Analysis

  • user interaction
    yes
  • max time kernel
    210s
  • max time network
    206s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 08:32

General

  • Target
    DOpusInstall-13.25.exe
  • Size 28.1MB
  • Sample260925-kfb16scc46
  • SHA256 41fdf3c800f61aebdeec054ab3e43f176a1798cda23c2a953cfc8bff7e6c4975
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies Control Panel 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOpusInstall-13.25.exe
    "C:\Users\Admin\AppData\Local\Temp\DOpusInstall-13.25.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\is-UAUWX2L33N.tmp\DOpusInstall-13.25.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UAUWX2L33N.tmp\DOpusInstall-13.25.tmp" /SL5="$40114,27810859,924672,C:\Users\Admin\AppData\Local\Temp\DOpusInstall-13.25.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:240
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopushlp.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1524
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll"
        3⤵
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2316
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GPSoftware\Directory Opus\dopuslib32.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1996
      • C:\Users\Admin\AppData\Local\Temp\is-R5ID1FCULM.tmp\SetAppUserModelId-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-R5ID1FCULM.tmp\SetAppUserModelId-x64.exe" /cert2:0:328248 13100 "C:\Program Files\GPSoftware\Directory Opus"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • NTFS ADS
        PID:1680
      • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
        "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /fixappname
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1904
      • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
        "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /runstd:"C:\Program Files\GPSoftware\Directory Opus\dopus.exe" /ignoresetup autolister=layout
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5872
  • C:\Program Files\GPSoftware\Directory Opus\dopus.exe
    "C:\Program Files\GPSoftware\Directory Opus\dopus.exe" /ignoresetup autolister=layout
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Modifies Control Panel
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:1244
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1696
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /testdarkmode
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4260
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /getsystemdpi
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:6012
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:1244,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5572
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:1244,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2080
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:1244,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1216
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /dblclk
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:5456
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:1244
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2444
  • C:\Program Files\GPSoftware\Directory Opus\dopus.exe
    "C:\Program Files\GPSoftware\Directory Opus\dopus.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5876
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5876,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2616
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5876,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2568
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /testdarkmode
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5008
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5876,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3880
    • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
      "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /crashhandler:5876,restart
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1800
  • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopus.exe
    C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopus.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe
      C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe /crashhandler:5124
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4940
    • C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe
      "C:\PROGRA~1\GPSOFT~1\DIRECT~1\dopusrt.exe" /testdarkmode
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4412
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4536
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
      1⤵
        PID:476
      • C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
        "C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe" /dblclk
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1428
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
        1⤵
          PID:4748
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
          1⤵
            PID:2620
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004FC
            1⤵
              PID:1192
            • C:\Windows\System32\ShellHost.exe
              "C:\Windows\System32\ShellHost.exe"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:3584

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  english.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\Language\english.dll
                  • Size 1.1MB
                  • SHA256 8fbed57516e7f34ee46cb377fc66c242970dbdfed133c17262225cb40ca9fd7f
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  audiotags.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\Viewers\audiotags.dll
                  • Size 300KB
                  • SHA256 af656d0a2eeeb7f80cd657142d0f886c9384a7e21e62d2dd3eae3b963232c0d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dcrawrap.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\Viewers\dcrawrap.dll
                  • Size 2.3MB
                  • SHA256 8942ec8e9b7199c6c24e779b7452d8bd4981665628893a039a0952cfd6a29126
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  docs.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\Viewers\docs.dll
                  • Size 569KB
                  • SHA256 78fdd67b11eb9cd3f55ec96f87a8cd2565dd701d26579e89360c613e3d1a8b6c
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  gifanim.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\Viewers\gifanim.dll
                  • Size 374KB
                  • SHA256 62dfb3e51c16b58b78c7c0d6ee404ba4f0e58afc869df2c1be12c9e032a1d50a
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopus.exe

                  • Path C:\Program Files\GPSoftware\Directory Opus\dopus.exe
                  • Size 35.7MB
                  • SHA256 fc27f6ea156c9569766ac38e138aedbfb7bf28bc37db85d9da6d5d3e68a5d3b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopushlp.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\dopushlp.dll
                  • Size 713KB
                  • SHA256 15d2e7e98a9e8e4a25ecbab726134cb50d22fa231475c8a7d657a038a90d56c1
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopuslib.dll

                  • Path C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll
                  • Size 1.2MB
                  • SHA256 8ad535bfe85f20acd6a5abc770bf5c0fc42dd28b654457362a5e497e7f9c231e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopusrt.exe

                  • Path C:\Program Files\GPSoftware\Directory Opus\dopusrt.exe
                  • Size 477KB
                  • SHA256 62f91ea7e2e2844b9e1c96afbfc12dcd9b3309bb4058a6245a028011b7e86be5
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  stockcert.txt

                  • Path C:\Program Files\GPSoftware\Directory Opus\stockcert.txt
                  • Size 1KB
                  • SHA256 083fa83a6d752048a36467cdc563cae0267d5a9e50b8704c8fd581f2a42cb65a
                  • MD5 SHA1 SHA512 TLSH

                  Applications.dop

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Buttons\Applications.dop
                  • Size 2KB
                  • SHA256 2cc1ad372e09c5e987291cd51ecfe95ca9d869bd3cbec824be68c7a8a9d75507
                  • MD5 SHA1 SHA512 TLSH

                  Drives.dop

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Buttons\Drives.dop
                  • Size 988B
                  • SHA256 3723b0053e362a269841b5be3cc4c80b48330ca01f8bf365adc14f7be825e988
                  • MD5 SHA1 SHA512 TLSH

                  Office.dop

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Buttons\Office.dop
                  • Size 2KB
                  • SHA256 c86149f85284c094c2388ba5b281dd19874c2cc131f9d6b3f19ecabdc356f7ff
                  • MD5 SHA1 SHA512 TLSH

                  Office365.dop

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Buttons\Office365.dop
                  • Size 3KB
                  • SHA256 9f6dba06f65cf1316f77e367107fa7c27b94154f8e0bb3cd4b06169169162704
                  • MD5 SHA1 SHA512 TLSH

                  OpenOffice.dop

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Buttons\OpenOffice.dop
                  • Size 2KB
                  • SHA256 21ca70e470967a4b5f6cbe3d1bffa087653a532bcd57a00c187ea745309b1b09
                  • MD5 SHA1 SHA512 TLSH

                  globaldata.omd

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Global Data\globaldata.omd
                  • Size 348B
                  • SHA256 c9003a178f6a5e8bc943a0052cd5b8232d33a02aa8cb0d1bdb599d9b17e5ec5f
                  • MD5 SHA1 SHA512 TLSH

                  globaldata.omd.tmp

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Global Data\globaldata.omd.tmp
                  • Size 349B
                  • SHA256 ab46ca339495dc1bf1b5692fb732b61af84d8ddcdc4e4897659435d6a3fb169f
                  • MD5 SHA1 SHA512 TLSH

                  globaldata.omd.tmp

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Global Data\globaldata.omd.tmp
                  • Size 386B
                  • SHA256 fa66e6241e1cc98fa095f05919bcfadb56d65bd8dee8cf29c118e057794e3e80
                  • MD5 SHA1 SHA512 TLSH

                  DOpus9.dis

                  • Path C:\ProgramData\GPSoftware\Directory Opus\Icons\DOpus9.dis
                  • Size 408KB
                  • SHA256 14b9c26913cb8d6e17e4f8c6f675678a7ef95fc9b3513cbbbf4425412161a6a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopus.cert:naughtypirates

                  • Path C:\ProgramData\GPSoftware\Directory Opus\dopus.cert:naughtypirates
                  • Size 160B
                  • SHA256 a83667ae4174eb9cd74ce0b5e13d7a99a2f293777ef7bd7b9eeb3a4505ad0e14
                  • MD5 SHA1 SHA512 TLSH

                  dopus.cert:naughtypirates

                  • Path C:\ProgramData\GPSoftware\Directory Opus\dopus.cert:naughtypirates
                  • Size 160B
                  • SHA256 4a5e5e6bea1ba53af6a5734029cc8aef2df329bc93a5c6aa662654ce6cb8f139
                  • MD5 SHA1 SHA512 TLSH

                  dopus.cert:naughtypirates

                  • Path C:\ProgramData\GPSoftware\Directory Opus\dopus.cert:naughtypirates
                  • Size 160B
                  • SHA256 60943a2f337f951146e760d88621b0e66e3cfa9c7bfa247827e3f0b1ce756942
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd
                  • Size 364B
                  • SHA256 2075385c1e5b59d143f02f9dac0c1ff6845ddb169615bb0c9f9e93aad1ab678c
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 449B
                  • SHA256 67a709447c916e9b87e3ee16fba45b3bdab75598c8e8510850f60efb9b16dc15
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 662B
                  • SHA256 227fa78a69f3febb0b7a805f5a9d3ba808f92ba5449af56baa5cbd3d65b6fe9a
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 867B
                  • SHA256 f1fb67afa0d1cdfbbf0008efc269ebf62393f759cad0239c92a20ab11b0ae0c9
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 4370c8c506c375be4a102e39340b6ccf041530d510e536ea5bd04de1a1cbf843
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 f957c5bf0e5c2828d8ffec4a63a2fdfe1fde00ab462132db593c693c035648fe
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 b5896313b9d4d48043ecd5e8e5f0768f73cdd5d19d54f9a25d55147452d93199
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 ee04b201d97e5110435bc651df71fe96c9f03121cf6806f217a5fff7bb1aca48
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 545b953204d9455df796a3542b35ec20cb557dc3ca8e9e5072696feedce9d388
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 730bd7e0e50dce4e2df743240c4f9e4b21ebdb69e52746a60e353802ef5273dc
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 98edf00d59fba1fdd106a4aec5d217ffeeefecba8f5f83cef8075250ecdf1857
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 1KB
                  • SHA256 88aca01bd07f9012ce6f123c7b5d9f1b3261b5cf3d2b0702576761550c4b3550
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 e443986c57618635ca5868e6e6b97791c3b2098cdf4a2ad32e8d31c5dfca6774
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 267fd6c8bfeb01cc9048321c579d13d3ee62184f4594749bd9c89574fcf08a64
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 852490a837d284bc90766b4c3720afd2b19b9eb9e8aedebeb7346f2f5e680723
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 e0320668eece9e24f647a708149b8ec4be130ec8ab404a90c53d4d5c50126104
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 2515c7b9adb4270cb391fdd0cda3c12005c6ffb4593b7f11c773efd15ef91699
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 12dbc809560ec2f99c40ab467ec803416dc07c4a684d3b3e78ec34e2b2f5eee7
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 69d8249aa131ac4c19c7c18cd883203dd603f1dc59011fa308efb4b65315f45d
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 ca297d64bfd55d07056ebc287b84bb068323c7e158727ed9a680352906423235
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 fe4c026fdbc2bf6eee0cde398eea8769e8db44d05f5c4716d6e4116f6def8d0f
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 3KB
                  • SHA256 02037107699db49c6e63dad56f677f5780f107454f1ad14c06a9fb53cd4ddff1
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 5eaf94e496945763e05c013d87f434efac69c56a7188e9c73c6578ecea44cba1
                  • MD5 SHA1 SHA512 TLSH

                  windowstate.osd.tmp

                  • Path C:\Users\Admin\AppData\Local\GPSoftware\Directory Opus\State Data\windowstate.osd.tmp
                  • Size 2KB
                  • SHA256 bc8ac9146542d8300276d3f2524bfdf5fc42fe851190269bb8080719e219f95a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837190862.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837190862.tmp
                  • Size 160B
                  • SHA256 2e47467127d760e0cc35de25dfb0abe7ff278072fc40c62f9f45c2de0fb41308
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200246.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200246.tmp
                  • Size 160B
                  • SHA256 f7865156fa95cac78be1ad10c763ab961e66da5a073193a28b2ad9d480b98cdc
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200281.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200281.tmp
                  • Size 160B
                  • SHA256 ce966a34199f1d52940c90daa92683f5c786fb10d3e08aa1d4ef40c90634037b
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200397.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200397.tmp
                  • Size 160B
                  • SHA256 a74adc9d8fb995515ef320b9dfce7fc74c6828840d35a5b44a2df0ffd19c083a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200520.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200520.tmp
                  • Size 160B
                  • SHA256 6556b6eeb7e10f3854cf80911ea7d65f17859c929c9ad4bce5f0bb85c39616ab
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200584.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200584.tmp
                  • Size 160B
                  • SHA256 37355185bd9102638dc3bdcc86f74da7a6ba4f0047c6104da80ca5d0f9675349
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200657.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200657.tmp
                  • Size 160B
                  • SHA256 d0fec299b6e26da844ad61fa2e945ed4cee1d42db069b5aa8f402f817ecdf364
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200727.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200727.tmp
                  • Size 160B
                  • SHA256 4d1cdbb0512d67b4193b837a4c20cad1275030d57b4781fe8cd59af493978b41
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200800.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200800.tmp
                  • Size 160B
                  • SHA256 0e8ca0533f6624ab5ecd985a676de1963da477852d019dd078e245818310dc4e
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837200868.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837200868.tmp
                  • Size 160B
                  • SHA256 a0477d3ab8dbba6b0ec839ac1fcae5da98f636ca5ff1fd16e02812629bcf8a81
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210195.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210195.tmp
                  • Size 160B
                  • SHA256 45682cb5cc056b8c2fa6e1a7fd9c0d68c5bc260d4a6d4de36d13a52409f81ff0
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210445.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210445.tmp
                  • Size 160B
                  • SHA256 6e1c480e47092b46af0ba7104fdda2313266547967f4a986a05528abb76b1daa
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210492.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210492.tmp
                  • Size 160B
                  • SHA256 ab7c9b174948d164854b8117fa8384ecd3e5f53e72017b8ff454e908506cbf45
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210546.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210546.tmp
                  • Size 160B
                  • SHA256 c6b167a648bb928897569da20be0c6008d8f6492676e3ebe5092007de818699a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210593.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210593.tmp
                  • Size 160B
                  • SHA256 098dc103bd25754e4ec652333966d4b7a8b3959626cc039e083eadb6c0b8d848
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210635.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210635.tmp
                  • Size 160B
                  • SHA256 52e3cbd174e3d20cacafdef8d8e3d7e2390e7baab320341e510295bbf576b9cd
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210691.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210691.tmp
                  • Size 160B
                  • SHA256 5189be9346c5465dd26260030bb08d38688cefc1460754ef477b5bf3971dccda
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210752.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210752.tmp
                  • Size 160B
                  • SHA256 885c4d2fada48b3cf205bb42a8cfbfda2a2df79974c74150302e39c3e99151fe
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210792.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210792.tmp
                  • Size 160B
                  • SHA256 76846ca3332127a5b0ca066b8011198cbcfb58b40d425e6cea2d1a01c2cad6fd
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210863.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210863.tmp
                  • Size 160B
                  • SHA256 556951946903495100d4d9f05079ee38dca5fe5be4c6685508369a7ad8ea117a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837210927.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837210927.tmp
                  • Size 160B
                  • SHA256 6ba6ff0941a0f0a118b19b4e15a44508f2a730111252fb63ddbc14550e62347d
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220108.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220108.tmp
                  • Size 160B
                  • SHA256 054d50669ad2f9498e30d2081510e49a7c4ac6add8d0402ec5ba550bba76083f
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220176.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220176.tmp
                  • Size 160B
                  • SHA256 dfda267e029bdcbb935f5c2a14fff49cd6b76299e3b90ce2f34fbf002c893f1d
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220319.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220319.tmp
                  • Size 160B
                  • SHA256 6a8546008c7d65a15440a4a9c6c99cee555eb18964898aa04ece3db045adfc8a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220404.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220404.tmp
                  • Size 160B
                  • SHA256 55c0d8b6736ba350d6f7ccfcdb8574f5c8998ff5a13374122e552a0cd97f3931
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220475.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220475.tmp
                  • Size 160B
                  • SHA256 d5884c6a161562eda80fb27d9d9da91a70b8fe638920c7e2f3d8de879dd3ece0
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220554.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220554.tmp
                  • Size 160B
                  • SHA256 938e12bf4dabdc434b7c77f9ee51fc38bd24a0754597b32f1aa773cb9682ed04
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220627.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220627.tmp
                  • Size 160B
                  • SHA256 111bb997c9adfa409a6639f4b2cb455745b9f6f89a83cfecebf7c8b67f967de7
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220696.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220696.tmp
                  • Size 160B
                  • SHA256 9e167b171170c1016bdaa45050af8c8a904c1e9d92dfd5ee4105f8dd83c1bea9
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220817.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220817.tmp
                  • Size 160B
                  • SHA256 10373698c72d7616a7946afafdc16be83fe075c971f541d8eace0871e1ca8bb6
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837220942.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837220942.tmp
                  • Size 160B
                  • SHA256 bdac39df2a4b9f338ffba608cb054325eba27620c7e2f9816561abc3ca5e3e04
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230060.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230060.tmp
                  • Size 160B
                  • SHA256 89f5d0cbc0461f4aa194f790504c13b6db79b300a5e02719338605e93803f1a4
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230151.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230151.tmp
                  • Size 160B
                  • SHA256 d7b4686809227162bc3ec4875ebe4eeace27df564970e9c2f62b866d7c98dc17
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230242.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230242.tmp
                  • Size 160B
                  • SHA256 7fc1c318c04c537a952d73dee447fb0e9ed3174e10556c6f0e1b7b3d8e9dfbc7
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230338.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230338.tmp
                  • Size 160B
                  • SHA256 0c4dd5e54f17cc34cc740e25bb9fcf537cbf4d058bb01bab77e948b7dbf596b5
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230469.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230469.tmp
                  • Size 160B
                  • SHA256 ef7cdae6fb7deee3af9867cab74682ca05ec6be246eb2b4a7d2add7d0d3ca013
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230559.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230559.tmp
                  • Size 160B
                  • SHA256 1f1df1c28afe4296ab60015397e3dc8e157aa81919dfd47ebcded15a03de5487
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230662.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230662.tmp
                  • Size 160B
                  • SHA256 7498097e0731779be68190907d1d3e50973011f749d76cc0130864061a19b15a
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230758.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230758.tmp
                  • Size 160B
                  • SHA256 4490e8c1b1923fa5efccaaaaf1b635cece5a9b45fc20ae8e003be2275fe0c186
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230841.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230841.tmp
                  • Size 160B
                  • SHA256 af997145fa5df3bb5dad3dcebda95f0c55c31da088cd864be684034c66210c25
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837230940.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837230940.tmp
                  • Size 160B
                  • SHA256 fab3d5f2b04ef4ec7a06b5f7434146562a21b21cbb5d2cb3137d3ad3946cab97
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837240055.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837240055.tmp
                  • Size 160B
                  • SHA256 d21f87548c1371388efc49369555932b4e00d9a023679c2e0d1df9b2f21dcae8
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837240160.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837240160.tmp
                  • Size 160B
                  • SHA256 b484372fc67c7fcdcd4e46a9a0afc61443b8be55757592760607c5d4373b96c5
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250837240330.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250837240330.tmp
                  • Size 160B
                  • SHA256 bfb93396cbfd5f82e4175fb422b82922e5ba4fd1cc638b454139e0a6d23ed209
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250838580885.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250838580885.tmp
                  • Size 160B
                  • SHA256 5fa52220c8c7ff889a7e14b90a356c9bff58b37444e19d5d912427bce2c082d3
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250838580907.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250838580907.tmp
                  • Size 160B
                  • SHA256 d8ae1a42cfce861b999226e11ac21adff970bc4f72cc2edab0a081e945fc310f
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250838580930.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250838580930.tmp
                  • Size 160B
                  • SHA256 9846fd6c9c3b0a48bd3187f98b3e4c564256b530a0077177c6524d5e95691341
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040374.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040374.tmp
                  • Size 160B
                  • SHA256 c155984e09d7adf8eb564224392f45fe0f61cd50dd33bff5bb79586aec17cd7d
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040386.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040386.tmp
                  • Size 160B
                  • SHA256 bce82bb68c5247fc8d04eb352fe43214ebeabfa83dece733ae831d76abf714f8
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040399.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040399.tmp
                  • Size 160B
                  • SHA256 45cf2048320132a6827b925547c2216ce04325698332f44412dd9d1847aa2102
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040404.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040404.tmp
                  • Size 160B
                  • SHA256 57dd4a322ff0e729151dfaa866273b3a12f6e26de92361205d701315c48e4ef1
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040413.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040413.tmp
                  • Size 160B
                  • SHA256 75bc715459bc080a560c6bb0d9bbfab6284e6ca5ea6203b1db829a6a8ec50f69
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040477.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040477.tmp
                  • Size 160B
                  • SHA256 d4407be2862315c2675768424669135c5b82f9b81836669004b31ab3eaf40473
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040486.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040486.tmp
                  • Size 160B
                  • SHA256 8888cb0eaf94a21789138fe9c34d82c6264b769cd9f4c4b93c9cd4130a4645f6
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040493.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040493.tmp
                  • Size 160B
                  • SHA256 c00851d92595a17c18db44d470cb8ca70803c81ca6d177a67b12f3b867f02da1
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040501.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040501.tmp
                  • Size 160B
                  • SHA256 4607ced1e0989071f4635c225cd426ad8ee353cc7de9c01688f8b1de3a90c29c
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040512.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040512.tmp
                  • Size 160B
                  • SHA256 3642f2d2e94bc94316e84059a5c837ca91d1a49db3c6799a6a2754173216c20d
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040522.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040522.tmp
                  • Size 160B
                  • SHA256 3c5470b472a0a2962c6245774cdf82a1edca8a45dde1089188fb2329d88287a6
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040533.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040533.tmp
                  • Size 160B
                  • SHA256 36f3fd5855a8327abd1064899bb7177320e10427c3c81e5d3a4c0b394820f5d4
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040545.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040545.tmp
                  • Size 160B
                  • SHA256 21bcaf4089d3a1e462eee6ea57499bba3107c1b5857fa5c066938ad8d9e42894
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040562.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040562.tmp
                  • Size 160B
                  • SHA256 8d77d7396ef84763207c33db6fe25a89334d419da7c2ac1c95108bd7c4b86a09
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040583.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040583.tmp
                  • Size 160B
                  • SHA256 1e8188fd9790b6d2b053ca6aa5131bcdaea5718172c6deebac370ef0fdd52207
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040590.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040590.tmp
                  • Size 160B
                  • SHA256 bf1997379f7e29bd6a36b84c4efcfb2f032dee8187478c9b874a21bf3755a2a6
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040600.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040600.tmp
                  • Size 160B
                  • SHA256 c4d81d28a6317377cc2b234ebcd4acc4908c67dac244b8cb480fb34799ca9329
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040611.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040611.tmp
                  • Size 160B
                  • SHA256 bb447ed0ac0665cb5593c8531469ea53f68d35285bacdfbfd1ca4012eaf1d330
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040621.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040621.tmp
                  • Size 160B
                  • SHA256 b7dd8a4571dc2415d6e90250c5870933b3543e774240009650f4713c94f69880
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040687.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040687.tmp
                  • Size 160B
                  • SHA256 d204a0a3258af621d2966280a71f30c335f4e6d307f7951dba6095dd1d2ce9eb
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040695.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040695.tmp
                  • Size 160B
                  • SHA256 a9d1e7a2795cb2725c63285f8cbd47960b8f5a0694db75b0b994240f9b794217
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040706.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040706.tmp
                  • Size 160B
                  • SHA256 8b1db52904290b7230c7db36ba53ca48446d51dd16dfd1ba43a2f05c386e4e36
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040714.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040714.tmp
                  • Size 160B
                  • SHA256 94266ffcc9a2bcc2640b10732eb7a5bb26b13e32d49ff614e41de22b8becac17
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040721.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040721.tmp
                  • Size 160B
                  • SHA256 f07bca209bea63bf46ece9d3df39a154d8b2e17c3d4bc5f63e92d020625ae8ea
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040732.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040732.tmp
                  • Size 160B
                  • SHA256 e3db54bee7147c9ac757b0949c333fa68862d22cb443617e9e7550ff5ce1d7b3
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040760.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040760.tmp
                  • Size 160B
                  • SHA256 01fd48f26489735f981cdfd34ebe95285950bea5f0d3432f437e9489b630134f
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040768.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040768.tmp
                  • Size 160B
                  • SHA256 cc07e1a403c111e65041ab30b2569090a29ee733d40f0a9b65121b0a54b0b964
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040777.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040777.tmp
                  • Size 160B
                  • SHA256 9d06981103b468a9e82724e72d3b2e03139e03457ac54e60e03b36b1da2a1979
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040793.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040793.tmp
                  • Size 160B
                  • SHA256 7f0c9e106410f70865360ef4b513413c8704f2013914426bbd92812a410a319d
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040808.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040808.tmp
                  • Size 160B
                  • SHA256 85eaf838cbb41edf24a74ceb6fbf62f2d5769be8b3149c4f4aceca5da74a6092
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040824.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040824.tmp
                  • Size 160B
                  • SHA256 f343261cc84af6624fb152505af38e3bddc45b9e2fc3b2d1eb3b84c90c0882d3
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040836.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040836.tmp
                  • Size 160B
                  • SHA256 d18ec187b58472a3629a238a80b448669f37cafa531480068de8179a414ebfd3
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040841.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040841.tmp
                  • Size 160B
                  • SHA256 d292555ef0cdabfb622eca6ec0e8250ed4f89d42c8db149183d6b1e9bad10581
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040847.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040847.tmp
                  • Size 160B
                  • SHA256 69b238fdab852f8eca9ff2e13f59778b57c9ed1bc0feb47a06720cdc2f76feab
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040855.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040855.tmp
                  • Size 160B
                  • SHA256 491eb499b4c97f3b4fa88103af298de7ff9b82bcc31313e19ad06098f7dc6de5
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040864.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040864.tmp
                  • Size 160B
                  • SHA256 f1dc130029a859e3ffc29e503efa79d254469d2d5ad2d47a299110c7984def43
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040882.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040882.tmp
                  • Size 160B
                  • SHA256 48db6285122d542adcc7b1674beeb22b1f3b09d700bbb3d720032f07248db878
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040894.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040894.tmp
                  • Size 160B
                  • SHA256 faeb35939ac453695c9484e0f912a1f0b64b1fae1a09a656237e879df15a63db
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040913.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040913.tmp
                  • Size 160B
                  • SHA256 390b2f01a7d55c213384d6c5d62c8f06985f9f66c448a0bd1ee6fba771899e9b
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040925.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040925.tmp
                  • Size 160B
                  • SHA256 93f66416e6ca185075d8e3b2dbfa6eec714828e73393d9b2d8633d3ba8f9c7be
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040942.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040942.tmp
                  • Size 160B
                  • SHA256 5663a6c0007a25841989d5266c3950265513f2852d3d132670992c3793633d27
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040963.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040963.tmp
                  • Size 160B
                  • SHA256 5382377ebeebaadfde7cb1936afb3123dac251f7e630171df049572bfcec2436
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040975.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040975.tmp
                  • Size 160B
                  • SHA256 e817720428b470886fc417475feb7d1bf4e7ca580fb5c3f34fca59829f473edb
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840040988.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840040988.tmp
                  • Size 160B
                  • SHA256 08123b91694375e41ea56ced46cf040056f9fa2dee831093252c04b7fa09c928
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050000.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050000.tmp
                  • Size 160B
                  • SHA256 0405df1d98bfcf546c938aec05753eda0ed878cffe4c52ddcb4d08e0a83aee68
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050010.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050010.tmp
                  • Size 160B
                  • SHA256 6d9b0d4069a1c382e7c5e983fe196d896731b6b0eebd49bac46db421b683fc4e
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050022.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050022.tmp
                  • Size 160B
                  • SHA256 e7c112726bdafca627e0407607c19712e398d0c5721fdeaee59ab4b48c3e69be
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050040.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050040.tmp
                  • Size 160B
                  • SHA256 82d5d32778b580c3d65fda9541e2d073d0c4b3047fbb2dc7fe2cc8a12903a6af
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050050.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050050.tmp
                  • Size 160B
                  • SHA256 d4f90fefd573dfae80aa068a7c832954755431a443224c32d6f9d4bad02d6eb5
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050057.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050057.tmp
                  • Size 160B
                  • SHA256 e44369949716433fddf12339eda3340b19961889c43d4c5be30757181ca9b3ca
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050073.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050073.tmp
                  • Size 160B
                  • SHA256 96e7fe22f0da9d471faf3262046b6fe8d7dff162e1df30ab920e0a71d1007440
                  • MD5 SHA1 SHA512 TLSH

                  dop202609250840050082.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\dop202609250840050082.tmp
                  • Size 160B
                  • SHA256 b1a18480ade0ce8167a423bf4517cf0ac833a76b935be590c388c94e0a5891fc
                  • MD5 SHA1 SHA512 TLSH

                  SetAppUserModelId-x64.exe

                  • Path C:\Users\Admin\AppData\Local\Temp\is-R5ID1FCULM.tmp\SetAppUserModelId-x64.exe
                  • Size 188KB
                  • SHA256 9d973eda38ec6bedbf95ef50db62cdd8c9109c453658999395bf1041e7db1649
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopuslib32.dll

                  • Path C:\Users\Admin\AppData\Local\Temp\is-R5ID1FCULM.tmp\dopuslib32.dll
                  • Size 1.1MB
                  • SHA256 8033fb5eb915f01b62e4e75d2fc04de65cc3be986e0500d1fd71cf1127a4b675
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  innohelp.dll

                  • Path C:\Users\Admin\AppData\Local\Temp\is-R5ID1FCULM.tmp\innohelp.dll
                  • Size 167KB
                  • SHA256 e9312b255ed7208585a12d42dee3304134b9e5da251481e14a66195f999c6c8d
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  DOpusInstall-13.25.tmp

                  • Path C:\Users\Admin\AppData\Local\Temp\is-UAUWX2L33N.tmp\DOpusInstall-13.25.tmp
                  • Size 4.8MB
                  • SHA256 ba73881ff1dc109ba3f26344521e1b36a92abf19cb1a4a718ba87ffe7debe24e
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  favorites.ofv

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\ConfigFiles\favorites.ofv
                  • Size 105B
                  • SHA256 83bc99282f82718b787c1df388fa1cf7c2e91e07a24cb8b694ee11a8abfad437
                  • MD5 SHA1 SHA512 TLSH

                  default.off

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\Formats\default.off
                  • Size 4KB
                  • SHA256 315e53bad61c5de78a5141a4a0e6223695fef24c6510935d968a0e78acb94536
                  • MD5 SHA1 SHA512 SSDEEP TLSH

                  dopus.dat

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\dopus.dat
                  • Size 80B
                  • SHA256 3141ae284631b751943e72b356bad3d389eacb9baec2f049f74fec1fecb7dbbf
                  • MD5 SHA1 SHA512 TLSH

                  userdata.omd

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd
                  • Size 125B
                  • SHA256 aba7722fedcea91eb29e7c6694152e38c1c829f087bdda09f879418042ddea89
                  • MD5 SHA1 SHA512 TLSH

                  userdata.omd.tmp

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                  • Size 175B
                  • SHA256 075fda7a865bce1bee0efb27b89e7922dd4ed4f91a5351016065732e11a86c30
                  • MD5 SHA1 SHA512 TLSH

                  userdata.omd.tmp

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                  • Size 179B
                  • SHA256 f83d95880e3d9ca061a65ad8e960f74e57f4048ad9c7f483494897f5bf5dd7c1
                  • MD5 SHA1 SHA512 TLSH

                  userdata.omd.tmp

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                  • Size 152B
                  • SHA256 92b1f86b6447cc80e120bbc5fff26ad5dee5cab1c5b4ae63043748d95fb15a0a
                  • MD5 SHA1 SHA512 TLSH

                  userdata.omd.tmp

                  • Path C:\Users\Admin\AppData\Roaming\GPSoftware\Directory Opus\userdata.omd.tmp
                  • Size 130B
                  • SHA256 5f873821e2e892bac6655e3e93ca1366b7f9062e7e185524956f5fb9045b5ced
                  • MD5 SHA1 SHA512 TLSH

                  {0A4C0EDA-7CDC-4EC1-A760-FED3128C463C}

                  • Path C:\Windows\System32\inf32\{0A4C0EDA-7CDC-4EC1-A760-FED3128C463C}
                  • Size 80B
                  • SHA256 a568d5fbffad7210c123c567c5e9c72d5f584ab0465ccfd7bcd77a2700c59ff0
                  • MD5 SHA1 SHA512 TLSH

                  {0F7C9092-62AC-455C-B912-23E18CC93986}

                  • Path C:\Windows\System32\inf32\{0F7C9092-62AC-455C-B912-23E18CC93986}
                  • Size 80B
                  • SHA256 6c9c1547cb0a4f6abf01b630bb6dc2893c51c596346c1c6f4ac23d9b3df2365e
                  • MD5 SHA1 SHA512 TLSH

                  {191CC445-70F2-44CC-B71D-5EEF959A26C8}

                  • Path C:\Windows\System32\inf32\{191CC445-70F2-44CC-B71D-5EEF959A26C8}
                  • Size 80B
                  • SHA256 892f928f5794b7925b4f3df0b2587edabd368cd42f131b5011e49dd12f3c22b1
                  • MD5 SHA1 SHA512 TLSH

                  {1D1B845B-AED9-40B9-8FCC-86C5FB3A9AE2}

                  • Path C:\Windows\System32\inf32\{1D1B845B-AED9-40B9-8FCC-86C5FB3A9AE2}
                  • Size 80B
                  • SHA256 5cc3b84025cb9f81a10d65d6b024177ecabcf1ae74e5324599aa514e42ee36c2
                  • MD5 SHA1 SHA512 TLSH

                  {203B9F1F-6814-4B71-A1C9-50FECA77997F}

                  • Path C:\Windows\System32\inf32\{203B9F1F-6814-4B71-A1C9-50FECA77997F}
                  • Size 80B
                  • SHA256 52381dd2a53c13f538f96482da83f77dd992d3736dee27edd7953e5a629cef30
                  • MD5 SHA1 SHA512 TLSH

                  {22CBD45B-15AE-4C20-A63A-26823A876706}

                  • Path C:\Windows\System32\inf32\{22CBD45B-15AE-4C20-A63A-26823A876706}
                  • Size 80B
                  • SHA256 201a113561aa9705cff7c10b926804266b4e25f8fe5b3e775d8d536c9e12b9d8
                  • MD5 SHA1 SHA512 TLSH

                  {309AAC97-C2D4-4FD9-804D-299CB8BCB762}

                  • Path C:\Windows\System32\inf32\{309AAC97-C2D4-4FD9-804D-299CB8BCB762}
                  • Size 80B
                  • SHA256 1839efe81778820866bbb092aed891d7d6f4177fe55e6b791cf64f72dfbabefc
                  • MD5 SHA1 SHA512 TLSH

                  {33FC20A5-B0AF-4447-9AE6-5717DEED5820}

                  • Path C:\Windows\System32\inf32\{33FC20A5-B0AF-4447-9AE6-5717DEED5820}
                  • Size 80B
                  • SHA256 2b8750e8f87156ede4c19f4ddd1336fa5e9723d5f023ce235e664952b639f037
                  • MD5 SHA1 SHA512 TLSH

                  {3DBCACB9-0638-4EC6-8A0D-F77B96406C4A}

                  • Path C:\Windows\System32\inf32\{3DBCACB9-0638-4EC6-8A0D-F77B96406C4A}
                  • Size 80B
                  • SHA256 fa75901e580b0151fcbc9b5b448ed188abb957e9fe0ba2a77124069a1db76234
                  • MD5 SHA1 SHA512 TLSH

                  {42D31ADB-5589-44BB-B578-F60621FB4883}

                  • Path C:\Windows\System32\inf32\{42D31ADB-5589-44BB-B578-F60621FB4883}
                  • Size 80B
                  • SHA256 68825dc96abd8bddd0047c12a38e7334a0a70fbd248d6d54fabce4f3f546543a
                  • MD5 SHA1 SHA512 TLSH

                  {43927BC0-4346-4391-AA69-1A09F36B9340}

                  • Path C:\Windows\System32\inf32\{43927BC0-4346-4391-AA69-1A09F36B9340}
                  • Size 80B
                  • SHA256 4f2faf77e49fa3dcf16d327ac8eac958380deaf592f7044fdff2188c90fc4562
                  • MD5 SHA1 SHA512 TLSH

                  {47394CFB-2F14-4BD4-8D70-FA8D755ECF0A}

                  • Path C:\Windows\System32\inf32\{47394CFB-2F14-4BD4-8D70-FA8D755ECF0A}
                  • Size 80B
                  • SHA256 3c6975efc9f9f6daceeb6bf806219ad0974cb5bb8a629a6d6840653a5694e09f
                  • MD5 SHA1 SHA512 TLSH

                  {48EBDBC2-5C1E-4E1C-96F5-A6763210E50E}

                  • Path C:\Windows\System32\inf32\{48EBDBC2-5C1E-4E1C-96F5-A6763210E50E}
                  • Size 80B
                  • SHA256 01a457d7c5fb07d465872aafbac9dc52758d2f8c4105bca7f8a691d921c528ad
                  • MD5 SHA1 SHA512 TLSH

                  {5B0A787B-32A3-47D8-AD13-8C1162B2D630}

                  • Path C:\Windows\System32\inf32\{5B0A787B-32A3-47D8-AD13-8C1162B2D630}
                  • Size 80B
                  • SHA256 610a24da8f891afe4815d3e75530087478416b4c8e5b91ec67d038b30a902a20
                  • MD5 SHA1 SHA512 TLSH

                  {66668C20-6D13-4930-944F-BC2706449056}

                  • Path C:\Windows\System32\inf32\{66668C20-6D13-4930-944F-BC2706449056}
                  • Size 80B
                  • SHA256 ff08a95cd823d243a4a3f1925398b0e164eb073e3352e6ab1b94d02cc92940a3
                  • MD5 SHA1 SHA512 TLSH

                  {6691B848-C613-4199-A413-E6AB520BEB18}

                  • Path C:\Windows\System32\inf32\{6691B848-C613-4199-A413-E6AB520BEB18}
                  • Size 80B
                  • SHA256 1d54238a5df4fc802063a4c80813af03c6e276d296219415e2d36bfc50f2d0cc
                  • MD5 SHA1 SHA512 TLSH

                  {6B4C71B1-5066-4D2F-AE1E-4066B6C5AA12}

                  • Path C:\Windows\System32\inf32\{6B4C71B1-5066-4D2F-AE1E-4066B6C5AA12}
                  • Size 80B
                  • SHA256 d01bc8402aade7d72b6e34c4fad72817af3b7428def8d08a5aba153c13213973
                  • MD5 SHA1 SHA512 TLSH

                  {6F5ABA87-0499-4BFE-A982-716CEB94F36E}

                  • Path C:\Windows\System32\inf32\{6F5ABA87-0499-4BFE-A982-716CEB94F36E}
                  • Size 80B
                  • SHA256 0260e6f07ce6bb69ba3231bfdde18c33941fb11fc39d4604a1bf6cd5409a984b
                  • MD5 SHA1 SHA512 TLSH

                  {6FF5B9B8-0642-4DB5-8A25-40FC175889C1}

                  • Path C:\Windows\System32\inf32\{6FF5B9B8-0642-4DB5-8A25-40FC175889C1}
                  • Size 80B
                  • SHA256 b8d2740eecea9d517725f8650982500a8520b795600aa425bb1c9e97219ef9fe
                  • MD5 SHA1 SHA512 TLSH

                  {77644BA0-845C-43BA-B1F9-8C9BCD12C4AF}

                  • Path C:\Windows\System32\inf32\{77644BA0-845C-43BA-B1F9-8C9BCD12C4AF}
                  • Size 80B
                  • SHA256 9e71a9ee013b7e50062ed110d769e524d74c05a562e0512338abf6264b1dea02
                  • MD5 SHA1 SHA512 TLSH

                  {837C0633-68CB-4B2D-A196-7F07D41DE95D}

                  • Path C:\Windows\System32\inf32\{837C0633-68CB-4B2D-A196-7F07D41DE95D}
                  • Size 80B
                  • SHA256 fa9d2dda46674c39423d63be27b371298a4711bd66b8c4ee4eba2c7414f28a71
                  • MD5 SHA1 SHA512 TLSH

                  {8D714E67-3450-48F7-A1AF-2219E1E67FF6}

                  • Path C:\Windows\System32\inf32\{8D714E67-3450-48F7-A1AF-2219E1E67FF6}
                  • Size 80B
                  • SHA256 4cbddbf7e6538e2582dec3fb99c0ff375693406e19069bae35f1dd97c6175453
                  • MD5 SHA1 SHA512 TLSH

                  {8FEFEBCC-4F8A-49DE-9CE1-8075334E2B96}

                  • Path C:\Windows\System32\inf32\{8FEFEBCC-4F8A-49DE-9CE1-8075334E2B96}
                  • Size 80B
                  • SHA256 e59956bbe7f307adc086d803b351a7f1a5839870860bb0775835647499c072b1
                  • MD5 SHA1 SHA512 TLSH

                  {94164FDE-9E76-4DCB-B01A-2051E8986CF0}

                  • Path C:\Windows\System32\inf32\{94164FDE-9E76-4DCB-B01A-2051E8986CF0}
                  • Size 80B
                  • SHA256 b0569e204dfcc0a037e7cdfd7d6ae3088cb719a6489cc1a0cd5c69d752fe656d
                  • MD5 SHA1 SHA512 TLSH

                  {98AD44E1-B593-45DF-B1D8-D8DD2E626976}

                  • Path C:\Windows\System32\inf32\{98AD44E1-B593-45DF-B1D8-D8DD2E626976}
                  • Size 80B
                  • SHA256 b19aeb3c377889ac6e5ee05261337eed168c61ddcec38b2500a3eb99db9cbe3c
                  • MD5 SHA1 SHA512 TLSH

                  {9C7F1F38-B744-40F0-AF8B-707E32212ED4}

                  • Path C:\Windows\System32\inf32\{9C7F1F38-B744-40F0-AF8B-707E32212ED4}
                  • Size 80B
                  • SHA256 38f8d0f792546c85281c427613ca7f1c679e8c9e283cdd1cd4d80b5b9edc8139
                  • MD5 SHA1 SHA512 TLSH

                  {9D49F39D-3A24-47DA-9CDD-AC1B71705F02}

                  • Path C:\Windows\System32\inf32\{9D49F39D-3A24-47DA-9CDD-AC1B71705F02}
                  • Size 80B
                  • SHA256 853bdad9fd57cbc8d45e1b60648397aa86e954a135beadf35c2fd75d260d71af
                  • MD5 SHA1 SHA512 TLSH

                  {A1C0670C-5131-4E48-947A-DDD05B44C1E6}

                  • Path C:\Windows\System32\inf32\{A1C0670C-5131-4E48-947A-DDD05B44C1E6}
                  • Size 80B
                  • SHA256 0e0676eb9306d186c447791169b99bcd8171d3b80a5e15ad224290718bfcb053
                  • MD5 SHA1 SHA512 TLSH

                  {A31CDF2B-6CE3-4C87-8274-150F1FDC77B9}

                  • Path C:\Windows\System32\inf32\{A31CDF2B-6CE3-4C87-8274-150F1FDC77B9}
                  • Size 80B
                  • SHA256 c4c16312b0c0951fc4bf50e7566c57a5f7838d4ab988e737ac0c3a479208a567
                  • MD5 SHA1 SHA512 TLSH

                  {BA0CA829-27AE-465C-A1D7-EBE962D291B9}

                  • Path C:\Windows\System32\inf32\{BA0CA829-27AE-465C-A1D7-EBE962D291B9}
                  • Size 80B
                  • SHA256 d26e470ea9fdc7564073a1686c5a7a7889575f2f7704d0bdf6ea0a589a4ca766
                  • MD5 SHA1 SHA512 TLSH

                  {BCB9FD60-FCC7-4B53-9CA5-6C9FF210BAFA}

                  • Path C:\Windows\System32\inf32\{BCB9FD60-FCC7-4B53-9CA5-6C9FF210BAFA}
                  • Size 80B
                  • SHA256 2fed01db1918244d35dbcbe3d442864bca7bfcd39b09ae6107d35dae8aedf39e
                  • MD5 SHA1 SHA512 TLSH

                  {BF482790-5B4D-478B-9BF2-39BFED16EFE6}

                  • Path C:\Windows\System32\inf32\{BF482790-5B4D-478B-9BF2-39BFED16EFE6}
                  • Size 80B
                  • SHA256 412649acd173f74184c368dc31d66aab03f93b1fa5fea1afc6571f4f21d77205
                  • MD5 SHA1 SHA512 TLSH

                  {BF9EEBF0-2A77-4943-9DC2-00FBF2E113C5}

                  • Path C:\Windows\System32\inf32\{BF9EEBF0-2A77-4943-9DC2-00FBF2E113C5}
                  • Size 80B
                  • SHA256 bc2e64440f023d4985b6c80f135daa52835fb6b2e726c036c840803ed54464c7
                  • MD5 SHA1 SHA512 TLSH

                  {C1542767-C49A-4E19-9A30-EB8E786B1B61}

                  • Path C:\Windows\System32\inf32\{C1542767-C49A-4E19-9A30-EB8E786B1B61}
                  • Size 80B
                  • SHA256 0f512c3c3ad63ceae3fe0a5ffa4cb535dbdc7f17f0bd7f2a1a4f0156a1263765
                  • MD5 SHA1 SHA512 TLSH

                  {C2B5D0A8-C40D-46FF-A045-A9CD225E2540}

                  • Path C:\Windows\System32\inf32\{C2B5D0A8-C40D-46FF-A045-A9CD225E2540}
                  • Size 80B
                  • SHA256 15ad6bfccbdcc59ef132d07c75dbef1925fb7c4d23e4d57c42981925f0ee2a88
                  • MD5 SHA1 SHA512 TLSH

                  {C5A85C46-21D7-47FB-9545-DE7EB3189388}

                  • Path C:\Windows\System32\inf32\{C5A85C46-21D7-47FB-9545-DE7EB3189388}
                  • Size 80B
                  • SHA256 34f63c909d24166f4a5dfccae8567c15d1cc31ccf31d4e4203d3666c20ad442f
                  • MD5 SHA1 SHA512 TLSH

                  {C8FAA060-3C65-4B2C-96F9-A5883F9128C5}

                  • Path C:\Windows\System32\inf32\{C8FAA060-3C65-4B2C-96F9-A5883F9128C5}
                  • Size 80B
                  • SHA256 b4edcde3a1de47681d23eb1b253bc7ed836960bc2d6a8f6bb31bbf452244f6e5
                  • MD5 SHA1 SHA512 TLSH

                  {D10D29DA-A69F-45FE-A227-648B53B9EB5C}

                  • Path C:\Windows\System32\inf32\{D10D29DA-A69F-45FE-A227-648B53B9EB5C}
                  • Size 80B
                  • SHA256 42360b75c3d5e1494a658f6b863e34bbd7476e70315f7623f5488642e9ee08e7
                  • MD5 SHA1 SHA512 TLSH

                  {D4A30278-30E2-41CF-981E-62D68E4B14DD}

                  • Path C:\Windows\System32\inf32\{D4A30278-30E2-41CF-981E-62D68E4B14DD}
                  • Size 80B
                  • SHA256 a18856c1e7003ce440ba651c5e07bd880ff75f239840f5491625b4a1b7e3348f
                  • MD5 SHA1 SHA512 TLSH

                  {D8D26666-F284-4C06-A2A7-62951C63F1F7}

                  • Path C:\Windows\System32\inf32\{D8D26666-F284-4C06-A2A7-62951C63F1F7}
                  • Size 80B
                  • SHA256 43785d8e050546ff148dbc4ae2c57b06cb1956beefc0d13ecb6b8ff405fd8603
                  • MD5 SHA1 SHA512 TLSH

                  {DE420775-C478-4882-8A9F-57457DBD76F4}

                  • Path C:\Windows\System32\inf32\{DE420775-C478-4882-8A9F-57457DBD76F4}
                  • Size 80B
                  • SHA256 c32512ad54583e2569db86ee80120b495c37ea0b8362bbeafdeda3db0ed50ad4
                  • MD5 SHA1 SHA512 TLSH

                  {E0349BAA-2639-4722-932D-99D5D3875D56}

                  • Path C:\Windows\System32\inf32\{E0349BAA-2639-4722-932D-99D5D3875D56}
                  • Size 80B
                  • SHA256 b66184342e43e61975f164b38cf7fb5b8a8ab8c793d842431bf475d783287c97
                  • MD5 SHA1 SHA512 TLSH

                  {EAECF47C-7C84-4C3C-9B6A-725BA38F4492}

                  • Path C:\Windows\System32\inf32\{EAECF47C-7C84-4C3C-9B6A-725BA38F4492}
                  • Size 80B
                  • SHA256 7f2fe4550fb152789d4e5b74ca27ab9781dbc3e0e670cc38ab3854efa12dbce6
                  • MD5 SHA1 SHA512 TLSH

                  {F35D3F59-EDC8-4DDB-96A1-472211370BBA}

                  • Path C:\Windows\System32\inf32\{F35D3F59-EDC8-4DDB-96A1-472211370BBA}
                  • Size 80B
                  • SHA256 5c838c0f49e53680521c1e03b06cfb444527d285e5ae11c071b53d1d841e83d6
                  • MD5 SHA1 SHA512 TLSH

                  {F3EC3C81-3628-42B6-B320-F077BBEE54AB}

                  • Path C:\Windows\System32\inf32\{F3EC3C81-3628-42B6-B320-F077BBEE54AB}
                  • Size 80B
                  • SHA256 cc6d499ea7e40f2dc9b233911963feefd14c797d5aaf6b1f6c1d50ec975769f4
                  • MD5 SHA1 SHA512 TLSH

                  {FEC92FA6-0E9C-49AE-AE92-05388E5D4D99}

                  • Path C:\Windows\System32\inf32\{FEC92FA6-0E9C-49AE-AE92-05388E5D4D99}
                  • Size 80B
                  • SHA256 53359a9bc15ac49a2e306cf6480165e06cd8230049dfd6702d287f0ac26a0958
                  • MD5 SHA1 SHA512 TLSH

                  memory/240-705-0x00000000003B0000-0x00000000008AA000-memory.dmp

                  memory/240-6-0x0000000002F10000-0x0000000002F11000-memory.dmp

                  memory/240-20-0x0000000002F10000-0x0000000002F11000-memory.dmp

                  memory/240-22-0x00000000003B0000-0x00000000008AA000-memory.dmp

                  memory/240-19-0x00000000003B0000-0x00000000008AA000-memory.dmp

                  memory/240-1245-0x00000000003B0000-0x00000000008AA000-memory.dmp

                  memory/1244-3115-0x000002C7D21A0000-0x000002C7D2768000-memory.dmp

                  memory/1244-215-0x00007FFAEC190000-0x00007FFAEC1A0000-memory.dmp

                  memory/1244-4436-0x000002C7D21A0000-0x000002C7D2768000-memory.dmp

                  memory/1244-2845-0x000002C7D21A0000-0x000002C7D2768000-memory.dmp

                  memory/1244-216-0x00007FFAEC190000-0x00007FFAEC1A0000-memory.dmp

                  memory/1244-3152-0x000002C7D21A0000-0x000002C7D2768000-memory.dmp

                  memory/1244-3156-0x000002C7D21A0000-0x000002C7D2768000-memory.dmp

                  memory/1244-219-0x00007FFAEC190000-0x00007FFAEC1A0000-memory.dmp

                  memory/1280-18-0x0000000000120000-0x0000000000210000-memory.dmp

                  memory/1280-1297-0x0000000000120000-0x0000000000210000-memory.dmp

                  memory/1280-0-0x0000000000120000-0x0000000000210000-memory.dmp