Overview

overview

8

Static

static

3

ControlSpa....4.exe

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

DanteServices.exe

windows10-2004-x64

7

VC_redist.x86.exe

windows10-2004-x64

4

bin/CC-xD_update.dll

windows10-2004-x64

3

bin/CC64Pr...er.exe

windows10-2004-x64

3

bin/CC64Up...ty.exe

windows10-2004-x64

3

bin/CSDesigner.exe

windows10-2004-x64

5

bin/CSupdate.exe

windows10-2004-x64

3

bin/CalcEQ...es.exe

windows10-2004-x64

3

bin/CalcEs...es.exe

windows10-2004-x64

3

bin/CalcEs...es.exe

windows10-2004-x64

3

bin/CalcEs...es.exe

windows10-2004-x64

3

bin/DotNetMagic.dll

windows10-2004-x64

1

bin/Newton...on.dll

windows10-2004-x64

1

bin/Northw...ut.dll

windows10-2004-x64

1

bin/Northwoods.Go.dll

windows10-2004-x64

1

bin/PSXSer...er.exe

windows10-2004-x64

3

bin/System...ty.dll

windows10-2004-x64

1

bin/Tftp.Net.dll

windows10-2004-x64

1

bin/UsbDll.dll

windows10-2004-x64

3

bin/Utilit...te.dll

windows10-2004-x64

3

bin/Utilit...r2.exe

windows10-2004-x64

3

bin/Utilit....0.exe

windows10-2004-x64

3

bin/WpfCon...ry.dll

windows10-2004-x64

1

bin/Xceed....it.dll

windows10-2004-x64

1

bin/bose_d...ib.exe

windows10-2004-x64

3

bin/cab32.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    298s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/07/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ControlSpace Designer 5.15.4.exe
  • Size 237.1MB
  • Sample260707-rntphsbw21
  • SHA256 cd5aee67967487a91985c72fd91c4e2bc90ffd53dbe393d32ecf1c761ae67bca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceransomware

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ControlSpace Designer 5.15.4.exe
    "C:\Users\Admin\AppData\Local\Temp\ControlSpace Designer 5.15.4.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM PSXServiceLauncher.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4392
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM PSXService.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:6048
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM PSXProxy.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\VC_redist.x86.exe
      "C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\VC_redist.x86.exe" /q /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3256
      • C:\Windows\Temp\{2AF4E09E-05DE-41A3-8D67-3C424CAB73D4}\.cr\VC_redist.x86.exe
        "C:\Windows\Temp\{2AF4E09E-05DE-41A3-8D67-3C424CAB73D4}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:432
    • C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\DanteServices.exe
      "C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\DanteServices.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\Temp\{DF3F9F6E-5E1D-4C21-9233-1C190BF541AA}\.cr\DanteServices.exe
        "C:\Windows\Temp\{DF3F9F6E-5E1D-4C21-9233-1C190BF541AA}\.cr\DanteServices.exe" -burn.clean.room="C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\DanteServices.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /quiet /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\Temp\{23E67F0E-187D-458E-B7FB-CF049E597E37}\.be\DanteServices.exe
          "C:\Windows\Temp\{23E67F0E-187D-458E-B7FB-CF049E597E37}\.be\DanteServices.exe" -q -burn.elevated BurnPipe.{1AE35411-0530-4D74-8B77-F3014613BD04} {3AC00EEC-6E2C-47B2-88C5-B4FB2D94EE18} 1712
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:792
    • C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Bose USB Driver\x64\dpinst.exe
      "C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Bose USB Driver\x64\dpinst.exe" /SW
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3136
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'ControlSpace Designer' -Direction Inbound -DisplayName 'ControlSpace Designer (TCP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\CSDesigner.exe' -Protocol TCP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'ControlSpace Designer' -Direction Inbound -DisplayName 'ControlSpace Designer (UDP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\CSDesigner.exe' -Protocol UDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'Bose Professional Dante Support' -Direction Inbound -DisplayName 'Bose Professional Dante Support (TCP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\bose_dante_lib.exe' -Protocol TCP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5792
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'Bose Professional Dante Support' -Direction Inbound -DisplayName 'Bose Professional Dante Support (UDP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\bose_dante_lib.exe' -Protocol UDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5696
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'PowerShareX Service' -Direction Inbound -DisplayName 'PowerShareX Service (TCP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXService.exe' -Protocol TCP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1176
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'PowerShareX Service' -Direction Inbound -DisplayName 'PowerShareX Service (UDP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXService.exe' -Protocol UDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5300
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'PowerShareX Proxy' -Direction Inbound -DisplayName 'PowerShareX Proxy (TCP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXProxy.exe' -Protocol TCP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5344
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "New-NetFirewallRule -Action Allow -Description 'PowerShareX Proxy' -Direction Inbound -DisplayName 'PowerShareX Proxy (UDP-In)' -EdgeTraversalPolicy Allow -Profile Any -Program 'C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXProxy.exe' -Protocol UDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3548
    • C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXServiceLauncher.exe
      "C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXServiceLauncher.exe" -rel
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /F /TN "ControlSpace Designer" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE07.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5484
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5264
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5812
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5dfdeca9-adef-544e-aaaa-49979bdf112b}\bosebulkusb.inf" "9" "4585c86a3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\bose professional\controlspace 5.15.4\bin\bose usb driver\x64"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{cb930944-4927-1142-b7d7-46ce5c25b18c} Global\{917f143a-705f-404c-8b17-028ee96cecf8} C:\Windows\System32\DriverStore\Temp\{92598bce-25bf-1343-b60f-38b6b5b64a9c}\bosebulkusb.inf C:\Windows\System32\DriverStore\Temp\{92598bce-25bf-1343-b60f-38b6b5b64a9c}\BoseBulkUSB.cat
        3⤵
          PID:5172

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DanteServices.exe
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\DanteServices.exe
          • Size 1.9MB
          • SHA256 d16d6659d76f70f14f6a990dc9e2ecfdc3e8027553f8cf814726a6944bb96f73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\VC_redist.x86.exe
          • Size 13.7MB
          • SHA256 e59ae3e886bd4571a811fe31a47959ae5c40d87c583f786816c60440252cd7ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dpinst.exe
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Bose USB Driver\x64\dpinst.exe
          • Size 660KB
          • SHA256 706863f230f6dccb2b9c346e917f686f38a9a112c884790266b09d29da2301f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          firmware1_v3.dat
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\IOCardPgm\Type0B\firmware1_v3.dat
          • Size 6KB
          • SHA256 36f224e38f04a36a6076c39aa00d298dc0ea1c9996f895f87ceb7882d716bd5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          category_forum.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\category_forum.ico
          • Size 9KB
          • SHA256 3248d00bfe5da713886af967994cd3fd04aede9c87dcb304f8be5dd6c2f49b43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          input_dynamic_mic.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\input_dynamic_mic.ico
          • Size 11KB
          • SHA256 d0a8ed23bea913012c495283ce232535f28d4020a101afe19f48e26a2c3ba4f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speaker_dm2s.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_dm2s.ico
          • Size 9KB
          • SHA256 7bd16454eedc2c315771a2621cb62bc3b7d33540fa6d2e3facf25fe023afba65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speaker_ds100SE.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_ds100SE.ico
          • Size 9KB
          • SHA256 b3edc3f4b588e825c4a64cddb7bffc60a1ee48238533c538dbdfc92d9b8def51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speaker_em180.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_em180.ico
          • Size 3KB
          • SHA256 fa71d9008280965f68cbf512a7cf1651f60c92d2bc4c1ad70612a6203e9cca4a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          speaker_p6400.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_p6400.ico
          • Size 9KB
          • SHA256 aec300e2e68ed4c86c4cb142abe36d6b1c8a4a603c40e005d970074ab0fc8869
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speaker_p6403.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_p6403.ico
          • Size 7KB
          • SHA256 9fd482f9bcca895cc00dfc2bc4e9157c8a5a949a234af4de291afd571144551d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          speaker_sm_module.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\speaker_sm_module.ico
          • Size 9KB
          • SHA256 85adf820f7262ea4dea2358512d69dd35b3cd2fa7e9cab051ea6be765e8a768b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          video_exuc.ico
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\Images\Nodes\video_exuc.ico
          • Size 9KB
          • SHA256 a256f9175e4f60af5efa3f7edbd3d2683801dcd33aebaf97623dfd7d4bae101c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PSXServiceLauncher.exe
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXServiceLauncher.exe
          • Size 26KB
          • SHA256 fc0f80afe550833587d07170a2ff85de1ed0c5b8a05ceb779697dca8de1a1087
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PSXServiceLauncherTask.xml
          • Path C:\Program Files (x86)\Bose Professional\ControlSpace 5.15.4\bin\PSXServiceLauncherTask.xml
          • Size 3KB
          • SHA256 04c84cfee1f0db2a534f959a92f7d1dea7f04260d23b70bba8004ffbf679cb86
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 6724a77ba8994f772b52302ad7dc19061f53130d1f601f606d1ff7929932d3c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 10a5d208419e5169060b7ffce2677630056e2d0a51d77c5f982035605a7904bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 9eeed65ae1d1ede84f1d71549bec124ee5046b362f4f79bd65a1e1ec8601dfde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 7d661fd90606a7953d8ee051550f6123db8e6e8a23d6f258e82d8cee2b1ed339
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 bf3b95ef0e6da10c229de45f47e86ae903acffcbed2138e033bfe06e08a9431f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 073718296e5a700a0539922845b4488eed958e5df9c7cf3e72c56935b129ba22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 55474f7bc897788d66f801c10445f3343b7e14a05e2bcf2a62e37a330b8875b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 0fd20dcc0ca6ef22c7586be45ed3260cc422d95e6cbdfb3beb1c45803471c83c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_1hnrm3qy.e4w.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hnrm3qy.e4w.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\System.dll
          • Size 12KB
          • SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\modern-wizard.bmp
          • Size 51KB
          • SHA256 7f8d56fd74a8fd413051b5eeda58b44a586849caac65aedd9be7028035dddfbb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\nsExec.dll
          • Size 7KB
          • SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          registry.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsj41C9.tmp\registry.dll
          • Size 24KB
          • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmpBE07.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\tmpBE07.tmp
          • Size 1KB
          • SHA256 6b89ce81bef21c7e5e12d9c7a946f5e1b86d60a2f18d4057dd7a0e5a8267d40d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 37KB
          • SHA256 4bf892733b50751734407b7a871333059fc570101c19492757af8db239c0df97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{23E67F0E-187D-458E-B7FB-CF049E597E37}\.ba\logo.png
          • Size 852B
          • SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{23E67F0E-187D-458E-B7FB-CF049E597E37}\.ba\wixstdba.dll
          • Size 184KB
          • SHA256 2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x86.exe
          • Path C:\Windows\Temp\{2AF4E09E-05DE-41A3-8D67-3C424CAB73D4}\.cr\VC_redist.x86.exe
          • Size 632KB
          • SHA256 4b1bf90a0e4e3a628613c2fe42ddba589ee6303e37ccc70cf99ddc92dde03b0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{921E13C2-AFE8-42D0-A77B-5986757DFEE3}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{921E13C2-AFE8-42D0-A77B-5986757DFEE3}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DanteServices.exe
          • Path C:\Windows\Temp\{DF3F9F6E-5E1D-4C21-9233-1C190BF541AA}\.cr\DanteServices.exe
          • Size 573KB
          • SHA256 78d8ca9250f19deaabc8dce32ace8ac1e4ff0b2b778484ed9c205da26dfee10a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BOSEBU~1.CAT
          • Path \??\c:\PROGRA~2\BOSEPR~1\CONTRO~1.4\bin\BOSEUS~1\x64\BOSEBU~1.CAT
          • Size 12KB
          • SHA256 99320b1c8dd2dca2e534239e2686255c030b2ad0964795099688cabb013aed54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BOSEBU~1.DLL
          • Path \??\c:\PROGRA~2\BOSEPR~1\CONTRO~1.4\bin\BOSEUS~1\x64\BOSEBU~1.DLL
          • Size 76KB
          • SHA256 3fc8bf013bbe0028f6d1c262944e0e7cfb5d4c746d42ae017c2e0aa05533d843
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WDFCOI~1.DLL
          • Path \??\c:\PROGRA~2\BOSEPR~1\CONTRO~1.4\bin\BOSEUS~1\x64\WDFCOI~1.DLL
          • Size 1.6MB
          • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WINUSB~1.DLL
          • Path \??\c:\PROGRA~2\BOSEPR~1\CONTRO~1.4\bin\BOSEUS~1\x64\WINUSB~1.DLL
          • Size 979KB
          • SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WUDFUP~1.DLL
          • Path \??\c:\PROGRA~2\BOSEPR~1\CONTRO~1.4\bin\BOSEUS~1\x64\WUDFUP~1.DLL
          • Size 2.1MB
          • SHA256 015f26bbcd619a0b67b5eaa985b69582bac27d5cbca99ce747a76532fcde4aff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bosebulkusb.inf
          • Path \??\c:\program files (x86)\bose professional\controlspace 5.15.4\bin\bose usb driver\x64\bosebulkusb.inf
          • Size 2KB
          • SHA256 ec416cad8229fc6f65385f1ec942f383839b5198364cf41434f8938c1f20b2cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1176-1250-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/1648-34-0x0000000003200000-0x0000000003259000-memory.dmp
          Download

          memory/1840-1155-0x0000000006340000-0x000000000635E000-memory.dmp
          Download

          memory/1840-1157-0x0000000006920000-0x0000000006952000-memory.dmp
          Download

          memory/1840-1173-0x00000000078B0000-0x00000000078BE000-memory.dmp
          Download

          memory/1840-1168-0x0000000007CB0000-0x000000000832A000-memory.dmp
          Download

          memory/1840-1170-0x00000000076D0000-0x00000000076DA000-memory.dmp
          Download

          memory/1840-1167-0x0000000007540000-0x00000000075E3000-memory.dmp
          Download

          memory/1840-1171-0x0000000007900000-0x0000000007996000-memory.dmp
          Download

          memory/1840-1166-0x0000000007510000-0x000000000752E000-memory.dmp
          Download

          memory/1840-1142-0x0000000002A20000-0x0000000002A56000-memory.dmp
          Download

          memory/1840-1158-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/1840-1172-0x0000000007870000-0x0000000007881000-memory.dmp
          Download

          memory/1840-1169-0x0000000007670000-0x000000000768A000-memory.dmp
          Download

          memory/1840-1143-0x0000000005520000-0x0000000005B48000-memory.dmp
          Download

          memory/1840-1156-0x0000000006390000-0x00000000063DC000-memory.dmp
          Download

          memory/1840-1144-0x0000000005BC0000-0x0000000005BE2000-memory.dmp
          Download

          memory/1840-1174-0x00000000079A0000-0x00000000079BA000-memory.dmp
          Download

          memory/1840-1154-0x0000000005E70000-0x00000000061C4000-memory.dmp
          Download

          memory/1840-1146-0x0000000005D00000-0x0000000005D66000-memory.dmp
          Download

          memory/1840-1145-0x0000000005C90000-0x0000000005CF6000-memory.dmp
          Download

          memory/2192-1326-0x0000000000810000-0x000000000081A000-memory.dmp
          Download

          memory/3548-1311-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/5248-1189-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/5300-1270-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/5344-1290-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/5696-1230-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download

          memory/5696-1221-0x0000000005730000-0x0000000005A84000-memory.dmp
          Download

          memory/5792-1209-0x00000000700D0000-0x000000007011C000-memory.dmp
          Download