bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Size 1.5MB
Sample260815-sdh1psyejd
SHA256 bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a
MD5 8836738739c3c9ae98349e11d9a99551
SHA1 6d8558d77ad2c50f3ab7ffbf679b6e8b2cebb960
SHA512 c4524628804fa90717b611598b86fc1f8cd3fca259c051ad62982b12a52948b1bc83fe58a241d067185a25bc2cfacece128dfc1ce48d415d02b4b687b7367232
SSDEEP 24576:EY+j/LlA1Sun6T5Jkqmbo+4ETJj48mDKIT0TJkPQAaJlhExLRKSvNjq0/r:EN/Lq1Su6DkthtHmOIT0TSPQL7hcN1/
TLSH
T1217533526FA96EDAE04308309D3D19D69EADBCC39D120410AD5AFCEA217FDD943C3267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5092	UEPcon.exe
5128	UEPcon.exe
4948	UEPcon.exe
5100	UEPcon.exe
3872	UEPcon.exe
5296	UEPcon.exe
5288	UEPcon.exe
948	UEPcon.exe
3120	UEPcon.exe
2428	UEPcon.exe
4400	UEPcon.exe
920	UEPcon.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/552-0-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/files/0x000c00000001c53f-44.dat	upx
behavioral2/memory/5092-56-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-105-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/5092-119-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-125-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/552-144-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/5128-162-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-182-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/4948-200-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-202-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/5100-238-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-240-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/552-253-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/3872-267-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-286-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/5296-298-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-299-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/5288-329-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-331-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/552-350-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/948-368-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-388-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/3120-406-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-425-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/2428-444-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-446-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/4400-482-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp	upx
behavioral2/memory/552-484-0x0000000000440000-0x0000000000792000-memory.dmp	upx
behavioral2/memory/552-503-0x0000000000440000-0x0000000000792000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
5092	UEPcon.exe
5092	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
5128	UEPcon.exe
5128	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
4948	UEPcon.exe
4948	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
5100	UEPcon.exe
5100	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
3872	UEPcon.exe
3872	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
5296	UEPcon.exe
5296	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
5288	UEPcon.exe
5288	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
948	UEPcon.exe
948	UEPcon.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5092	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	89
PID 552 wrote to memory of 2780	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	91
PID 552 wrote to memory of 5128	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	93
PID 552 wrote to memory of 704	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	94
PID 552 wrote to memory of 6124	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	97
PID 552 wrote to memory of 4948	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	99
PID 552 wrote to memory of 1512	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	100
PID 552 wrote to memory of 5452	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	104
PID 552 wrote to memory of 5100	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	106
PID 552 wrote to memory of 4340	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	107
PID 552 wrote to memory of 4588	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	110
PID 552 wrote to memory of 3872	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	112
PID 552 wrote to memory of 5296	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	114
PID 552 wrote to memory of 3400	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	115
PID 552 wrote to memory of 5288	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	118
PID 552 wrote to memory of 4252	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	120
PID 552 wrote to memory of 948	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	122
PID 552 wrote to memory of 4292	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	123
PID 552 wrote to memory of 624	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	126
PID 552 wrote to memory of 3120	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	128
PID 552 wrote to memory of 5992	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	129
PID 552 wrote to memory of 4900	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	132
PID 552 wrote to memory of 2428	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	134
PID 552 wrote to memory of 4872	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	135
PID 552 wrote to memory of 1140	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	138
PID 552 wrote to memory of 4400	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	140
PID 552 wrote to memory of 5592	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	141
PID 552 wrote to memory of 1472	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	144
PID 552 wrote to memory of 920	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	146
PID 552 wrote to memory of 4672	552	bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe	147

C:\Users\Admin\AppData\Local\Temp\bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
"C:\Users\Admin\AppData\Local\Temp\bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-42.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5128
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-48.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-54.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6124
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-1.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-7.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5452
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-14.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-20.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5296
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-40.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-0.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-6.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-13.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-20.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5992
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-26.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-33.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-39.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1140
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-46.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5592
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-52.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
  "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" bca574b66f3fa406730c1a7bfdea80cdc29ada7fbabd8764f4e262ae7ebe289a.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-59.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QuellGTA_log_2026-8-15-16-0-42.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-42.txt
Size 35B
SHA256 8360ebd1343448e1b915e4bfe0774353845a822609327ea0bc4d18ef8f04acc3
MD5 420e0d2a02c1c446104fe4a07c07bbe9
SHA1 bfe38381a0cb668c545aea9325514d8db8cf961b
SHA512 a3c04d674d19447682adabefb63c3f1b3fa00d2feb7c52e47b514b4f8d48b6d10432367490e8a369354a7927dc72347d7d3900d47a36aa794fb5e43606636674
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-0-48.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-48.txt
Size 27B
SHA256 ec73f4a73f681522b260a76f6c05dfef17ee2e5bd190d7290cd752facbcaf3bf
MD5 d36d80f6741ead267a0443f4b6aaa867
SHA1 5910b54098204d647c599b0b98197ce82342d82a
SHA512 de642ceffa55564195d0609f5b08f20e79803e28f7979e77ee0acfecdd3e27da3e04d703b41343eb84fe4e4d393ab2810c990d14bae4c1123cf0f9139c96cb66
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-0-54.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-0-54.txt
Size 97B
SHA256 06aafe9de303e4d8def5d22cb1c79d7c32eb8010b212496084e9afaefe20d7bc
MD5 5a15772b0e8ffbbc2a1d7d155dd26cbd
SHA1 5023825312b03791863ff7874112779ac3ceb0ca
SHA512 7e7d1564f1c3497897554af9b052ce26e2430c2329d6b0b8fe731bb28fd812c7f79147e8fae71701f3af5785bcf0c776ec828bf54009074d6a2ec0956b194d87
TLSH
T16DB0122F232B5269038141D97B0406C308801A424100C53F940E3418F8CC252033E556
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-1-1.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-1.txt
Size 58B
SHA256 88a369e209d5729995932e5eed9dcbed7997f61593be6e5a6307be7500c47dd8
MD5 f7ea034ab8633b982bb4c804ba9ac872
SHA1 918cef88e2e9fe5dc31410561f08af3fd6a2e9a6
SHA512 30304caba283be01ff59e36c8e1a47ee725a28013188a0cf7b2765b1802e5f3e4ccb6a6f9af1ea6d2c8b73392c7e20c435664c435d5996867e5f5ff2f6506d8a
TLSH
T168A0021F212B4376472503887D434146489530425B44C832940E31119D80196487E5D6
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-1-14.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-14.txt
Size 27B
SHA256 b95c30a695831c15d4464cb62b4d1c418697cbca6774e09c8ced602d3b5f8b9a
MD5 c57b832e4a97e0901e3457121b609f0e
SHA1 bcde74cc7aedd4e9d86aaf54f1236136c8f39c5b
SHA512 7db2f2b117bb60f18bcac9d7d2d0d0d9cc6e4ccf140d7142547ed4a7e5992f70a7041c0821152da59beed302a90f47087178789da220aaeaa7738383aa5601df
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-1-20.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-20.txt
Size 58B
SHA256 e62c06dd1ffc91afe1d57eeadbc5156d8affdace161a125929d00aa627b0f80b
MD5 a9f66e4f3759e0b11d424c6e80ea6b19
SHA1 88bd614f46c3a2a6ee5a75640b04432b0a4bf510
SHA512 1be16f2daefc21b555687ad4bca5d70c3578d064d3570af874b6cff1ecfbcf84110d713da677b936af432f94612c987108e865be5167cedbd46cb36ddd5b3c2a
TLSH
T14AA0021E218F437A471401C87D4109474855304B5304CC32940E3115D2421965076194
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-1-40.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-40.txt
Size 27B
SHA256 207488a886dbc78f32a868144a1645db518d15fa1ff393608136b966c8963801
MD5 ad6d46ef9f9388f4a88d3e8c4bd7a753
SHA1 79ab76843a60c34f62677e494e825883a3007bc9
SHA512 519bfd9bf503fab714964cd03f82da0091bd4bc48445b7da60e6eb603e143fdc864e8b8038dc4582899baed438642c225b547d335aa3b6559470cf8ff25185ee
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-1-7.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-1-7.txt
Size 58B
SHA256 4ba770277277e14db78de920d8ab1b04b48680a93d3bbd5b2cc92dcc0fdcf34e
MD5 b062137791dd98bd98dbcc6a031070c3
SHA1 174ae7bda38a8cb10ecdb701726814369f882ad8
SHA512 8c4d1506c506fd62237405aa4abeb12890d61618604242c05b6776dc03c80306272d62d55e11ec4a5ca30cf6c7fced867d7202899969a988143855e44e0ec467
TLSH
T10EA00216611F436A472721C87A4103461855304B5304C836944E351290001AA50673D5
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-0.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-0.txt
Size 27B
SHA256 849c665e7e5dc07bf765c22b3eee5c0f3afee42bd1bcce1d3d81740c531141c2
MD5 d3cfb6601ba2ee13c5864b46bbd13e49
SHA1 ec2dc119d47ba40baeb8aa02840afd757f2c61ec
SHA512 854960c12bc762ece549d5d8f1d566d4d4f516f79bff7e0c743cc25211cb534b7f5a9c76d3518c5d218fe925979a6d4cabf6775122ffd69f80b37f89bda3a81e
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-2-13.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-13.txt
Size 97B
SHA256 deee09248e4fc8b4ae71434a89456f070f203c51fe3f6891d880b7bedbeffb7d
MD5 aa5aeaea91a3cbe18f1f7e3da9c86173
SHA1 a215813a7c0eba9abfddd425f10b25f775afe5d9
SHA512 5717a6a5d3e8d0797306fddd9c85967b7f5dd830bca529db451f5dcff116a9c40a84a34c29712a5f515e3c7a624f9889c2ab86da3c2882ef7725b69b1a67bdb7
TLSH
T126B0123F110B2269079069D977C8070308C013425110CD36B09E3018F084351CF26198
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-20.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-20.txt
Size 97B
SHA256 bf9bdfebfef837dbe9d64f7f4be63e432a8bc0977c5447a797f85c4c7bb752d7
MD5 f1d8815c46ab701ac36641c48edc6070
SHA1 89ad2ec3ee246e3304491faa7bff8e1358bbddd2
SHA512 9b58c9dd8cbf64441b4b239911d8cf0126d9cfb3d66706ae7f9efe39295d41e3421cca1912411c7b80d9b19bf4f90a57dcc1eb68bdf06b5d919649d5c63c2b7d
TLSH
T1F1B0123F120A126A078049D97B040603084026425200DD3A7CCE3018F0803511EA6164
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-26.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-26.txt
Size 58B
SHA256 8ab964ddfdaa1ae46b9a1e314a385d3248e8905684e5581c573f4c813b265557
MD5 93f6e701d1b427a1fbc14911c179caa5
SHA1 aeb877853e234407a1c3c3d41b4dfe86a50aed9a
SHA512 de428a15eccb3315b3b2c894d6082fe4180301ac8ce5e7b88dffefd050bb38bf8299bb4bdd2368d0acac22b48184ef2dae7692e835a1e1978471bc51b95f8b84
TLSH
T194A00236220A436647160EC87BA721860C55E2425204CC32B59E311190001924CEA194
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-33.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-33.txt
Size 97B
SHA256 458146992543811165cade98d1b456ce23cfc6c24e41fdc9a1d3905265b25de7
MD5 946331c924ac948e9898ae53788bdc6e
SHA1 10c26e813e37513f354946fde3e98adf8fdac449
SHA512 3565ba5ab8f0f199755dcf71c80f6161baf868572b23aecb4133e41f3fb6fac24a8682b9fa584ecb14118a946728d3b909720c5ff86d2d6c0bb3100db5a536ec
TLSH
T1F5B0923E110A1269078249D97744260208C0924251008D32B19E2019A080249CAAA154
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-39.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-39.txt
Size 58B
SHA256 8b223548a38189d520f313668027c05d79117c21666f8c5213e676897f37ee4a
MD5 449615620a57cbfb3e960a475bef12ef
SHA1 86f2f2d0837e57ca0592f091f0a070809179a2aa
SHA512 095996abe8d934f5e1eae0886954908d0cb3ae7366173dea07ff1d46006d50f10077c6bb9821d503fc32013fb6b1af8e4707e2e366f34839aa1e64b5fb577305
TLSH
T1C0A0023A250A6367AB18098879430186485522426204DC3AB4DE311190021A248A61E8
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-46.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-46.txt
Size 97B
SHA256 64d384baf79868827ee0b2c75a6059f96cb89322081f31f544bc2b5f55c5e44f
MD5 803075595f8c659e840f9dc1d79cbe9b
SHA1 a98d61e0c7b42ef30e1ac1ea1947cbcf42f38062
SHA512 8aa990ef51beca4e90f18c99efcf97b32177a6079fffa72c57ef689488634fcd4e58713b9e818ce2d0e356edf6b98ff30074da6fe14fda67a7cabcd26f61695d
TLSH
T1DBB0123F110E33A953804AD9B7454743084013424100CD3270AE3418F0C3A510E2A278
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-52.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-52.txt
Size 27B
SHA256 230882b6710e04dbf418dfbae61850ccacd2c1d7ef65c89fa471bf5c3ac86025
MD5 235180e3cebf8cc6ade4d48b8292c07a
SHA1 5a4078f6f9cb17ffac4c654c0fa005642e33e6c0
SHA512 981b1fdd4a60bd6a89307fc40d13728ec202411835d1415cd54960dd3b896a19d4f4f8e65232c5b89099c98b934e9a22c588a484a58fbf3806a1f5ab5f47e38f
MD5 SHA1 SHA512

Submit Download

QuellGTA_log_2026-8-15-16-2-59.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-59.txt
Size 97B
SHA256 f096f7f076ac99077eb4972a9ffe045d6ac5fb1336df7c2ae43989fe9b7f32fd
MD5 e326732141dbb7e337a4f84a58503efd
SHA1 4802f6236a26cf23b8d18bec4c98dbb48e4a198e
SHA512 90023622054883b588ea7b46f6792a2e156aab6d659622e1ebf06e5af62d606e0af92afce9056d26575c45f8d0495684e5a348a5ce56c02149619120ead7e1cd
TLSH
T1D4B0123F120A326B03A04BD97F17064308402B434140CD3370CF301EF0812410E27358
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA_log_2026-8-15-16-2-6.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-8-15-16-2-6.txt
Size 27B
SHA256 bd0df895addc4bfd0584d88d012d0820e7b2ee1553b9533655b1873bc1d8840a
MD5 ab0840a621f13f0928347b3947a4d1f9
SHA1 b7245d5fcbe5925cbca82dab48fc95dc4832d2ec
SHA512 5b0752767c895371fa9890b4c496e99cd31f76225ab41d6c4692ff48883a6650eefbb34e15f3662a37ea7e9215b7da5b0143c8fdb9d3aa4aa1c66261447eb7bf
MD5 SHA1 SHA512

Submit Download

MscriptA.txt

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptA.txt
Size 18B
SHA256 9bab2523093fd8c255c2cdb2e3325b7703d9bf9bf9cf7b3586aa888566726ab0
MD5 50b7e200a09318ce5e373ffada605133
SHA1 e45ddc19e0d9b03e5992abe8fef614460abd65ee
SHA512 2b464a2c7fe7a93dc704ef046182ed1c8c66d9c6632b2a7dfa7f2c25f402ebc94743b4cd06cc0cb98a5d521600ffc7472832531e5d777ce35b426028950e5b76
MD5 SHA1 SHA512

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 153B
SHA256 c73fdf9192f15c9084904b461a9913e770348e84ac758a59e0c3d036a5bc595d
MD5 f101220d1b0009f63445a93d110d2477
SHA1 ea577b7c0eeea9dbb366695b19c72a4ce22288dc
SHA512 6e23ea2e3bc9c32462a6a41c65d112cba8c7d5783baf0735e7affc00cab97248f20a00dcf2430bf2b222fa1f60fcdedb68905f582348b2b88cda74a60ceab026
TLSH
T127C04C5F51C6693052C95C804F233C89F3F0D469797884D5C96DC16E19117350517A6B
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 153B
SHA256 af2deb88bb236526d42e30b0d1114dc1b3345a227ba6303dfca8d5e98083c962
MD5 4dc1b070c968dffe8956664039cdb384
SHA1 fbc79b7266adc18bec7dee3a1c1ce2b3c9f5146b
SHA512 3d3cc9f1f4caf3699e9956bce867a16d338d311d6bd72d3f7bf52ee1024734d023cefda1058ed3412ccd4ec8986e7ad0f2c38aa5c3e615a839af66fd9148fdb1
TLSH
T11DC04C5F51C6293052C558804E633CD5F3F0D4697978C4D5C56DC16E19217340557A6B
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 153B
SHA256 9532601c94bd8f57734c738d5374b07ca255c285f47001a2d20d0f4475342015
MD5 fef37e218f68bae4e4e3176eefeb3b83
SHA1 1b0e2056959b84939271c64f7395ea060b754d33
SHA512 4a45349e4ebd653c25d75683ba5d8abbb9283bda83a25a92f756179040fd33313ea971423cd5d6ded0859d6f8d7cb859c0aceb6940db0e3d93791402c3242e4f
TLSH
T10FC04C5F51C6693052C95C804F633C89F3F0D46979788495C56DC16E19217340517A6B
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 153B
SHA256 39d6d11ac3f6f70302c8b28aaad4a5be019fdf43b87cdef3a3dedc192f47402f
MD5 d2eb0daf5ef42b8d1ddf3798d05199b4
SHA1 3f6186613311ed9ed1642cf006a4c9b66c55f424
SHA512 c78bb99312fdfc887a31d65b27bdde24c76685d4b9b444d4b224bdcfa720b53b9ce9a299812d86c62aca5c38e2aaa13bf240ac48650930cb3d502c3a2f56a02e
TLSH
T172C04C5F51C6293052C558804E233CD5F3F0D4697978C4D5C96DC16E19117350557A6F
MD5 SHA1 SHA512 TLSH

Submit Download

QuellGTA.ini

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
Size 23B
SHA256 0a1c1da1b01d62ca7f6d031359cc10ea0b85e38f7558f24287e04426ae50dc2d
MD5 aeef30588e67a62756e9cde002d59551
SHA1 e5ad55e13d90cb95c0f7f2fc8c5712f13278df4a
SHA512 2e15d27e615ccdf40ab7b735ef140eb8dc29e6d5be147b34c4e5ac1552501167eadc949ae26fa8977708b9f93ec459d4e07f53c91005ffa7e6f1be28a9a3376a
MD5 SHA1 SHA512

Submit Download

UEPcon.exe

Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
Size 10KB
SHA256 20f3de1f63458a6d4d1c6492b46671841241f24612b91b16fa654c6ec3f378fc
MD5 f6d33fd5e4beb7fdfb91d8c79f89f10c
SHA1 1aa658d93873fb44d186166d17e62f624a65b9aa
SHA512 2d98b9ceece61ea9e9970a305fa9f4eb7968e54069982d35353b4bcc8ea07fdd846ddb4617e24695586b88a436011cbb04edc7d3fdc6bda756b807281e681ac5
SSDEEP 192:kAGWnIlsP8dISygK05fqo3ENYDTRCMHEVO/T+Qk:khWIls0ayKkCozsMh/k
TLSH
T133229F4B637D855CC35A203195D0D12D23B8671F025C9B2CC7B10EDA3D986A297F91B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-144-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-182-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-253-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-105-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-446-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-286-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-503-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-299-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-1-0x0000000000791000-0x0000000000792000-memory.dmp

Download

memory/552-202-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-331-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-425-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-350-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-484-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-125-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-240-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-388-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/552-0-0x0000000000440000-0x0000000000792000-memory.dmp

Download

memory/948-368-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/2428-444-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/3120-406-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/3872-267-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/4400-482-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/4948-200-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5092-119-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5092-56-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5100-238-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5128-162-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5288-329-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download

memory/5296-298-0x00007FF6842A0000-0x00007FF6842AC000-memory.dmp

Download