Overview

overview

7

Static

static

5

1e6a984c31...79.exe

windows10-2004-x64

7

1e6a984c31...79.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 07:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
  • Size 1.6MB
  • Sample261102-jtztqaee52
  • SHA256 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 28 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
    "C:\Users\Admin\AppData\Local\Temp\1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.wav
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:548
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4044
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.wav
      2⤵
      • Executes dropped EXE
      PID:4980
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.wav
      2⤵
      • Executes dropped EXE
      PID:4888
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.wav
      2⤵
      • Executes dropped EXE
      PID:2144
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.wav
      2⤵
      • Executes dropped EXE
      PID:2016
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.wav
      2⤵
      • Executes dropped EXE
      PID:1216
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.wav
      2⤵
      • Executes dropped EXE
      PID:4780
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.wav
      2⤵
      • Executes dropped EXE
      PID:2172
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
      2⤵
      • Executes dropped EXE
      PID:2868
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.wav
      2⤵
      • Executes dropped EXE
      PID:2988
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.wav
      2⤵
      • Executes dropped EXE
      PID:4932
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.wav
      2⤵
      • Executes dropped EXE
      PID:4884
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.wav
      2⤵
      • Executes dropped EXE
      PID:4512
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.wav
      2⤵
      • Executes dropped EXE
      PID:516
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.wav
      2⤵
      • Executes dropped EXE
      PID:4392
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.wav
      2⤵
      • Executes dropped EXE
      PID:312
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.wav
      2⤵
      • Executes dropped EXE
      PID:892
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.wav
      2⤵
      • Executes dropped EXE
      PID:5072
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.wav
      2⤵
      • Executes dropped EXE
      PID:4432
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.wav
      2⤵
      • Executes dropped EXE
      PID:3592
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.wav
      2⤵
      • Executes dropped EXE
      PID:2624
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.wav
      2⤵
      • Executes dropped EXE
      PID:628
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.wav
      2⤵
      • Executes dropped EXE
      PID:3956
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.wav
      2⤵
      • Executes dropped EXE
      PID:412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "try {$null = icim MSFT_MpPreference @{ExclusionPath = "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA"; Force = $True} Add -Namespace root/Microsoft/Windows/Defender -EA 1} catch {$host.SetShouldExit($_.Exception.HResult)}
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1340
      • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
        "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe" show
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
          "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
          4⤵
          • Executes dropped EXE
          PID:4404
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
      2⤵
      • Executes dropped EXE
      PID:3984
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2f8
    1⤵
      PID:4392

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_5yyvpvhd.qbm.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5yyvpvhd.qbm.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lame.exe
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
          • Size 199KB
          • SHA256 4e29a900163f55406c76f31a47d70d17ec53cf9786cbffc17ab9f8b3eaef83b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s1.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3
          • Size 10KB
          • SHA256 c9fb6d3ccb4e34ff966e6ddc1538637c17d54552b368f146c00c7991eb1c837d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s10.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3
          • Size 8KB
          • SHA256 bf6dac71153eb7b6b8c35b8a21e4df033aa5771add64bcc0e8151a53f33eb127
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s11.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3
          • Size 2KB
          • SHA256 6bae9fdf39167df3452d0e9cb7d547a795f60c2bc09f9667c619f370f191dda6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          s12.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3
          • Size 9KB
          • SHA256 de6be44c98dc9dc1c8fee89edaa62d92a7abc68dd76aed393eac1852f34a048b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s13.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3
          • Size 11KB
          • SHA256 635c083c7d1add63f6f1f213187cfcb08cc199bfc92b4bc9eb3eaa89e1db0ae3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s14.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3
          • Size 11KB
          • SHA256 3afaeaab22e422d2a8cf1727f2e6e0f3d2c3b768eaaea8afb08b23f294497865
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s15.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3
          • Size 8KB
          • SHA256 397a1322c6a6117c7d6e7772cbd9bdb27e82d4bc23f2d96acd215ff56de0ee45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s16.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3
          • Size 2KB
          • SHA256 f8953809831e0aa81b66c826b756b64a86f5e0da4239d65375ab7ba46968eb5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          s17.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3
          • Size 3KB
          • SHA256 840b52c4f7c13a362f271bcc75fa486bbda65d45295d099456ab4604773dc74f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          s18.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3
          • Size 7KB
          • SHA256 d97348e84850b3fcc2c15050d73c6d6a968d1976c666e88d46b87aaa06fc2b29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s19.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3
          • Size 12KB
          • SHA256 693b22f2b0b7ebc0703d6151be8bf23963066c7dc258df6b832f81073cb9436a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s2.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3
          • Size 9KB
          • SHA256 59411f1a3406f7e07fb84dbd62402eb68799e1e24c7f3129f9a3314991d5641a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s20.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3
          • Size 9KB
          • SHA256 94d017906a18d4436898c1ad8e6a04629c8edeff36ca80cf87d04ae822f718c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s21.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3
          • Size 9KB
          • SHA256 ad76c866bb89be2700099835f0d3349b384e4c7a7d7c0dda8c568f42e9247638
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s22.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3
          • Size 2KB
          • SHA256 c305d92b52d610fef9051154f5ca269d976eb02a154d62e3d777fbc8b22c864d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          s23.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3
          • Size 1KB
          • SHA256 26b5c899108c58b9421050a1fab96f3ed33c194dadd3035918643693ff9a987f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          s3.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3
          • Size 6KB
          • SHA256 f2c62494f76717cfd1db4c92bcb71690bbecca55ad0fa8c1c023249cfbf78968
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s4.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3
          • Size 11KB
          • SHA256 e9f474be1f11f7cdd350cd9a54bc689bd7a47bf28046c5f46d3a7365e3db4b12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s5.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3
          • Size 15KB
          • SHA256 691e922463ac1c7be39da15e4035755e17740816cb074a7733ad5c0f3ecaeefe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s6.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3
          • Size 12KB
          • SHA256 1f6ca9dd2dafb449b96a390f967863c94c17724f9604d4f28a752144a84a8fc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s7.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3
          • Size 14KB
          • SHA256 a15f6690ff4305cfbd8ff5fdb34d2159d9325fae4c761a6ed1fa60706ab471e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s8.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3
          • Size 7KB
          • SHA256 e6dbe62df0e28626b02d73849c39e5bf641e20b9c2050e693cf9e2e14fef0fcf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s9.mp3
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3
          • Size 9KB
          • SHA256 88a3c68a8cf79c0ee0bda94c4d1429357bbe15caf324f1da1abd0890564e8f06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          s9.wav
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
          • Size 77KB
          • SHA256 ab7a10e13361aedb0764d14254bc5e213afb03d68af047b8556b3fd983542241
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MscriptA.txt
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptA.txt
          • Size 18B
          • SHA256 9bab2523093fd8c255c2cdb2e3325b7703d9bf9bf9cf7b3586aa888566726ab0
          • MD5 SHA1 SHA512
          Submit Download

          QuellGTA.exe
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
          • Size 1.6MB
          • SHA256 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 23B
          • SHA256 0a1c1da1b01d62ca7f6d031359cc10ea0b85e38f7558f24287e04426ae50dc2d
          • MD5 SHA1 SHA512
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 46B
          • SHA256 f15dc2c488410ec63b4e96b42b6850fc523833dc5fe25e94061de3a1dc7061a7
          • MD5 SHA1 SHA512
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 46B
          • SHA256 1077c31400e14f1b6dc901624f3f2b2c4551b57011e15a7d702622751dc18e4c
          • MD5 SHA1 SHA512
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 243B
          • SHA256 87b9697dd1a1cd6676916f643f63390c2c8579c69353c1a26c15615cbe34616e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 243B
          • SHA256 b34ae856f7036106b7fee3d0354d0b07ef45d8305e8cd05017a435a6d4f30be2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 243B
          • SHA256 fdfcea6341874565f210620348e39d51daad6cd41f721bf24be59e5767d56be2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 243B
          • SHA256 403cfdc5067be5a2971bff2879a0501effb30607b022d52a59a7a10d3597b17d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 254B
          • SHA256 3846b624899db8aaee6590e4cc3ea8f24a15a03c51e9d0ad347789c9848ecba2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          QuellGTA.ini
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
          • Size 254B
          • SHA256 3cf4c8104cd13e278e67aaaa482f9d922c7dae217dcc42747f50fe4c24c8b118
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Restart.bat
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
          • Size 135B
          • SHA256 f1a4b2d0f965ccae27bdfd8aab19f5d820c33b0627c850e17a18b9ebee371428
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UEPcon.exe
          • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
          • Size 12KB
          • SHA256 425b21ead7eb330fd516c6e2119719c480c7fbfdef052f5bfac318f3b962cee1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/312-266-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/412-308-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/516-256-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/548-65-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/548-9-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/628-298-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/892-272-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/1216-210-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2016-205-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2144-199-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2172-222-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2252-336-0x0000000005940000-0x0000000005C94000-memory.dmp
          Download

          memory/2252-337-0x0000000005F20000-0x0000000005F3E000-memory.dmp
          Download

          memory/2252-322-0x0000000005230000-0x0000000005858000-memory.dmp
          Download

          memory/2252-340-0x0000000005FC0000-0x000000000600C000-memory.dmp
          Download

          memory/2252-327-0x0000000005860000-0x00000000058C6000-memory.dmp
          Download

          memory/2252-328-0x00000000058D0000-0x0000000005936000-memory.dmp
          Download

          memory/2252-326-0x0000000005060000-0x0000000005082000-memory.dmp
          Download

          memory/2252-315-0x00000000025E0000-0x0000000002616000-memory.dmp
          Download

          memory/2624-292-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2868-228-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/2988-234-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/3592-287-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/3956-303-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/3984-384-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/3996-400-0x0000000000580000-0x0000000000951000-memory.dmp
          Download

          memory/3996-479-0x0000000000580000-0x0000000000951000-memory.dmp
          Download

          memory/3996-353-0x0000000000580000-0x0000000000951000-memory.dmp
          Download

          memory/3996-436-0x0000000000580000-0x0000000000951000-memory.dmp
          Download

          memory/3996-382-0x0000000000580000-0x0000000000951000-memory.dmp
          Download

          memory/4044-237-0x00007FF6E4A00000-0x00007FF6E4A0E000-memory.dmp
          Download

          memory/4044-22-0x00007FF6E4A00000-0x00007FF6E4A0E000-memory.dmp
          Download

          memory/4044-321-0x00007FF6E4A00000-0x00007FF6E4A0E000-memory.dmp
          Download

          memory/4392-261-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4404-406-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4432-282-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4512-251-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4772-385-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-435-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-202-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-480-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-352-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-457-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-0-0x0000000000960000-0x0000000000D31000-memory.dmp
          Download

          memory/4772-1-0x0000000000D30000-0x0000000000D31000-memory.dmp
          Download

          memory/4780-216-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4884-246-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4888-194-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4932-241-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/4980-171-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download

          memory/5072-277-0x0000000000A90000-0x0000000000B32000-memory.dmp
          Download