Overview

overview

7

Static

static

5

1e6a984c31...79.exe

windows10-2004-x64

7

1e6a984c31...79.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 07:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
  • Size 1.6MB
  • Sample261102-jtztqaee52
  • SHA256 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionupx

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
    "C:\Users\Admin\AppData\Local\Temp\1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:248
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.wav
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1308
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5344
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.wav
      2⤵
      • Executes dropped EXE
      PID:4232
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.wav
      2⤵
      • Executes dropped EXE
      PID:5880
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.wav
      2⤵
      • Executes dropped EXE
      PID:1656
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.wav
      2⤵
      • Executes dropped EXE
      PID:3876
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.wav
      2⤵
      • Executes dropped EXE
      PID:2700
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.wav
      2⤵
      • Executes dropped EXE
      PID:704
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.wav
      2⤵
      • Executes dropped EXE
      PID:2740
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
      2⤵
      • Executes dropped EXE
      PID:4764
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.wav
      2⤵
      • Executes dropped EXE
      PID:4736
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.wav
      2⤵
      • Executes dropped EXE
      PID:4644
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.wav
      2⤵
      • Executes dropped EXE
      PID:4180
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.wav
      2⤵
      • Executes dropped EXE
      PID:4300
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.wav
      2⤵
      • Executes dropped EXE
      PID:6124
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.wav
      2⤵
      • Executes dropped EXE
      PID:1164
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.wav
      2⤵
      • Executes dropped EXE
      PID:2672
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.wav
      2⤵
      • Executes dropped EXE
      PID:748
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.wav
      2⤵
      • Executes dropped EXE
      PID:3608
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.wav
      2⤵
      • Executes dropped EXE
      PID:2488
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.wav
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.wav
      2⤵
      • Executes dropped EXE
      PID:3392
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.wav
      2⤵
      • Executes dropped EXE
      PID:3588
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.wav
      2⤵
      • Executes dropped EXE
      PID:2104
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe" --decode C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.mp3 C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s24.wav
      2⤵
      • Executes dropped EXE
      PID:2776
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "try {$null = icim MSFT_MpPreference @{ExclusionPath = "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA"; Force = $True} Add -Namespace root/Microsoft/Windows/Defender -EA 1} catch {$host.SetShouldExit($_.Exception.HResult)}
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4100
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5588
      • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
        "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe" show
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4292
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004FC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        lame.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\lame.exe
        • Size 199KB
        • SHA256 4e29a900163f55406c76f31a47d70d17ec53cf9786cbffc17ab9f8b3eaef83b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s1.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s1.mp3
        • Size 10KB
        • SHA256 c9fb6d3ccb4e34ff966e6ddc1538637c17d54552b368f146c00c7991eb1c837d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s10.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s10.mp3
        • Size 8KB
        • SHA256 bf6dac71153eb7b6b8c35b8a21e4df033aa5771add64bcc0e8151a53f33eb127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s11.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s11.mp3
        • Size 2KB
        • SHA256 6bae9fdf39167df3452d0e9cb7d547a795f60c2bc09f9667c619f370f191dda6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s12.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s12.mp3
        • Size 9KB
        • SHA256 de6be44c98dc9dc1c8fee89edaa62d92a7abc68dd76aed393eac1852f34a048b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s13.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s13.mp3
        • Size 11KB
        • SHA256 635c083c7d1add63f6f1f213187cfcb08cc199bfc92b4bc9eb3eaa89e1db0ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s14.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s14.mp3
        • Size 11KB
        • SHA256 3afaeaab22e422d2a8cf1727f2e6e0f3d2c3b768eaaea8afb08b23f294497865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s15.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s15.mp3
        • Size 8KB
        • SHA256 397a1322c6a6117c7d6e7772cbd9bdb27e82d4bc23f2d96acd215ff56de0ee45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s16.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s16.mp3
        • Size 2KB
        • SHA256 f8953809831e0aa81b66c826b756b64a86f5e0da4239d65375ab7ba46968eb5a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s17.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s17.mp3
        • Size 3KB
        • SHA256 840b52c4f7c13a362f271bcc75fa486bbda65d45295d099456ab4604773dc74f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s18.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s18.mp3
        • Size 7KB
        • SHA256 d97348e84850b3fcc2c15050d73c6d6a968d1976c666e88d46b87aaa06fc2b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s19.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s19.mp3
        • Size 12KB
        • SHA256 693b22f2b0b7ebc0703d6151be8bf23963066c7dc258df6b832f81073cb9436a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s2.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s2.mp3
        • Size 9KB
        • SHA256 59411f1a3406f7e07fb84dbd62402eb68799e1e24c7f3129f9a3314991d5641a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s20.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s20.mp3
        • Size 9KB
        • SHA256 94d017906a18d4436898c1ad8e6a04629c8edeff36ca80cf87d04ae822f718c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s21.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s21.mp3
        • Size 9KB
        • SHA256 ad76c866bb89be2700099835f0d3349b384e4c7a7d7c0dda8c568f42e9247638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s22.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s22.mp3
        • Size 2KB
        • SHA256 c305d92b52d610fef9051154f5ca269d976eb02a154d62e3d777fbc8b22c864d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s23.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s23.mp3
        • Size 1KB
        • SHA256 26b5c899108c58b9421050a1fab96f3ed33c194dadd3035918643693ff9a987f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        s3.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s3.mp3
        • Size 6KB
        • SHA256 f2c62494f76717cfd1db4c92bcb71690bbecca55ad0fa8c1c023249cfbf78968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s4.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s4.mp3
        • Size 11KB
        • SHA256 e9f474be1f11f7cdd350cd9a54bc689bd7a47bf28046c5f46d3a7365e3db4b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s5.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s5.mp3
        • Size 15KB
        • SHA256 691e922463ac1c7be39da15e4035755e17740816cb074a7733ad5c0f3ecaeefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s6.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s6.mp3
        • Size 12KB
        • SHA256 1f6ca9dd2dafb449b96a390f967863c94c17724f9604d4f28a752144a84a8fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s7.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s7.mp3
        • Size 14KB
        • SHA256 a15f6690ff4305cfbd8ff5fdb34d2159d9325fae4c761a6ed1fa60706ab471e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s8.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s8.mp3
        • Size 7KB
        • SHA256 e6dbe62df0e28626b02d73849c39e5bf641e20b9c2050e693cf9e2e14fef0fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s9.mp3
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.mp3
        • Size 9KB
        • SHA256 88a3c68a8cf79c0ee0bda94c4d1429357bbe15caf324f1da1abd0890564e8f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        s9.wav
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Bgm\s9.wav
        • Size 77KB
        • SHA256 ab7a10e13361aedb0764d14254bc5e213afb03d68af047b8556b3fd983542241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MscriptA.txt
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\MscriptA.txt
        • Size 18B
        • SHA256 9bab2523093fd8c255c2cdb2e3325b7703d9bf9bf9cf7b3586aa888566726ab0
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.exe
        • Size 1.6MB
        • SHA256 1e6a984c316b23d2de811f699200400ad0508381aa8e0a10d6a92623f467b979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 246B
        • SHA256 e3f9b7ca5f81ad75d95de2b419a0ae99cbf696b9c2e2a9aec939bb734258bbc1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 246B
        • SHA256 126afedd7ea337f6f4c3317c9ee305d67ad9ebba26b16a809251e61a56012762
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 246B
        • SHA256 c3a475f368d1a26cddb001ce589b9984df15591678ba7632637de806c7bde328
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 246B
        • SHA256 405d1d025807cc6181722fefdfebf8e0b4e8ca9e99be859109ecd3afe6dfffd1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 246B
        • SHA256 5ca956456eb9da32a4434d06d9fe6dd41965d87c89770e3784ff8b91153fcb3e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 49B
        • SHA256 2cb8e6cefbf22b70b72cac310cbbdb7376e4ce52bc758f4781ebae6b7939aaab
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 23B
        • SHA256 0a1c1da1b01d62ca7f6d031359cc10ea0b85e38f7558f24287e04426ae50dc2d
        • MD5 SHA1 SHA512
        Submit Download

        Restart.bat
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Restart.bat
        • Size 135B
        • SHA256 f1a4b2d0f965ccae27bdfd8aab19f5d820c33b0627c850e17a18b9ebee371428
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UEPcon.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
        • Size 12KB
        • SHA256 425b21ead7eb330fd516c6e2119719c480c7fbfdef052f5bfac318f3b962cee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/248-1-0x0000000000610000-0x0000000000611000-memory.dmp
        Download

        memory/248-750-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-691-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-352-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-730-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-450-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-388-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-611-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-670-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-489-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-431-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-573-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-631-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-0-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-216-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-510-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/248-551-0x0000000000240000-0x0000000000611000-memory.dmp
        Download

        memory/704-220-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/748-277-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/1164-266-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/1308-23-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/1308-184-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/1656-201-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2104-313-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2244-295-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2488-289-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2672-272-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2700-213-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2740-226-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/2776-318-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/3392-301-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/3588-307-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/3608-283-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/3876-207-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4100-357-0x0000000006220000-0x000000000626C000-memory.dmp
        Download

        memory/4100-335-0x0000000005910000-0x0000000005F5A000-memory.dmp
        Download

        memory/4100-355-0x00000000061E0000-0x00000000061FE000-memory.dmp
        Download

        memory/4100-347-0x0000000005870000-0x0000000005892000-memory.dmp
        Download

        memory/4100-348-0x0000000005FD0000-0x0000000006036000-memory.dmp
        Download

        memory/4100-349-0x0000000006040000-0x00000000060A6000-memory.dmp
        Download

        memory/4100-333-0x0000000002CF0000-0x0000000002D26000-memory.dmp
        Download

        memory/4100-353-0x00000000062B0000-0x000000000660B000-memory.dmp
        Download

        memory/4180-250-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4232-190-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4292-389-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-671-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-451-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-432-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-490-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-751-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-512-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-731-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-552-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-710-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-574-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-356-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-612-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4292-632-0x00000000004C0000-0x0000000000891000-memory.dmp
        Download

        memory/4300-256-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4644-245-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4736-239-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/4764-232-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/5344-235-0x00007FF7E4290000-0x00007FF7E429E000-memory.dmp
        Download

        memory/5344-334-0x00007FF7E4290000-0x00007FF7E429E000-memory.dmp
        Download

        memory/5344-24-0x00007FF7E4290000-0x00007FF7E429E000-memory.dmp
        Download

        memory/5880-196-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download

        memory/6124-261-0x00000000001C0000-0x0000000000262000-memory.dmp
        Download