Overview

overview

7

Static

static

3

91327e44cf...e4.exe

windows10-2004-x64

7

91327e44cf...e4.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4.exe
  • Size 3.4MB
  • Sample261102-jtqwtaf181
  • SHA256 91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionupx

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4.exe
    "C:\Users\Admin\AppData\Local\Temp\91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.wav
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" 91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5068
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.wav
      2⤵
      • Executes dropped EXE
      PID:3548
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.wav
      2⤵
      • Executes dropped EXE
      PID:4488
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.wav
      2⤵
      • Executes dropped EXE
      PID:1320
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.wav
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.wav
      2⤵
      • Executes dropped EXE
      PID:1120
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.wav
      2⤵
      • Executes dropped EXE
      PID:4776
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.wav
      2⤵
      • Executes dropped EXE
      PID:2084
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
      2⤵
      • Executes dropped EXE
      PID:4832
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.wav
      2⤵
      • Executes dropped EXE
      PID:4828
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.wav
      2⤵
      • Executes dropped EXE
      PID:2580
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.wav
      2⤵
      • Executes dropped EXE
      PID:1140
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.wav
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.wav
      2⤵
      • Executes dropped EXE
      PID:1912
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.wav
      2⤵
      • Executes dropped EXE
      PID:5624
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.wav
      2⤵
      • Executes dropped EXE
      PID:3152
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.wav
      2⤵
      • Executes dropped EXE
      PID:2416
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.wav
      2⤵
      • Executes dropped EXE
      PID:6068
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.wav
      2⤵
      • Executes dropped EXE
      PID:4800
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.wav
      2⤵
      • Executes dropped EXE
      PID:2788
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.wav
      2⤵
      • Executes dropped EXE
      PID:2300
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.wav
      2⤵
      • Executes dropped EXE
      PID:1852
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.wav
      2⤵
      • Executes dropped EXE
      PID:3752
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.wav
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "try {$null = icim MSFT_MpPreference @{ExclusionPath = "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA"; Force = $True} Add -Namespace root/Microsoft/Windows/Defender -EA 1} catch {$host.SetShouldExit($_.Exception.HResult)}
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4768
      • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
        "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe" show
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4108
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_v2lrpglz.ihu.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2lrpglz.ihu.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lame.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
        • Size 199KB
        • SHA256 4e29a900163f55406c76f31a47d70d17ec53cf9786cbffc17ab9f8b3eaef83b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s1.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3
        • Size 10KB
        • SHA256 c9fb6d3ccb4e34ff966e6ddc1538637c17d54552b368f146c00c7991eb1c837d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s10.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3
        • Size 8KB
        • SHA256 bf6dac71153eb7b6b8c35b8a21e4df033aa5771add64bcc0e8151a53f33eb127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s11.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3
        • Size 2KB
        • SHA256 6bae9fdf39167df3452d0e9cb7d547a795f60c2bc09f9667c619f370f191dda6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s12.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3
        • Size 9KB
        • SHA256 de6be44c98dc9dc1c8fee89edaa62d92a7abc68dd76aed393eac1852f34a048b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s13.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3
        • Size 11KB
        • SHA256 635c083c7d1add63f6f1f213187cfcb08cc199bfc92b4bc9eb3eaa89e1db0ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s14.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3
        • Size 11KB
        • SHA256 3afaeaab22e422d2a8cf1727f2e6e0f3d2c3b768eaaea8afb08b23f294497865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s15.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3
        • Size 8KB
        • SHA256 397a1322c6a6117c7d6e7772cbd9bdb27e82d4bc23f2d96acd215ff56de0ee45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s16.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3
        • Size 2KB
        • SHA256 f8953809831e0aa81b66c826b756b64a86f5e0da4239d65375ab7ba46968eb5a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s17.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3
        • Size 3KB
        • SHA256 840b52c4f7c13a362f271bcc75fa486bbda65d45295d099456ab4604773dc74f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s18.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3
        • Size 7KB
        • SHA256 d97348e84850b3fcc2c15050d73c6d6a968d1976c666e88d46b87aaa06fc2b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s19.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3
        • Size 12KB
        • SHA256 693b22f2b0b7ebc0703d6151be8bf23963066c7dc258df6b832f81073cb9436a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s2.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3
        • Size 9KB
        • SHA256 59411f1a3406f7e07fb84dbd62402eb68799e1e24c7f3129f9a3314991d5641a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s20.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3
        • Size 9KB
        • SHA256 94d017906a18d4436898c1ad8e6a04629c8edeff36ca80cf87d04ae822f718c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s21.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3
        • Size 9KB
        • SHA256 ad76c866bb89be2700099835f0d3349b384e4c7a7d7c0dda8c568f42e9247638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s22.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3
        • Size 2KB
        • SHA256 c305d92b52d610fef9051154f5ca269d976eb02a154d62e3d777fbc8b22c864d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s23.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3
        • Size 1KB
        • SHA256 26b5c899108c58b9421050a1fab96f3ed33c194dadd3035918643693ff9a987f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s3.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3
        • Size 6KB
        • SHA256 f2c62494f76717cfd1db4c92bcb71690bbecca55ad0fa8c1c023249cfbf78968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s4.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3
        • Size 11KB
        • SHA256 e9f474be1f11f7cdd350cd9a54bc689bd7a47bf28046c5f46d3a7365e3db4b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s5.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3
        • Size 15KB
        • SHA256 691e922463ac1c7be39da15e4035755e17740816cb074a7733ad5c0f3ecaeefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s6.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3
        • Size 12KB
        • SHA256 1f6ca9dd2dafb449b96a390f967863c94c17724f9604d4f28a752144a84a8fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s7.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3
        • Size 14KB
        • SHA256 a15f6690ff4305cfbd8ff5fdb34d2159d9325fae4c761a6ed1fa60706ab471e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s8.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3
        • Size 7KB
        • SHA256 e6dbe62df0e28626b02d73849c39e5bf641e20b9c2050e693cf9e2e14fef0fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s9.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3
        • Size 9KB
        • SHA256 88a3c68a8cf79c0ee0bda94c4d1429357bbe15caf324f1da1abd0890564e8f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s9.wav
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
        • Size 77KB
        • SHA256 ab7a10e13361aedb0764d14254bc5e213afb03d68af047b8556b3fd983542241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MscriptA.txt
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptA.txt
        • Size 18B
        • SHA256 9bab2523093fd8c255c2cdb2e3325b7703d9bf9bf9cf7b3586aa888566726ab0
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
        • Size 3.4MB
        • SHA256 91327e44cfd1cc4a1ec01b6b9a48e04c43f04f8cd61af32d2bd817e8760a06e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 43B
        • SHA256 7833e7423d7ca5516ed2d94b7c5cd31a38334086d3f6092d5bd3c1bb581c0b04
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 240B
        • SHA256 b48efb6d8e0ed44a0b7b05ffa28a59abf6b6b8500bb26b7a684609f73856fba2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 240B
        • SHA256 7183868d47b240d40fbb095145ef339aa4d3153d0e58e1a72c1a3753416b7d21
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 240B
        • SHA256 a059021aa6e128169033403dbbe4e65732065bfd099e2dcc3049ae28757a5c66
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 240B
        • SHA256 12cf4a788b3ecea2aea03a6fcb169218e316d065eb5a0eb82efb8b913b8a81a3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 43B
        • SHA256 1657a6822285e78ac3a643a0a95fe0dcebf395486a3ef977ee8b9037cd0541a0
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 23B
        • SHA256 0a1c1da1b01d62ca7f6d031359cc10ea0b85e38f7558f24287e04426ae50dc2d
        • MD5 SHA1 SHA512
        Submit Download

        Restart.bat
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
        • Size 135B
        • SHA256 f1a4b2d0f965ccae27bdfd8aab19f5d820c33b0627c850e17a18b9ebee371428
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UEPcon.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
        • Size 12KB
        • SHA256 425b21ead7eb330fd516c6e2119719c480c7fbfdef052f5bfac318f3b962cee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1120-212-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1140-248-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1320-200-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1740-22-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1740-182-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1800-253-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1852-303-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/1912-258-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2084-224-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2300-297-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2412-331-0x0000000005890000-0x0000000005EDA000-memory.dmp
        Download

        memory/2412-343-0x00000000057D0000-0x00000000057F2000-memory.dmp
        Download

        memory/2412-352-0x00000000060B0000-0x000000000640B000-memory.dmp
        Download

        memory/2412-345-0x0000000006040000-0x00000000060A6000-memory.dmp
        Download

        memory/2412-344-0x0000000005FD0000-0x0000000006036000-memory.dmp
        Download

        memory/2412-325-0x0000000002D70000-0x0000000002DA6000-memory.dmp
        Download

        memory/2412-354-0x00000000065F0000-0x000000000663C000-memory.dmp
        Download

        memory/2412-353-0x00000000065B0000-0x00000000065CE000-memory.dmp
        Download

        memory/2416-275-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2580-242-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2788-291-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/2968-314-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/3060-206-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/3152-269-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/3548-189-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/3752-309-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/4108-356-0x0000000000710000-0x0000000000AC6000-memory.dmp
        Download

        memory/4292-0-0x0000000000270000-0x0000000000626000-memory.dmp
        Download

        memory/4488-194-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/4776-218-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/4800-286-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/4828-237-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/4832-230-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/5068-330-0x00007FF6F93D0000-0x00007FF6F93DE000-memory.dmp
        Download

        memory/5068-233-0x00007FF6F93D0000-0x00007FF6F93DE000-memory.dmp
        Download

        memory/5068-23-0x00007FF6F93D0000-0x00007FF6F93DE000-memory.dmp
        Download

        memory/5624-263-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download

        memory/6068-281-0x0000000000500000-0x00000000005A2000-memory.dmp
        Download