d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
Size 1.1MB
Sample260722-ftprzadm7s
SHA256 d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668
MD5 b1de17d2edfec9c2e9a730eb4cb27c01
SHA1 71612859d21025f21976ba089f54f7b79c49de68
SHA512 b582e1455b4b8a9b5cb63156e24bed20d5c550a810355029114d34effb698732b3e3b4e017d3a7d24986f30346d531455dc0945e1c2ef23e33e1b4e142204b73
SSDEEP 24576:LqgK76BTFiApQ0aeuoTR3G16qdPIyAL4IFdhozojwJ7lB25DACQr:w7ATFxpQGuoV252y1IFdhKo47G5Ds
TLSH
T1F53523596E1124AEE5224C70E8766DF37F38BE5309450527CD88FED930BEBC22B82657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 28 IoCs

pid	Process
3548	UEPcon.exe
3484	QuellGTA.exe
6012	UEPcon.exe
5688	UEPcon.exe
1148	UEPcon.exe
3844	RTSScon.exe
2244	RTSScon.exe
236	UEPcon.exe
6032	UEPcon.exe
3236	UEPcon.exe
5024	UEPcon.exe
1264	UEPcon.exe
1124	UEPcon.exe
3956	UEPcon.exe
1224	UEPcon.exe
3300	UEPcon.exe
4384	RTSScon.exe
4736	RTSScon.exe
4360	UEPcon.exe
4152	UEPcon.exe
2372	UEPcon.exe
2236	UEPcon.exe
5532	UEPcon.exe
2700	UEPcon.exe
3312	UEPcon.exe
5444	UEPcon.exe
2664	UEPcon.exe
4436	UEPcon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6140-0-0x0000000000C60000-0x0000000000F97000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fd-5.dat	upx
behavioral2/memory/3548-6-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/6140-68-0x0000000000C60000-0x0000000000F97000-memory.dmp	upx
behavioral2/memory/3548-83-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/6140-84-0x0000000000C60000-0x0000000000F97000-memory.dmp	upx
behavioral2/files/0x000c00000001c605-97.dat	upx
behavioral2/memory/3484-98-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/6012-260-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-262-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/5688-279-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-281-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/files/0x000c00000001c611-286.dat	upx
behavioral2/memory/3844-287-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp	upx
behavioral2/memory/3844-290-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp	upx
behavioral2/memory/2244-292-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp	upx
behavioral2/memory/1148-310-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-312-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/236-330-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/6032-349-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-351-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/3236-369-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-371-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/5024-389-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/1264-408-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-410-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/1124-427-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-430-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/3956-448-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/1224-467-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-469-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/4384-472-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp	upx
behavioral2/memory/4736-475-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp	upx
behavioral2/memory/3300-493-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-495-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/4360-513-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/4152-532-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-534-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/2372-552-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-554-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/2236-572-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/5532-590-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-593-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/2700-611-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-613-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/3312-631-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/5444-650-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx
behavioral2/memory/3484-652-0x0000000000FE0000-0x0000000001317000-memory.dmp	upx
behavioral2/memory/2664-670-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuellGTA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6004	PING.EXE

Modifies registry class 27 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000e95c3372120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee95c3372f65c46292e0000005e0000000000020000000000000000000000000000000c56a6004100700070004400610074006100000042000000	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5a00310000000000f65c4b2910005175656c6c4754410000420009000400efbef65c4629f65c4b292e000000f6c5010000000d000000000000000000000000000000e4884a005100750065006c006c00470054004100000018000000	QuellGTA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5e00310000000000f65c462910004d414745414e7e310000460009000400efbef65c4629f65c4a292e000000f5c5010000000d00000000000000000000000000000047410f004d0061006700650041006e00670065006c006100000018000000	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	QuellGTA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5600310000000000f65c46291000526f616d696e6700400009000400efbee95c3372f65c4a292e0000005f00000000000200000000000000000000000000000047410f0052006f0061006d0069006e006700000016000000	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	QuellGTA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	QuellGTA.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	QuellGTA.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6004	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
3548	UEPcon.exe
3548	UEPcon.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
3548	UEPcon.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
2456	powershell.exe
2456	powershell.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
6012	UEPcon.exe
6012	UEPcon.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
6012	UEPcon.exe
6012	UEPcon.exe
3484	QuellGTA.exe
3484	QuellGTA.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3484	QuellGTA.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe
3484	QuellGTA.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 3548	6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe	89
PID 6140 wrote to memory of 2456	6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe	91
PID 6140 wrote to memory of 5460	6140	d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe	93
PID 5460 wrote to memory of 6004	5460	cmd.exe	95
PID 5460 wrote to memory of 3484	5460	cmd.exe	97
PID 3484 wrote to memory of 6012	3484	QuellGTA.exe	98
PID 3484 wrote to memory of 5352	3484	QuellGTA.exe	100
PID 3484 wrote to memory of 5688	3484	QuellGTA.exe	101
PID 3484 wrote to memory of 1148	3484	QuellGTA.exe	104
PID 3484 wrote to memory of 3672	3484	QuellGTA.exe	105
PID 3484 wrote to memory of 3844	3484	QuellGTA.exe	108
PID 3484 wrote to memory of 2244	3484	QuellGTA.exe	110
PID 3484 wrote to memory of 4228	3484	QuellGTA.exe	112
PID 3484 wrote to memory of 236	3484	QuellGTA.exe	113
PID 3484 wrote to memory of 6032	3484	QuellGTA.exe	117
PID 3484 wrote to memory of 3508	3484	QuellGTA.exe	118
PID 3484 wrote to memory of 2096	3484	QuellGTA.exe	121
PID 3484 wrote to memory of 3236	3484	QuellGTA.exe	122
PID 3484 wrote to memory of 5024	3484	QuellGTA.exe	125
PID 3484 wrote to memory of 4564	3484	QuellGTA.exe	126
PID 3484 wrote to memory of 2512	3484	QuellGTA.exe	129
PID 3484 wrote to memory of 1264	3484	QuellGTA.exe	130
PID 3484 wrote to memory of 1124	3484	QuellGTA.exe	133
PID 3484 wrote to memory of 3212	3484	QuellGTA.exe	134
PID 3484 wrote to memory of 120	3484	QuellGTA.exe	137
PID 3484 wrote to memory of 3956	3484	QuellGTA.exe	138
PID 3484 wrote to memory of 1224	3484	QuellGTA.exe	141
PID 3484 wrote to memory of 472	3484	QuellGTA.exe	142
PID 3484 wrote to memory of 3048	3484	QuellGTA.exe	145
PID 3484 wrote to memory of 3300	3484	QuellGTA.exe	146
PID 3484 wrote to memory of 4384	3484	QuellGTA.exe	149
PID 3484 wrote to memory of 4736	3484	QuellGTA.exe	151
PID 3484 wrote to memory of 4360	3484	QuellGTA.exe	153
PID 3484 wrote to memory of 1964	3484	QuellGTA.exe	154
PID 3484 wrote to memory of 4852	3484	QuellGTA.exe	157
PID 3484 wrote to memory of 4152	3484	QuellGTA.exe	158
PID 3484 wrote to memory of 2372	3484	QuellGTA.exe	161
PID 3484 wrote to memory of 2572	3484	QuellGTA.exe	162
PID 3484 wrote to memory of 4596	3484	QuellGTA.exe	165
PID 3484 wrote to memory of 2236	3484	QuellGTA.exe	166
PID 3484 wrote to memory of 5532	3484	QuellGTA.exe	169
PID 3484 wrote to memory of 4256	3484	QuellGTA.exe	170
PID 3484 wrote to memory of 5392	3484	QuellGTA.exe	173
PID 3484 wrote to memory of 2700	3484	QuellGTA.exe	174
PID 3484 wrote to memory of 3312	3484	QuellGTA.exe	177
PID 3484 wrote to memory of 5876	3484	QuellGTA.exe	178
PID 3484 wrote to memory of 5444	3484	QuellGTA.exe	181
PID 3484 wrote to memory of 1788	3484	QuellGTA.exe	182
PID 3484 wrote to memory of 2664	3484	QuellGTA.exe	185
PID 3484 wrote to memory of 4192	3484	QuellGTA.exe	186
PID 3484 wrote to memory of 3448	3484	QuellGTA.exe	189
PID 3484 wrote to memory of 4436	3484	QuellGTA.exe	190

C:\Users\Admin\AppData\Local\Temp\d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
"C:\Users\Admin\AppData\Local\Temp\d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "try {$null = icim MSFT_MpPreference @{ExclusionPath = "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA"; Force = $True} Add -Namespace root/Microsoft/Windows/Defender -EA 1} catch {$host.SetShouldExit($_.Exception.HResult)}
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6004
- - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
    "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6012
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-25.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:5688
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:1148
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-31.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe" limiter:get
      4⤵
      Executes dropped EXE
      PID:3844
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe" property:get GTA5_Enhanced.exe FramerateLimit
      4⤵
      Executes dropped EXE
      PID:2244
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-37.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4228
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:236
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:6032
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-44.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-50.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2096
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:3236
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:5024
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-10-57.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-4.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2512
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:1264
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:1124
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-10.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-17.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:120
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:3956
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:1224
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-23.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:472
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-30.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:3300
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe" limiter:get
      4⤵
      Executes dropped EXE
      PID:4384
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe" property:get GTA5_Enhanced.exe FramerateLimit
      4⤵
      Executes dropped EXE
      PID:4736
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:4360
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-36.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1964
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-43.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:4152
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:2372
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-50.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2572
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-11-56.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:2236
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:5532
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-3.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4256
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-9.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:2700
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:3312
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-16.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:5444
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-22.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1788
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:2664
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-29.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4192
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-7-22-6-12-35.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" QuellGTA.exe
      4⤵
      Executes dropped EXE
      PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QuellGTA_log_2026-7-22-6-10-25.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-25.txt
Size 277B
SHA256 3297bd20bcaf67718d11edcf43c90f1ab30476e4d0988a1fd5a5339e6886b21f
MD5 edc28aaefb5020ea713d0eefe02b0ded
SHA1 709c888944f08939166f8250323ef9cf5040185b
SHA512 4b98a1d025568b50fb0560d3a25a342182329308054b47460b3675b084569dd5ce895edc8c8c8b13cb871b472a48943c350438e3df12d0d6e615e55a3e4a165f
TLSH
T13DD017DB435771B6A3E1C44653A02AC65D6CCE4E06415D33B19A309AF98C2AA0F3A6D0
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-10-31.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-31.txt
Size 136B
SHA256 6de8fbe9d761a7a540bd6431da9e45a1b2c037995caca5584e3add19af97f6c6
MD5 adb586dec32ce37916b6120538cfa1a8
SHA1 59d73106216832653a02668225cd47441c0d02ba
SHA512 35501b8ce17977b855abcb5662d4ea8abe4dadf6ad1675da3bc2f6e914b0e5ec834bbeeb3da66adc5e1b1c57ec9c834e01189eb87cd74c8cdfd35b09d4757ced
TLSH
T161C02B1F130F823A5350805513401FC64E1C92460144D232704F31C1F84D3830F0F140
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-10-37.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-37.txt
Size 347B
SHA256 8eca95d461a5bf19014cd0c1a0b2e3f2b08d3c5f6b54cc7d621f0b00dad70831
MD5 84d9a73a11fa6033e5682e07e84a17fa
SHA1 bc2334e5f7a0085a890b36a8b96dcd89e00c6493
SHA512 007cb6ade137502fcd166fbf262d9dcec50f8411addae7202e06e0eb0da54424016d2b51d5728b8d626ba76a94a2eb978e236c4deae3c70cf5c357e40a451b5a
TLSH
T117E0C62F07268233A3E0804768113BC22F0CC0020301A33221ABA3C18E8E26B4F5B240
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-10-44.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-44.txt
Size 136B
SHA256 170126bd41c701718ecced0068f4b05383f220832de8d4e846d9320f37ffcb3e
MD5 20a4f12d97f917839a5476d862d5fde6
SHA1 d94b669c175ac8ecc494e3355f0f35e79fb14cba
SHA512 24c8c2f946327fe47eb5d0bf8e540341c8c715e10f4d3fad6b7b41b1879765d3d60472631672ab3ea1cbca123fb03119b7a5e105d6f8377c1184f5b334699ed3
TLSH
T1DBC02B2F030F033BB360C09413201FC44C0CAA420200D236248F39D0684E3134F1A1C0
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-10-50.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-50.txt
Size 136B
SHA256 030abd994f7f7f580b6feab43594464010e67c7595ca74a0ac8ae0324cf10179
MD5 2899f7f88628be61e127ca648b62a8f4
SHA1 edf21b36b729f3e9b60ce8f472973eb5525a48bc
SHA512 4770ec13bb33ba24820855529b1815bbd36cb5fd060fb6653117dab724f33b02e53d3e15c7d5c96e89aacaf7994ba62a0f61789de7e123e5135fc583d210d777
TLSH
T168C09B1F130F527E5391819557172FC45D1CDB424244E53F665F3955688D2534F1A5D0
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-10-57.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-10-57.txt
Size 136B
SHA256 dc150e7c4cdbec4ca04f804586a2c374920cd5e7d5fb0ac9bc109b5330336781
MD5 b8122cb1969abc96dc7703ad76231c73
SHA1 055345bfe153099ebf989553a8dc4abc269730db
SHA512 0f13d0cb29027418089eb3acf353cd7f693940e43f98fab764e46a69278dd4481f93e25f4e79db70e6804fe938ed0b9585ca0e446cb4f07ee6b68bd15c72e0a7
TLSH
T1CDC02B1F030F023A93A4805437031FC90C0C87420140D03E614F30406C4C2030F0AA80
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-10.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-10.txt
Size 136B
SHA256 a8f7152862995a644cf6f07fbbd8d7cf4f0111826648b091576fc640aed20d8d
MD5 c694fd61bc49f1ce4fcf9a8be8ac8424
SHA1 c81ce9dab42ad8454a217ba14a0fe319c94a73d5
SHA512 184277561b7a195f70b37244ad5a59a203b4f211dc6b76dfc694211b2933890345cb0772d7948601d78faf4aff262a268ac1b74c74d327cdf178158914152463
TLSH
T157C09B1F230F127E53D1815657351FC5551C17CE4344F536657F3459A045253573B390
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-17.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-17.txt
Size 136B
SHA256 9428ec4018e6a3c103bab5c5bad5d87821b93962290162e6dcb1dc6162d69e6e
MD5 192fc4ca6520b782100bdb24fc477680
SHA1 eabb6fe9f755560a593139fd734f4c8ddfd2137f
SHA512 c36211c47fb62b7ef2551d6b4a4aed27b803d0d5aec9d603362ecd9a7564cda721212d3a51d19925fad7ac2e58e444d32264bc6701b235863b2a2c518efe5fbe
TLSH
T164C09B1F230F127E93D1825557352FCB5D1C16CE4244D532757F309DE044253673A150
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-23.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-23.txt
Size 136B
SHA256 3f71a4128e6e886f0377437e015bea19a3198e99b5ad5113a7a914c6c9aa1db7
MD5 3a69d2e99e73e13bdc52fa92feb7fb7b
SHA1 578cb3c46f417cc545264711e4a8802dbf606d0f
SHA512 43c1e4ba39b93d528b7cc9b82ffcf405affeef079f05490d0d7823a7a6e45462d1debf5f9c63f62ed0a7a9364dd06d9e1edb85710e26ba937ed3604ff9b1c658
TLSH
T18AC02B1F034F423EA3D0819813101F85080C22CF0310E432297F30557040203032A180
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-30.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-30.txt
Size 136B
SHA256 6e867773e6a8e8d138905ee7018134c3cdf554b832c46f5a7c250ec156292904
MD5 b889944247936ab1c5d3c36f490e58c1
SHA1 2080a4ac75bc419564220d4f763e48ee371c49a9
SHA512 3a2b272f19d86837aad3c3bf47eb7c2c2761453b4b65323807ed770a0cbb8e0438afb197cfafe230dcdcbc8787a1ec856959ddcad58b02c2bba7b7b530c5e29a
TLSH
T12CC02B1F030F423F53D0805613051FC8050C038E4250F032707F31407042253030A150
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-36.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-36.txt
Size 432B
SHA256 685088f96454fd7c98ed335c2d41888604736784eb73a0bca08138b661805139
MD5 3e09a649c54ed09550f73cf429c00edd
SHA1 c7794db71c2c66a4bf2d11ba122b2833468a2e58
SHA512 6cf7f528f2c1ca5d8e18db56e163f543a2ea0206aba34314b0152f4b199e5c946d285bb292c215a9f1073bc63157a3f027a36f5e8f066aa430f1e6cc05ff7eb3
TLSH
T156E0552F170FA0B662E180464C213BD91F0CC64E43445133617EB3DB034A24A471E1A4
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-4.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-4.txt
Size 136B
SHA256 ed2f5bf4686671d93c81c1b28b9e12e59819338e76f23129e8dbc74a03f827b0
MD5 9c33a16a5adea12ba3422ba0e3b6dbb6
SHA1 03e2e0ec2bffb9a8574919aefe02516913c94472
SHA512 5fdd1afeb4c82b169c3cfd0fe3f0c1093136fd3cc935fa957b591a2fbb57d8bf5c1719d0a39ad5e4ab404f6529cbcc6160baf634c1d0f30040ac22ff3fa430a2
TLSH
T186C02B1F030F023A93F0C05433121FC50C0E02470240D13E245F345064482134F0B344
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-43.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-43.txt
Size 136B
SHA256 c9226cb0220fb53b10de9725a45867ee5fd96ab1ab69da08df30b581192f2570
MD5 b81fa57bda43b7300665cf588cedd8c5
SHA1 b2829b0018ade93de8368071741b758fe2d0778e
SHA512 d917d0213239cccb08158d4c4d96ee41721f955fd91f22dbbd6e581621853eef0217d0d41660a97b9cffe086dd9bfecc67bc70aee7930983fd5b0235707fb01e
TLSH
T1C1C0223F030F233EFBE080A823002F88880C028F0200E03228BF3288A08A323230A280
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-50.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-50.txt
Size 136B
SHA256 99852712fac3d3d4f2c650a899d84283b9d2ca562e1cd67ebb2cfd0e46595219
MD5 1c6f344a3037ba2aea849816b7b80dcc
SHA1 1cdae3979debbfcee5da7b249b6b918063dff034
SHA512 602f866b40bcdf2bdf1fc6175a148b037462c22ff2ec0e158211b69287515667cfc5c9eb6817a9f0e3786aab6f594300632305a07c3145a80139ac4c4aec1687
TLSH
T1D3C09B2F134F627F53D1815657072FC4551C174E4144D537657F34996088257571A150
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-11-56.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-11-56.txt
Size 136B
SHA256 13bfc7019bd12609e9ab55f6f42041c055550d12bd72d7bdd91ab9549fb0752c
MD5 23ec88da815619992e8fea8ae27c322f
SHA1 dc7b1aa7abcf3e9c09b77ca12a8234846a826de9
SHA512 1db05c367398c4ecfd4a3a8fda1d7978fd357d55e127aa798373385915a003929b686c40e49d4b840f958bb916cf5525c61f08862deb8bb8b38e8df68b08d46c
TLSH
T1C8C09B2F130F127E57E181D577072FC4591C174E514CD53E757F3055644C253471A150
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-16.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-16.txt
Size 136B
SHA256 dc30fa86e29214004f1b8f893e12c5e46d335a0dc1c9763468db4c8dc215e4c8
MD5 8ca600dfbd6915092e04eb4aa2527ba0
SHA1 97445303e6104d4a2deeb6a0c2c42c6fc0a3c6a9
SHA512 9c10c2b877e3f08380e0a73b58ce2e9006262198f58179cb10c73130da062cc4acc9692d406f9b8f1a9a3c8867704a182b190f4078f2f8909a1d8838e34a484b
TLSH
T17CC02B3F830F023E6350CC5417101F85040C07C60100D8322D4F3040A080213FF0A3A0
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-22.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-22.txt
Size 136B
SHA256 04ea0673d881b5b438bd633e541844158778cd2e73a7e7c1c4fad7fac94aab07
MD5 73209555cce836a07df04b1630ef9ad6
SHA1 bace643a6d942af41e9403eb640e2c148d20eb45
SHA512 0176e7c3cc487d1865c24248bd6b81c8126fb73121ea34ea0ecd449616dd320b0c474f97b40dcbb0d5df6f783c23a7347621126cc76ce1792cedbf0637a81ba8
TLSH
T1ECC08C1BC30A022E53A0889813202A850508168302009432794B3042B040203AF0F340
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-29.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-29.txt
Size 136B
SHA256 b3b07cd55965e7c1f227315d3d4b520a6498c5fb12fb9d9bdcc94c59e03b79ad
MD5 7e07305aa10e4f4e4670897d6c955f96
SHA1 cff4df2aeabd079c65e38a8489067a66c9cba080
SHA512 ab39f4c6ae43e5ecd5b0750d66cff6be1eab137ebc98764427e9ab3d1e8671da25acc41cdf0d5a6d031072ebaf7dcbc129387815b4bef99c2fef02bd81d2a22d
TLSH
T11BC02BBFC30F033E93908D9817003F84040C82438101D432714F304270402036F0F360
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-3.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-3.txt
Size 136B
SHA256 462e91a0057c4695771a7e91212ea351227cb3b66d8f9e4ef9c62bd577bbc29a
MD5 84dafbd646c3de321203d7f352b326b5
SHA1 fe77d757d29e9af05dfe8987ce2f7aa181a8f864
SHA512 1839eaa445a6ed7ceb12b0ecdc3c0a02341939c25a0e2b025a77d725485083b1af062a6a96a4217e6662308fe4bf2e2623640144cec11088f08f634631ef37bb
TLSH
T157C02B1F130F023E67F0869433022F84050C02460148E03E245F3040A0483130F4E340
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-35.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-35.txt
Size 136B
SHA256 5ab023f4836102337f6d35c9019b5a1c7bb4ba393146e08541e8e8e0a2e52689
MD5 7e52d6ee1aea8e7b8bb3d3f5cd7dcf5a
SHA1 1f99c7cb1aa5bbdc067aea84cdc3bb01cb87a981
SHA512 2674da447187b68a19d1a26c03755b292561dc06f5f1450095a8459043770ea83ce6dc5e49346fd6b80c3190264ab2b0517c2bbf258d7fe1bac6633fc32ea58d
TLSH
T188C02B2F830F223E63508C5E73403FC4041C02C28201D033705F314070812132F0E364
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-7-22-6-12-9.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-7-22-6-12-9.txt
Size 136B
SHA256 7cd4580b60d9083e1e06c78cc0285783b5fc71d23a507087568eead1fb53ebeb
MD5 9a73445c431b73c4a2f81a0c061bd59a
SHA1 d0cfae4193fcd9666fc21c7238b9975f75020dce
SHA512 4113457b154e618675d2a3d2e03795431883fee0aea6c93caebbbf44fc4dfe4337c585d7adef23a9681a871d994712f7c0ae02264701c3fda82fd955b3cdc573
TLSH
T1F2C09B3F930F137B5361CF5557052F94551C16464154D53A654F345560842637F5A3B8
MD5 SHA1 SHA512 TLSH

Submit Download

MscriptA.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptA.txt
Size 648B
SHA256 7cfaeba9e0c3664aaa199cef7a49490ce85ecbc5194fd3b2ef88b2ce2d2977be
MD5 babd6484ec248b1de1b3789bd69f2d5d
SHA1 acbf49a8785c4e26bae84c678866f6d874664b5c
SHA512 00a42da4206028532b49e0bba2f0c38c630ab6e11b93d66c773d10a61366e36074ed0a7ca5df8d6d0b2df3ab581957476a82d7ef06226e93f0f8c117c2f38fcc
TLSH
T118F04F7516CC3EED04430CC9AA59ACC301F2AF08C32908ACA6C02AE2D1435A0E27B9D3
MD5 SHA1 SHA512 TLSH

Submit Download

MscriptB.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptB.txt
Size 328B
SHA256 6d3601d239748223febb7570be5d690ba74a681aead8baa6a1675b9b9be98b06
MD5 6436f357a9767c2e437a72843246ecb3
SHA1 535396d648345f50b7a9b77fd4a3a6e40c42d5af
SHA512 e152a6023c89a083f6221632dfbf12748c5bef5b33e780d7d2f2467c22414e96a90a62dd460c8e9b1bc0852ad38d7797482fd515e6acc33431d100f2ca61eab9
TLSH
T115E0947516CC3EED04430CC9AA59ACC301F29F08C32A086CA6C01AD1D1435A0E27B9C3
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.exe

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
Size 1.1MB
SHA256 d2ed0533174db447c4c9f9b4f0d53e4a530f13d350f8675e53a1ab6c9705c668
MD5 b1de17d2edfec9c2e9a730eb4cb27c01
SHA1 71612859d21025f21976ba089f54f7b79c49de68
SHA512 b582e1455b4b8a9b5cb63156e24bed20d5c550a810355029114d34effb698732b3e3b4e017d3a7d24986f30346d531455dc0945e1c2ef23e33e1b4e142204b73
SSDEEP 24576:LqgK76BTFiApQ0aeuoTR3G16qdPIyAL4IFdhozojwJ7lB25DACQr:w7ATFxpQGuoV252y1IFdhKo47G5Ds
TLSH
T1F53523596E1124AEE5224C70E8766DF37F38BE5309450527CD88FED930BEBC22B82657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 80B
SHA256 ecf97542395dd90ffe852036a277247af9f1d6dfca91998b6d72661efa56cf91
MD5 23bda49421b5e4aca794aa68eebda041
SHA1 ff66d1812fb133f6671d7bbc5170df4f9cb7dbec
SHA512 c3d9cc10ee011af826075d2aca3d08d9a3943b74a0bbdc3313ddf0806c641cfb0531f8bb1a17f0ebe9ab945fd5e737b694c3a69b59f3632163fc1c99165a212b
TLSH
T14FA0220BC82303F0EFAA000A802B00B2E0C08C083E2FF000F08030008C3E0B0CA0CB2F
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 25B
SHA256 9df85000bd500a8245fc19582c7c30dcb7a651949e521605905f76cc1f74ac9b
MD5 3380ba99b98aec1b6d98d843c14bb8e2
SHA1 983221c8b5923b7f3b63826d4293981b66337955
SHA512 d2d518951b536448ff57906decc0019ffee57aa0d6372898e8e2b3c678e5f6ddf850d7994923d6d4886f5ec84dcd5bb8b34ff966b438e4678c664aa752919a41
MD5 SHA1 SHA512

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 299B
SHA256 48854458e223ad214ba1166e4ce0f24eb3e80d1e787d467c298b3975510815bc
MD5 d5bd28204b4893c12674aa8fc53a412a
SHA1 1b3c9e9c7f4778d7191d79eac46434f0bc394149
SHA512 ce5d965ffaf74b1093aa5b00f29c2617aea9f52355a7311f2d4df13d63ca7caa3c67c52d1fcf2c04b7d21a27a74b174595e5821651be2acf7b5ae9591ca8d034
TLSH
T105E0C25F49C32A74A58A48820F67789AE3F0C4693EB9D058E96CF1190915B34D607A6F
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 299B
SHA256 a18d018796e5bab5fec4ac269b089e2952d3be3d996dacab408bd2740998172b
MD5 c1e714603433312687fd839198456343
SHA1 2c8742b154f9889dec522bd8cd7e15598c059828
SHA512 ed8ee933aedd4ea7ff12345a84cd33847e176484f37fd1c94029b857e77b3589550676256e384cabc609ae9137ad19ffa78f8b64c1463ad841d335684bd8933d
TLSH
T119E0C25F85C32A34A58748820F6778E6E3F0C4693DB9D058D92DF1190915B34D607A6F
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 48B
SHA256 f9cf5304ac5a681ee8217d26c7803d18ecc95f4a85eb0ed7106d99cd74f364eb
MD5 62995989fee7ce6b63012294194d0204
SHA1 283188abe11c941140a854efec58f950ff6d7bba
SHA512 4df19474aea7df4360b32144cb49bbec12e6dff2fb1f9422e25abf4c8e5ca0d886b1377eb7a2473a64a634394b898a016c883f41ad8ca37c3e414045df64aead
MD5 SHA1 SHA512

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 299B
SHA256 5de69ef4f7a288825c10d2a1294421e3deb2e2d5cd8917d5fcffcd2f8172f71c
MD5 443bc775a9fb53e12c29b602a43a6a84
SHA1 43ad1ef268f242e1515e270765ff0b3b8be7ffcd
SHA512 6df6af591bfbf986e0ddfe71ea0dbd395f47a3b3ecc2e13be90613dbe6fea2fa2fa09529243a0f94a8849b8a48433b9269eca84d5c2f8dd408e2275a6aa0aedc
TLSH
T140E0C25F89C32A24A58B48820F667896E3F0C4693DB9D058ED2CF1190915B34D60796F
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 80B
SHA256 3c3522c2c523da3992d1e28db78cd62cdabf3c8046a7275c75fc0f3f7a71ab69
MD5 15aea200a2e52e7770874f3770dd5d2f
SHA1 46585d342077447e5f4b96582683124880b22063
SHA512 6d72bb0fd386477123759fe4f30c958160cc1cb76129aec900a573068d77a164c7ccb0b51995cfdf911e19a8ef2375c5fcc2f0fef3b24d6c65ba8f315492d76b
TLSH
T185A0220BC8A303E0EFAA000A822A00B2E0E0C8003C2FF200F88030008C0E030CA0CB2F
MD5 SHA1 SHA512 TLSH

Submit Download

RTSScon.exe

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\RTSScon.exe
Size 13KB
SHA256 24509a643c143a166c7ba8bacbb74d1e52a60f1b05a9c90c8c385327f93d50c1
MD5 d298ab20474b72ada68be183bec0bbe9
SHA1 a35b455837b4c3a39a237c12c9bb4160c8c74891
SHA512 f0665310b9909d16603b9e3b6e1e29e116d8e7fece560eb5973290388e3a21c034742f686da1d855cd6e6edf7ebeef3acdf9d48f03c4f970da7f245528d0635c
SSDEEP 384:E/zgsmsjkMojvV7AysZ7Lm6YtkCnJ6xNoWOOMMOcYeE:Eyuz09O7qfuKJ+oOWcD
TLSH
T1DB52BF8BB6742B5BCEB31537F1EA81FB8270DC76CD409742C9990F1229F8294526239F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Restart.bat

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
Size 130B
SHA256 4d51db3082d2c896eb5f334d6c5a643adbed9f02ce2620735e5909f0c1bc1060
MD5 1ce81a018da66d28a9f555710d5dc043
SHA1 ca43fd8cda0cf40622f2294a8750292b68971a5d
SHA512 7994d140ea26730f5fea7b0fb834267460b49249d5de7b68d44687ef9d4113592cad8bc6e1c73c16c006b896b761be44cb6c596cddfbf4755b0e0a818d5def0a
TLSH
T1D3C02B171CC04228690704D302B53559D0E5405C2600A0CC8909FA841287D10E04D001
MD5 SHA1 SHA512 TLSH

Submit Download

UEPcon.exe

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
Size 18KB
SHA256 e19f7ce38c4f4dd0f22d5a437b5c6e1e36245dafdc4d88fd96e5e188e1f9fcbc
MD5 6c24ae28710d6d43c0177b82d80727c3
SHA1 e9bc3621047016eacce3bfcfbf1497f8685c92d7
SHA512 25f869a9e475799a92ebf89043a94eb22a489849708dd40722dfdb9cc7f2659251267f1a596c9338ce4f5f0cdc704fc03b5621d8e43a0c04095454d94a53c564
SSDEEP 384:SX7kVGVRI0JvAgnTI+EsPyrHloJl7YNMb4w6GFgKyfBcQehk:SX7kVG0iognTzyrHlov7gc36hKyZcQY
TLSH
T1A282C08DF63980D3DB496835D0F0094E13A279A1A15A93B92D09165D2FD87367F8F2F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-330-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/1124-427-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/1148-310-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/1224-467-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/1264-408-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/2236-572-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/2244-292-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp

Download

memory/2372-552-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/2456-76-0x0000000002650000-0x0000000002686000-memory.dmp

Download

memory/2456-241-0x0000000073710000-0x0000000073ECC000-memory.dmp

Download

memory/2456-90-0x0000000005160000-0x00000000051C6000-memory.dmp

Download

memory/2456-91-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/2456-89-0x00000000050A0000-0x00000000050C2000-memory.dmp

Download

memory/2456-71-0x0000000073722000-0x0000000073723000-memory.dmp

Download

memory/2456-85-0x0000000073710000-0x0000000073ECC000-memory.dmp

Download

memory/2456-94-0x0000000005B70000-0x0000000005ECB000-memory.dmp

Download

memory/2456-96-0x0000000005F50000-0x0000000005F9C000-memory.dmp

Download

memory/2456-86-0x00000000051F0000-0x000000000583A000-memory.dmp

Download

memory/2456-87-0x0000000073710000-0x0000000073ECC000-memory.dmp

Download

memory/2456-95-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/2664-670-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/2700-611-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3236-369-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3300-493-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3312-631-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3484-351-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-554-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-430-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-410-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-469-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-652-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-98-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-613-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-371-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-495-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-262-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-593-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-281-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-312-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3484-534-0x0000000000FE0000-0x0000000001317000-memory.dmp

Download

memory/3548-83-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3548-6-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/3844-290-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp

Download

memory/3844-287-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp

Download

memory/3956-448-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/4152-532-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/4360-513-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/4384-472-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp

Download

memory/4736-475-0x00007FF74B070000-0x00007FF74B07E000-memory.dmp

Download

memory/5024-389-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/5444-650-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/5532-590-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/5688-279-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/6012-260-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/6032-349-0x00007FF74BC30000-0x00007FF74BC43000-memory.dmp

Download

memory/6140-0-0x0000000000C60000-0x0000000000F97000-memory.dmp

Download

memory/6140-68-0x0000000000C60000-0x0000000000F97000-memory.dmp

Download

memory/6140-84-0x0000000000C60000-0x0000000000F97000-memory.dmp

Download

memory/6140-1-0x0000000000F96000-0x0000000000F97000-memory.dmp

Download