Windows Analysis Report
Gulvmaattens.exe

Overview

General Information

Sample Name: Gulvmaattens.exe
Analysis ID: 680567
MD5: afa8d5c2f8f14ed458ea6d8547fe57a8
SHA1: ef603c82c7976fcd34a018cd8280e28b8a22510d
SHA256: 7d3d134f8b37621766da3378b143ab0fbacf13f7793f42b6e81d7e5cc702a32b
Tags: agentteslaguloaderexe
Infos:

Detection

GuLoader
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected GuLoader
Mass process execution to delay analysis
Obfuscated command line found
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
PE file contains strange resources
Drops PE files
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Binary contains a suspicious time stamp
Detected potential crypto function
Too many similar processes found
PE / OLE file has an invalid certificate
PE file contains more sections than normal
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
Abnormal high CPU Usage
Contains functionality for read data from the clipboard

Classification

Uses 32bit PE files
Source: Gulvmaattens.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Gulvmaattens.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: sqmapi.pdbUGP source: sqmapi.dll.0.dr
Source: Binary string: sqmapi.pdb source: sqmapi.dll.0.dr
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_0040676F FindFirstFileW,FindClose, 0_2_0040676F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405B23
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Gulvmaattens.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com01
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com02
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com05
Source: Gulvmaattens.exe String found in binary or memory: http://www.certum.pl/CPS0
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_004055B8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004055B8
Too many similar processes found
Source: Conhost.exe Process created: 92
Uses 32bit PE files
Source: Gulvmaattens.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
PE file contains strange resources
Source: Gulvmaattens.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Gulvmaattens.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034C5
Detected potential crypto function
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00407458 0_2_00407458
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00406C81 0_2_00406C81
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_6F6A1B5F 0_2_6F6A1B5F
PE / OLE file has an invalid certificate
Source: Gulvmaattens.exe Static PE information: invalid certificate
PE file contains more sections than normal
Source: vfslog.dll.0.dr Static PE information: Number of sections : 19 > 10
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\Gulvmaattens.exe File read: C:\Users\user\Desktop\Gulvmaattens.exe Jump to behavior
Source: Gulvmaattens.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Gulvmaattens.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Gulvmaattens.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x52^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x43^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034C5
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nsp6DDB.tmp Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.winEXE@412/8@0/0
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_004021A2 CoCreateInstance, 0_2_004021A2
Source: C:\Users\user\Desktop\Gulvmaattens.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00404858 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404858
Source: Gulvmaattens.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: sqmapi.pdbUGP source: sqmapi.dll.0.dr
Source: Binary string: sqmapi.pdb source: sqmapi.dll.0.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.626525207.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Obfuscated command line found
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x52^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x43^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
PE file contains sections with non-standard names
Source: vfslog.dll.0.dr Static PE information: section name: .xdata
Source: vfslog.dll.0.dr Static PE information: section name: /4
Source: vfslog.dll.0.dr Static PE information: section name: /19
Source: vfslog.dll.0.dr Static PE information: section name: /31
Source: vfslog.dll.0.dr Static PE information: section name: /45
Source: vfslog.dll.0.dr Static PE information: section name: /57
Source: vfslog.dll.0.dr Static PE information: section name: /70
Source: vfslog.dll.0.dr Static PE information: section name: /81
Source: vfslog.dll.0.dr Static PE information: section name: /92
Binary contains a suspicious time stamp
Source: sqmapi.dll.0.dr Static PE information: 0xCBF26285 [Sun Jun 5 13:03:01 2078 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_6F6A1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_6F6A1B5F
Drops PE files
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99\Interelectrode\Overvejendes\sqmapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nso786B.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99\Interelectrode\Overvejendes\vfslog.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nso786B.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Mass process execution to delay analysis
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Gulvmaattens.exe RDTSC instruction interceptor: First address: 000000000076281A second address: 000000000076281A instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF438CD5F9Ch 0x00000006 test dh, bh 0x00000008 inc ebp 0x00000009 jmp 00007FF438CD603Ah 0x0000000b test edx, edx 0x0000000d inc ebx 0x0000000e rdtsc
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Gulvmaattens.exe Dropped PE file which has not been started: C:\Users\user\Falder99\Interelectrode\Overvejendes\sqmapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe Dropped PE file which has not been started: C:\Users\user\Falder99\Interelectrode\Overvejendes\vfslog.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_0040676F FindFirstFileW,FindClose, 0_2_0040676F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405B23
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
Source: C:\Users\user\Desktop\Gulvmaattens.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Gulvmaattens.exe API call chain: ExitProcess graph end node
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_6F6A1B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_6F6A1B5F
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034C5
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680567 Sample: Gulvmaattens.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 60 41 Yara detected GuLoader 2->41 7 Gulvmaattens.exe 29 2->7         started        process3 file4 33 C:\Users\user\Falder99\...\vfslog.dll, PE32+ 7->33 dropped 35 C:\Users\user\Falder99\...\sqmapi.dll, PE32+ 7->35 dropped 37 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->37 dropped 39 C:\Users\user\AppData\Local\...\System.dll, PE32 7->39 dropped 43 Obfuscated command line found 7->43 45 Mass process execution to delay analysis 7->45 47 Tries to detect virtualization through RDTSC time measurements 7->47 11 cmd.exe 7->11         started        13 cmd.exe 7->13         started        15 cmd.exe 7->15         started        17 61 other processes 7->17 signatures5 process6 process7 19 Conhost.exe 11->19         started        21 Conhost.exe 13->21         started        23 Conhost.exe 15->23         started        25 Conhost.exe 17->25         started        27 Conhost.exe 17->27         started        29 Conhost.exe 17->29         started        31 58 other processes 17->31
⊘No contacted IP infos