31b94953bf508eaac58aeeac1db55e3cd6344896c2bb75ba6e29b93d520
                                                                  • Instruction Fuzzy Hash: 12D05E70A0520DEFCB40DFA8EA0059DB7FAEB49209B1081A8D409E7304EA316F049FD1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03C27F Relevance: .0, Instructions: 15COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6268767fd69e3e6fec331db38b66daddbe4af42bfccda722042d18f262d8fc1f
                                                                  • Instruction ID: 1eb749164a9e812f6ae58e337639b2be43381b0a6ce527d2efec5f34c9cf7571
                                                                  • Opcode Fuzzy Hash: 6268767fd69e3e6fec331db38b66daddbe4af42bfccda722042d18f262d8fc1f
                                                                  • Instruction Fuzzy Hash: B8E01271A1030FCBEB288FD1C499AAE7776FB04708F204415C412FA244DBB55506CF91
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347FF90 Relevance: .0, Instructions: 14COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 02b1cae99c2aa3d6eff51caa44f3ce3cd4e4b52402c76109c15a7555fe7b57f5
                                                                  • Instruction ID: 7b6f66ac16e75823d315ece47042ea07862c5b3bdd13c908c662a687156eaf09
                                                                  • Opcode Fuzzy Hash: 02b1cae99c2aa3d6eff51caa44f3ce3cd4e4b52402c76109c15a7555fe7b57f5
                                                                  • Instruction Fuzzy Hash: E7D0223000D345CFC303AB64A8944403F3EFE01308381948AF0848996BEB28096DC3E2
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0329B0 Relevance: .0, Instructions: 14COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 70f64430a263636318bbd127dc5d8f3a8a4690646872d937f511f7258fecaa8e
                                                                  • Instruction ID: fa739f5f16283605bd7ebe1e810a031d795405c566da40ab18205f7ac388d485
                                                                  • Opcode Fuzzy Hash: 70f64430a263636318bbd127dc5d8f3a8a4690646872d937f511f7258fecaa8e
                                                                  • Instruction Fuzzy Hash: 68D0C930304208DBCA88DAA5E469979779A9B88915314886E980ACB241DE26E8029650
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037E97 Relevance: .0, Instructions: 14COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 4fa5c6648c027d171ad34d4221b1e2a2c4b171d17761da3c83b94b9761538cb3
                                                                  • Instruction ID: ef089ea3538cb8b2131dc1aaf2916809586afeb7d4d6721f121db550da5a9362
                                                                  • Opcode Fuzzy Hash: 4fa5c6648c027d171ad34d4221b1e2a2c4b171d17761da3c83b94b9761538cb3
                                                                  • Instruction Fuzzy Hash: 5EC0123269810A8FC301926CF858A9A7B6EC784304F109435B00CCB74AEE6AE95B45E9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0311E0 Relevance: .0, Instructions: 12COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 171472b0b04f71bf5bad63a305f25a7a10e2f58ae2c1945dc9f651a216a5a84a
                                                                  • Instruction ID: a38306cc037dd4ab86a6f02fef6caa636105e4ba6bd49c5b1b7ebd90d51ce794
                                                                  • Opcode Fuzzy Hash: 171472b0b04f71bf5bad63a305f25a7a10e2f58ae2c1945dc9f651a216a5a84a
                                                                  • Instruction Fuzzy Hash: BAD01230165148CBC244DB4CE88D8D57BEDF748A14764C240F0188B321CB76FC03CB80
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033508 Relevance: .0, Instructions: 12COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: fb219f62f5dc58e243bb828e8e2fabfe07f1d8d8b1aa6d4380a4642a36c0692a
                                                                  • Instruction ID: f382e242474ae69196b49d277704556887f6a68b98e66514394ee9c49e6a774a
                                                                  • Opcode Fuzzy Hash: fb219f62f5dc58e243bb828e8e2fabfe07f1d8d8b1aa6d4380a4642a36c0692a
                                                                  • Instruction Fuzzy Hash: A2C08CF110834AAFC7215B24F905A567F8EDB90308F609932E0C94A219EA7AAD564BF1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03473918 Relevance: .0, Instructions: 11COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: a1abfafdf1cf1af7e1f172064af9b814949fa208ac843639737b38078dacc58e
                                                                  • Instruction ID: 218a9b09d3e0dd5742c1d13f31b3e2df51fcd10294a2e2109e746dfee88e8e48
                                                                  • Opcode Fuzzy Hash: a1abfafdf1cf1af7e1f172064af9b814949fa208ac843639737b38078dacc58e
                                                                  • Instruction Fuzzy Hash: 51C08034110208CFC304EF74F51651D7F5DE744600F408661E50D82254FF3C6C004F62
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037E70 Relevance: .0, Instructions: 11COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 3d9e424d09c4fb9e868d5403813101d730c491915818ef02ed1fcb2415fcd245
                                                                  • Instruction ID: 1471bdc82da0b99a5cb9d1e18a7cffd66002f8f9b210fa1849901741b09116e0
                                                                  • Opcode Fuzzy Hash: 3d9e424d09c4fb9e868d5403813101d730c491915818ef02ed1fcb2415fcd245
                                                                  • Instruction Fuzzy Hash: A8C04CB1A591419FDF0AA22899609DB1B66D795304F1144A6B048CB69AD925CC0782F5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0306C0 Relevance: .0, Instructions: 11COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e37da944ca093096ba1a04cf900dff0ab418cd408048a12699980704375c4768
                                                                  • Instruction ID: 74389648f1a335291abcb4841330b1c0fd230a68af95a390ee62459c987f7721
                                                                  • Opcode Fuzzy Hash: e37da944ca093096ba1a04cf900dff0ab418cd408048a12699980704375c4768
                                                                  • Instruction Fuzzy Hash: B5C04C32648524DB86146659F41989AFFAEDB99A72300842BFA0A83B418F756D1086D9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B0334E0 Relevance: .0, Instructions: 10COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 979263f36238408450df940dbb65edc3fa44b54e84e6ab93039d545e37c9e191
                                                                  • Instruction ID: ffd8c70f299847ad9caa51b6f3d7ac199e4cbb5957e7c83d001d29292bf8b4be
                                                                  • Opcode Fuzzy Hash: 979263f36238408450df940dbb65edc3fa44b54e84e6ab93039d545e37c9e191
                                                                  • Instruction Fuzzy Hash: 36C08CE1A08140DBDB228604C6207DB2B47C7E0304F10881690C90B788E429EC0682E0
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 063E44A0 Relevance: .0, Instructions: 9COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 082b65b3c3a791b62585b9d4e280242761296a1a94d0abb802c31dba7f4a81cc
                                                                  • Instruction ID: 28ca88b75ae283752237b6fa357e1283e157b717aeccd2820e701982094b3732
                                                                  • Opcode Fuzzy Hash: 082b65b3c3a791b62585b9d4e280242761296a1a94d0abb802c31dba7f4a81cc
                                                                  • Instruction Fuzzy Hash: B6C02BF25091017ADF120720DD05B0E7E5A5B10702F555C13F244C0082CE294075F363
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037440 Relevance: .0, Instructions: 9COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6f4ef29c0189e055101d650bcdf2ffdd335c295df83ee707bad73fb6db025d95
                                                                  • Instruction ID: 9509f64653963ccce995e40b3fb4ea09d8cbc25cfd8ee19050c2a5ef109de91c
                                                                  • Opcode Fuzzy Hash: 6f4ef29c0189e055101d650bcdf2ffdd335c295df83ee707bad73fb6db025d95
                                                                  • Instruction Fuzzy Hash: 11C0123190D3806FD30357144919B947FE09B11300F05406EB288C6492C2664890D753
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347C9F0 Relevance: .0, Instructions: 8COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e3d2dffa4ba48cdf56d56311812e78e86a8e7690e145097affeee87b61b11674
                                                                  • Instruction ID: c4d0545667515dfa19b1d51878c0cfc2e173ce9cf706cc443339481bc09c3f5c
                                                                  • Opcode Fuzzy Hash: e3d2dffa4ba48cdf56d56311812e78e86a8e7690e145097affeee87b61b11674
                                                                  • Instruction Fuzzy Hash: FEC09234240208CFC304DF59D585C10BBE8FF49A0835940D8E5098B732CB22FC01CA80
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B039F30 Relevance: .0, Instructions: 8COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 770e2a8e65652ab22b9ba468e4cc7ed408a7ce1de34032491484dd35669f6fe3
                                                                  • Instruction ID: 81b6cde9062512db4963057d766a392bab2ae2a682b622873d095b62c3e519e9
                                                                  • Opcode Fuzzy Hash: 770e2a8e65652ab22b9ba468e4cc7ed408a7ce1de34032491484dd35669f6fe3
                                                                  • Instruction Fuzzy Hash: 8CB09B5670924057DF141510E85816A3E1B5BD5252F34487950A502344C535D80686D5
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0347FFA0 Relevance: .0, Instructions: 7COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 35e97fbe8a2a3123a01a6bc2f377945fa471e8965b791752a3d29e67a17be31d
                                                                  • Instruction ID: 9142e46ff348d457aa9b1119a6cc076b7cc14d210a55aba38ed8fffe8ebc4798
                                                                  • Opcode Fuzzy Hash: 35e97fbe8a2a3123a01a6bc2f377945fa471e8965b791752a3d29e67a17be31d
                                                                  • Instruction Fuzzy Hash: 5EB0123104430ECFC600F754F444615772EE54031CB409524A10C056197B6CAD4C86D9
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B037EA8 Relevance: .0, Instructions: 7COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 09f06eb92b572bb2bd5d2d4adfdebd4e94197f3afec4052c8e3c1b866c13fea4
                                                                  • Instruction ID: 2a78e32dc50357be2ff30a980a2dc05819b7f2a5cc11f61daa10ced407c36d31
                                                                  • Opcode Fuzzy Hash: 09f06eb92b572bb2bd5d2d4adfdebd4e94197f3afec4052c8e3c1b866c13fea4
                                                                  • Instruction Fuzzy Hash: 05B0123204020DCFC700A764F404909B73DD640308B40A530E10D05619FAADAD484AE4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B033518 Relevance: .0, Instructions: 7COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: bd87f5a93b5e17dce92668121e5176574fbf32d9ca90581f3fa656aa9c33be8e
                                                                  • Instruction ID: 8e74bbe60768b88ef96304bcd828c87259623ea6e2331173e901c773ccf6716c
                                                                  • Opcode Fuzzy Hash: bd87f5a93b5e17dce92668121e5176574fbf32d9ca90581f3fa656aa9c33be8e
                                                                  • Instruction Fuzzy Hash: 58B0123004420ECFC700AB54F405904775DE740308B409630E10D06115EB796C444AF4
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 03470850 Relevance: .0, Instructions: 5COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2912041834.0000000003470000.00000040.00000800.00020000.00000000.sdmp, Offset: 03470000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_3470000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c03e79998e852c85a819f74ecc30a1d74c7f80646d195dd5aeadfe8fe1ccf2dc
                                                                  • Instruction ID: 68533f051623535abcd20266757471f9d5d47cd06ba9e2aee78e9fb18055fd76
                                                                  • Opcode Fuzzy Hash: c03e79998e852c85a819f74ecc30a1d74c7f80646d195dd5aeadfe8fe1ccf2dc
                                                                  • Instruction Fuzzy Hash: 9F90023104C60C9B4D5027D5B40A555B79C96495157844055B50D875065AA5B4104796
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Non-executed Functions

                                                                  Function 063E6588 Relevance: 13.9, Strings: 11, Instructions: 146COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2921554967.00000000063E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063E0000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_63e0000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: $&_q$4c^q$4c^q$4c^q$4c^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                                  • API String ID: 0-157140308
                                                                  • Opcode ID: b7f6c94ce65c63af0f6630520b36a85ad4158c0a38564663710e6193fcdc3aa8
                                                                  • Instruction ID: 22b8f26fb137f4753199317d647374fa86980524f8f1d2141730d7093fd1f777
                                                                  • Opcode Fuzzy Hash: b7f6c94ce65c63af0f6630520b36a85ad4158c0a38564663710e6193fcdc3aa8
                                                                  • Instruction Fuzzy Hash: B4519E71F201298FCB589F29C81456DB7BABFA6700B240969D406AF3A4DE31DC05CBE1
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%

                                                                  Function 0B03D500 Relevance: 7.6, Strings: 6, Instructions: 117COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000001.00000002.2926322286.000000000B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B030000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_1_2_b030000_3Shape Unite Installer.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: (bq$,bq$,bq$Hbq$`]cq$`]cq
                                                                  • API String ID: 0-2072144370
                                                                  • Opcode ID: 06e0c0c09cbae942ce5f73dd5567a361bd4c280fa8c23e69ce0bc0c60e137d0a
                                                                  • Instruction ID: 5e882238e6995fc6a6c0a0581b2f25d640cd7c66d485ce4d0fd847d0fd94ebff
                                                                  • Opcode Fuzzy Hash: 06e0c0c09cbae942ce5f73dd5567a361bd4c280fa8c23e69ce0bc0c60e137d0a
                                                                  • Instruction Fuzzy Hash: DD310571B441188FCB68AB2CD01C46E3BEAEF89A6173006BAD006DB7A4CE31DC41CB85
                                                                  Uniqueness

                                                                  Uniqueness Score: -1.00%