Edit tour

Windows Analysis Report
getscreen-469829524.exe

Overview

General Information

Sample name:	getscreen-469829524.exe
Analysis ID:	1502577
MD5:	d0bf9837ca88c67c4e4f972c686cd46c
SHA1:	2bd3c6cae2f40fb10cec7dbb0e23807a02548078
SHA256:	4736fa94718e2a96ee2d6c454011294c8354935fe66c7f3118d981d0555238e4
Tags:	exe
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	62
Range:	0 - 100

Signatures

Modifies Internet Explorer zonemap settings

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Abnormal high CPU Usage

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: IE Change Domain Zone

Classification

Process Tree

System is w10x64

getscreen-469829524.exe (PID: 6280 cmdline: "C:\Users\user\Desktop\getscreen-469829524.exe" MD5: D0BF9837CA88C67C4E4F972C686CD46C)

getscreen-469829524.exe (PID: 6224 cmdline: "C:\Users\user\Desktop\getscreen-469829524.exe" -gpipe \\.\pipe\PCommand97kipwvswuxtgtrmg -gui MD5: D0BF9837CA88C67C4E4F972C686CD46C)

getscreen-469829524.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\getscreen-469829524.exe" -cpipe \\.\pipe\PCommand96wiwybutigebpjzj -cmem 0000pipe0PCommand96wiwybutigebpjzjkmlpqq4kelrogik -child MD5: D0BF9837CA88C67C4E4F972C686CD46C)

dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe (PID: 6540 cmdline: "C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe" -elevate \\.\pipe\elevateGS512dztvkxlovsiqwfdjxlwevyxacycmahb MD5: D0BF9837CA88C67C4E4F972C686CD46C)

svchost.exe (PID: 2200 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: IE Change Domain Zone

Source: Registry Key set

Author: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\getscreen-469829524.exe, ProcessId: 6224, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me\http

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, ProcessId: 2200, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Bitcoin Miner

Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-469829524.exe			Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-469829524.exe			Jump to behavior

Compliance

PE / OLE file has a valid certificate

Source: getscreen-469829524.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-469829524.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp

Networking

Source: Joe Sandbox View

IP Address: 5.75.168.191 5.75.168.191

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)

Source: global traffic

DNS traffic detected: DNS query: getscreen.me

Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.contoso.com:3128/
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF721D02000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.pcommand.com:3128
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/exper
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.we
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-id
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://%S/%S/agent/chat$.typeoutprocessDataH
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policy
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link
Source: getscreen-469829524.exe, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52515
Source: unknown	Network traffic detected: HTTP traffic on port 52567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52519
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52512
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52510
Source: unknown	Network traffic detected: HTTP traffic on port 52326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52511
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52520
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52535
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52533
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52545
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 52579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52506
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52502
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52500
Source: unknown	Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52478
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 52146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 52387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52481
Source: unknown	Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 53369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51172
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51175
Source: unknown	Network traffic detected: HTTP traffic on port 53104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51179
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51183
Source: unknown	Network traffic detected: HTTP traffic on port 53333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52430
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52449
Source: unknown	Network traffic detected: HTTP traffic on port 52109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51115
Source: unknown	Network traffic detected: HTTP traffic on port 52087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52445
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52450
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 51188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52457
Source: unknown	Network traffic detected: HTTP traffic on port 52363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52456
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52461
Source: unknown	Network traffic detected: HTTP traffic on port 53286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51139
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52464
Source: unknown	Network traffic detected: HTTP traffic on port 52694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 51242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52471
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52470
Source: unknown	Network traffic detected: HTTP traffic on port 52099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51195
Source: unknown	Network traffic detected: HTTP traffic on port 51994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51194
Source: unknown	Network traffic detected: HTTP traffic on port 51741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51198
Source: unknown	Network traffic detected: HTTP traffic on port 53250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50968 -> 443

System Summary

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Process Stats: CPU usage > 49%

Source: getscreen-469829524.exe	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)
Source: dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)

Source: getscreen-469829524.exe, 00000000.00000002.4119974273.00007FF777EF9000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe, 00000000.00000000.1649513521.00007FF777EF9000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe, 00000001.00000000.1652501796.00007FF777EF9000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe, 00000001.00000002.4118000597.00007FF777EF9000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe, 00000004.00000002.1833881804.00007FF777EF9000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe, 00000004.00000000.1679827494.00007FF777EF9000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe
Source: getscreen-469829524.exe	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-469829524.exe

Source: classification engine

Classification label: mal54.phis.evad.winEXE@8/482@5/2

Source: C:\Users\user\Desktop\getscreen-469829524.exe

File created: C:\Users\user\AppData\Local\Getscreen.me

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\PCommandMutextTurbo96phqghum

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe

File read: C:\Users\user\Desktop\getscreen-469829524.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe"
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe" -gpipe \\.\pipe\PCommand97kipwvswuxtgtrmg -gui
Source: unknown	Process created: C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe "C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe" -elevate \\.\pipe\elevateGS512dztvkxlovsiqwfdjxlwevyxacycmahb
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe" -cpipe \\.\pipe\PCommand96wiwybutigebpjzj -cmem 0000pipe0PCommand96wiwybutigebpjzjkmlpqq4kelrogik -child
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe" -gpipe \\.\pipe\PCommand97kipwvswuxtgtrmg -gui	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe" -cpipe \\.\pipe\PCommand96wiwybutigebpjzj -cmem 0000pipe0PCommand96wiwybutigebpjzjkmlpqq4kelrogik -child	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: mfwmaaec.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: getscreen-469829524.exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: getscreen-469829524.exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: getscreen-469829524.exe

Static file information: File size 4271408 > 1048576

PE file has a big raw section

Source: getscreen-469829524.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x40b600

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-469829524.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Code function: 0_2_00007FF777EF80C0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF777EF80C0

Source: getscreen-469829524.exe	Static PE information: real checksum: 0x416874 should be: 0x41c52f
Source: dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe.0.dr	Static PE information: real checksum: 0x416874 should be: 0x41c52f

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe

File created: C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe

Jump to dropped file

Source: C:\Users\user\Desktop\getscreen-469829524.exe

File created: C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\getscreen-469829524.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-469829524.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, Manufacturer, MACAddress, Speed, InterfaceIndex, Index, GUID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Users\user\Desktop\getscreen-469829524.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 1
Source: C:\Users\user\Desktop\getscreen-469829524.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'
Source: C:\Users\user\Desktop\getscreen-469829524.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, VolumeName, FileSystem, Size, FreeSpace FROM Win32_LogicalDisk

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption FROM Win32_SoundDevice

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\getscreen-469829524.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	System information queried: FirmwareTableInformation	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 665	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 1143	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 430	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 520	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 443	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 9911	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Window / User API: threadDelayed 943	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 6436	Thread sleep count: 665 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 6496	Thread sleep count: 1143 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 4628	Thread sleep count: 430 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 4504	Thread sleep count: 520 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 6228	Thread sleep count: 443 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 6436	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 2932	Thread sleep count: 160 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe TID: 3592	Thread sleep count: 943 > 30	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\getscreen-469829524.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Last function: Thread delayed

Source: getscreen-469829524.exe, 00000000.00000002.4117251714.000001F3F97CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $VMware Virtual RAM
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V console (use port 2179, disable negotiation)
Source: getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMnet
Source: getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF777E13000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: RAM slot #0RAM slot #0@VMware Virtual RAMVMW-4096MB00000001
Source: getscreen-469829524.exe, 00000000.00000002.4114441091.000001F3F7899000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll$3
Source: getscreen-469829524.exe, 00000001.00000002.4103494346.0000017A36488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF777E13000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Virtual RAM
Source: getscreen-469829524.exe, 00000000.00000002.4110571025.000000CD6C2F4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {"CPU":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","CPUSpeed":2000,"CPUCores":4,"CPUCoresLogical":1,"CPUFamily":"Intel64 Family 6 Model 143 Stepping 8","BIOS":"GZM2119VDG","BIOSVersion":"20221121","BIOSDate":"","RAMPhys":8191,"RAMPhysAvail":2260,"RAMVirt":134217727,"RAMVirtAvail":134213423,"RAMPageFile":8191,"RAMBanks":[{"Bank":"RAM slot #0","Locator":"RAM slot #0","DataWidth":64,"Manufacturer":"VMware Virtual RAM","PartNumber":"VMW-4096MB","SerialNumber":"00000001","Capacity":4096}],"VideoName":"CUN7_6D","VideoRAM":1024,"VideoCards":[{"Name":"CUN7_6D","RAM":1024,"Integrated":false}],"Locale":"0809","LocaleOemPage":"1252","LocaleCountry":"Switzerland","LocaleCurrency":"CHF","LocaleTimezone":60,"LocaleFormatTime":"HH:mm:ss","LocaleFormatDate":"dd\/MM\/yyyy","ComputerModel":"M4pB8pYt","ComputerDomain":"ogaFf","ComputerWorkgroup":"WORKGROUP","ComputerName":"user-PC","ComputerIP":["192.168.2.4","fe80::29b9:a951:1791:4eb3"],"OSName":"Microsoft Windows 10 Pro","OSVersion":"10.0.19045","HDD":[{"Model":"TFFSLZAE SCSI D
Source: getscreen-469829524.exe, 00000000.00000002.4110571025.000000CD6C2F4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {"token":"","uid":"71434D56-1548-ED3D-AEE6-C75AECD93BF0","turbo":"13592217250262214uifUcsTueR0DFsl8k0i","turbo_old":"","invite":"","brand":"","install":false,"admin":true,"isadmin":true,"onetime":true,"file_download":true,"name":"878411","nonadmin":true,"islock":false,"blackscreen_available":true,"hibernate":true,"power_supply":true,"silent":false,"os":"win","rdp":false,"os_user":"user","os_username":"","build":2,"version":"2.21.3","hardware":"{\"CPU\":\"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\",\"CPUSpeed\":2000,\"CPUCores\":4,\"CPUCoresLogical\":1,\"CPUFamily\":\"Intel64 Family 6 Model 143 Stepping 8\",\"BIOS\":\"GZM2119VDG\",\"BIOSVersion\":\"20221121\",\"BIOSDate\":\"\",\"RAMPhys\":8191,\"RAMPhysAvail\":2260,\"RAMVirt\":134217727,\"RAMVirtAvail\":134213423,\"RAMPageFile\":8191,\"RAMBanks\":[{\"Bank\":\"RAM slot #0\",\"Locator\":\"RAM slot #0\",\"DataWidth\":64,\"Manufacturer\":\"VMware Virtual RAM\",\"PartNumber\":\"VMW-4096MB\",\"SerialNumber\":\"00000001\",\"Capacity\":4096}],\"VideoName\":\"CUN7_6D\",
Source: dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661141283.000001CE7B719000.00000004.00000020.00020000.00000000.sdmp, getscreen-469829524.exe, 00000004.00000002.1832321097.000001705E7F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\getscreen-469829524.exe	API call chain: ExitProcess graph end node	graph_0-79
Source: C:\Users\user\Desktop\getscreen-469829524.exe	API call chain: ExitProcess graph end node	graph_1-79
Source: C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe	API call chain: ExitProcess graph end node	graph_2-80
Source: C:\Users\user\Desktop\getscreen-469829524.exe	API call chain: ExitProcess graph end node	graph_4-79

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\getscreen-469829524.exe

Code function: 0_2_00007FF777EF80C0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF777EF80C0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\svchost.exe

Process created: C:\Users\user\Desktop\getscreen-469829524.exe "C:\Users\user\Desktop\getscreen-469829524.exe" -cpipe \\.\pipe\PCommand96wiwybutigebpjzj -cmem 0000pipe0PCommand96wiwybutigebpjzjkmlpqq4kelrogik -child

Jump to behavior

Source: getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: loselink.button.copymain.isntall.howconnection.session.titleconnection.menu.copyconnection.menu.generatelogin.password.titlelogin.password.ennterlogin.active.help.1login.link.dashboard.1login.link.dashboard.2login.link.registerlogin.link.restorelogin.link.help.1login.link.help.2login.active.device.titlelogin.active.contactlogin.menu.dashboardlogin.menu.logoutsettings.common.titlesettings.common.agentsettings.common.languagesettings.common.startupsettings.common.onetimesettings.common.adminsettings.permission.titlesettings.permission.controlsettings.permission.audiosettings.permission.micsettings.permission.filesettings.permission.lock_inputsettings.permission.confirmsettings.proxy.buttoninvite.disableinvite.button.agreecall.income.textcall.income.acceptcall.income.rejectcall.out.textcall.out.cancelcall.connect.textcall.connect.closecall.active.closecall.rejecet.textcall.rejecet.againcall.rejecet.closecall.finish.textcall.finish.closeturbo.button.hideturbo.button.endturbo.button.proxyturbo.button.closeturbo.button.callturbo.button.chatturbo.confirm.closeturbo.confirm.close.yesturbo.confirm.close.noturbo.menu.exitturbo.menu.chatturbo.menu.showsettings.proxy.usesettings.proxy.serversettings.proxy.loginsettings.proxy.passwordsettings.proxy.applysettings.proxy.cancelconnection.confirm.acceptinstall.turbo.line2install.turbo.confirmconnection.link.titleconnection.link.text.4connection.link.title.2connection.link.title.3connection.link.getlogin.active.help.title.headlogin.active.help.title.2login.active.help.title.3connection.menu.clipboardconnection.menu.diactivateconnection.menu.disableShell_traywnd

Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me https	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-469829524.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me https	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	631 Windows Management Instrumentation	1 Scripting	12 Process Injection	1 Masquerading	OS Credential Dumping	721 Security Software Discovery	Remote Services	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	53 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	53 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Modify Registry	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	122 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe	3%	ReversingLabs
C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	URL Reputation	safe
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	URL Reputation	safe
https://getscreen.me/signal/agent	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Avira URL Cloud	safe
https://%S/%S/agent/chat$.typeoutprocessDataH	0%	Avira URL Cloud	safe
http://proxy.contoso.com:3128/	0%	Avira URL Cloud	safe
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	0%	Avira URL Cloud	safe
http://proxy.pcommand.com:3128	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policy	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Virustotal		Browse
https://getscreen.me/signal/agent	0%	Virustotal		Browse
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	1%	Virustotal		Browse
https://getscreen.me/agent-policy	0%	Virustotal		Browse
http://proxy.pcommand.com:3128	0%	Virustotal		Browse
http://proxy.contoso.com:3128/	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.contoso.com:3128/	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://%S/%S/agent/chat$.typeoutprocessDataH	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720471000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF7765F1000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getscreen.me/agent-policy	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF720D41000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF776EC1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.pcommand.com:3128	getscreen-469829524.exe, 00000000.00000002.4118432812.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp, getscreen-469829524.exe, 00000001.00000002.4113959974.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp, dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe, 00000002.00000002.1661273201.00007FF721D02000.00000040.00000001.01000000.00000006.sdmp, getscreen-469829524.exe, 00000004.00000002.1832435803.00007FF777E82000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
51.89.95.37	unknown	France		16276	OVHFR	false
5.75.168.191	getscreen.me	Germany		24940	HETZNER-ASDE	true

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502577
Start date and time:	2024-09-02 02:41:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	getscreen-469829524.exe
Detection:	MAL
Classification:	mal54.phis.evad.winEXE@8/482@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
51.89.95.37	getscreen-156413884-x86.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
5.75.168.191	getscreen-156413884-x86.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://mukulkasana0001.github.io/netflix_clone	Get hash	malicious	HTMLPhisher	Browse	51.77.64.70
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	51.195.138.88
	XarsweLoader.exe	Get hash	malicious	LummaC Stealer	Browse	51.38.43.18
	soinjector.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
	https://hemanth-kumar-p.github.io/E-comm	Get hash	malicious	HTMLPhisher	Browse	188.165.80.188
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	193.70.74.252
	http://eedqt.foruskw.com/4lAabg16572cnef1382rzkeufeqnp14569ZZZRNPUIWFYUECM7379HVKJ18607i18	Get hash	malicious	Unknown	Browse	54.38.113.3
	Etisalat Summary Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	213.186.33.5
	fnMUjxpqa5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	54.39.19.94
	rBslc_Pymt-Hs.exe	Get hash	malicious	Remcos, DBatLoader	Browse	51.79.72.49
HETZNER-ASDE	https://linitha-royal.github.io/Netflix-Landing-Page	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	AdjustLoader.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	Order enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	88.99.66.38
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse	116.203.12.50
	http://lobster.cloudserver1097.com/3f9vxbkr4q83r4aq	Get hash	malicious	Unknown	Browse	159.69.12.52
	https://indd.adobe.com/view/30080812-36e9-4257-a76c-64b9db55c4c1	Get hash	malicious	HTMLPhisher	Browse	5.9.57.79
	https://download.metatrader.com/cdn/web/gvd.markets.capital/mt5/gvdmarkets5setup.exe	Get hash	malicious	LummaC Stealer	Browse	195.201.80.82
	https://168.119.60.168	Get hash	malicious	Unknown	Browse	168.119.60.168
	RFQ_0030829024SEPT.xla.xlsx	Get hash	malicious	Remcos	Browse	88.99.66.38
	LPO 92558 & 92669.exe	Get hash	malicious	FormBook	Browse	213.133.104.4

Process:	C:\Users\user\Desktop\getscreen-469829524.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4271408
Entropy (8bit):	7.943851360450553
Encrypted:	false
SSDEEP:	98304:+8YlQbDbj6CKUW4p2wgoQBVPJ77vmUkR2u/CTsTqRvsur:+PKNWSrtWPJ7QR5/CTsQvl
MD5:	D0BF9837CA88C67C4E4F972C686CD46C
SHA1:	2BD3C6CAE2F40FB10CEC7DBB0E23807A02548078
SHA-256:	4736FA94718E2A96EE2D6C454011294C8354935FE66C7F3118D981D0555238E4
SHA-512:	CE7D6705C9C2523A729DB0926CF864DB9212BF9AE46295728D5A72EE8B11D5A3A2A361311E5E0CD8031B667FD21B78EB6818C90A3708FAAB0C036AB74211E6B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........,...BE..BE..BE..AD..BE5}.E..BE5}FD..BE.FD..BE..BEa.BE..ED..BE5}AD..BE5}GD..BE..FD..BE..GD..BE..DD..BE..CD..BE..CE..BE.zKDi.BE.zBD..BE.z.E..BE...E..BE.z@D..BERich..BE........................PE..d..../.f.........."....(..@..P....O.P.....O....@....................................thA...`.........................................p7...T..P..........P:............@.0/.....$...............................(...@...@...........................................UPX0......O.............................UPX1......@...O...@.................@....rsrc....P.......D....@.............@..............................................................................................................................................................................................................................................................................................4.22.UPX!.$..

Entrypoint:	0x141908050
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66912FB0 [Fri Jul 12 13:29:20 2024 UTC]
TLS Callbacks:	0x41908298, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6d672e4bd356e5397fdadac0bf3134f4

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	28/05/2024 14:50:28 28/06/2026 15:36:10
Subject Chain	CN=POINT B LTD, O=POINT B LTD, L=Limassol, S=Limassol, C=CY, OID.1.3.6.1.4.1.311.60.2.1.3=CY, SERIALNUMBER=HE 430957, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9B083870477F4699693EEECABF351BF8
Thumbprint SHA-1:	B3C999E29AED18DEA59733F3CAA94E788B1AC3A1
Thumbprint SHA-256:	3E73B7C28C18DC6A03B9816F200365F1DF1FF80A7BD0D55DB920F1B24BBD74E7
Serial:	7AE0E9C1CFE2DCE0E21C4327

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x993770	0x548c	UPX0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x190ca50	0x7c8	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1909000	0x3a50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1850000	0x3fb88	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x40fe00	0x2f30	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x190d218	0x24	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x19082c0	0x28	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1908340	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x14fc000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x14fd000	0x40c000	0x40b600	6616965f06d8ac67aec214a0c5e92f8f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1909000	0x5000	0x4400	7e0a4896226c7d62a4db110d4d1d8361	False	0.45588235294117646	data	5.020294468398366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x1894a98	0x2	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894aa0	0x2	ASCII text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b08	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x18dcdb0	0x2	OpenPGP Public Key			5.0
AFX_DIALOG_LAYOUT	0x1894aa8	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b00	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b10	0x2a	data	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x1894b40	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894b68	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894b90	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894bb8	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894be0	0x2a	data	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x1894c10	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c28	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c20	0x2	International EBCDIC text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c18	0x2	ISO-8859 text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c30	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c38	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c40	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x18dcff0	0x2	ISO-8859 text, with no line terminators	English	United States	5.0
AFX_DIALOG_LAYOUT	0x1894c48	0x2	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c50	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c58	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c60	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c68	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c70	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894ab0	0x42	data	Russian	Russia	1.1666666666666667
AFX_DIALOG_LAYOUT	0x1894af8	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c78	0x2	data	Russian	Russia	5.0
INI	0x18dba18	0xa	data	Russian	Russia	1.8
LANG	0x18b4e60	0x1b82	data	Russian	Russia	0.9679068446464073
LANG	0x18b69e8	0x26fb	data	Russian	Russia	0.9749473895179878
LANG	0x18b90e8	0x1e2b	OpenPGP Secret Key	Russian	Russia	0.989382364366179
LANG	0x18baf18	0x1e5d	data	Russian	Russia	0.9117457866975428
LANG	0x18bcd78	0x1ca1	data	Russian	Russia	0.22663392004366217
LANG	0x18bea20	0x21fd	data	Russian	Russia	0.9332260659694288
LANG	0x18c0c20	0x1de4	data	Russian	Russia	0.9303450078410873
LANG	0x18c2a08	0x1a50	data	Russian	Russia	0.9318586698337292
LANG	0x18c4458	0x1d25	data	Russian	Russia	0.9304382790510656
LANG	0x18c6180	0x1e03	data	Russian	Russia	0.9288038526617207
LANG	0x18efc38	0x1ddc	data	English	United States	0.9743589743589743
OPUS	0x18c7f88	0xa5e5	data	Russian	Russia	0.9239916174150556
OPUS	0x18d2570	0x94a4	data	Russian	Russia	0.9105434668348575
RT_ICON	0x1894c80	0x139	data	Russian	Russia	1.035143769968051
RT_ICON	0x1894dc0	0x1ef	data	Russian	Russia	1.0222222222222221
RT_ICON	0x1894fb0	0x225	data	Russian	Russia	1.0200364298724955
RT_ICON	0x18951d8	0x26b	data	Russian	Russia	1.0177705977382876
RT_ICON	0x1895448	0x326	data	Russian	Russia	1.0136476426799008
RT_ICON	0x1895770	0x402	data	Russian	Russia	1.010721247563353
RT_ICON	0x190b0f0	0x13b	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.034920634920635
RT_ICON	0x190b230	0x1c5	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0242825607064017
RT_ICON	0x190b3fc	0x1ee	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0222672064777327
RT_ICON	0x190b5f0	0x253	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0184873949579831
RT_ICON	0x190b848	0x2e7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0148048452220726
RT_ICON	0x190bb34	0x3ad	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0116896918172158
RT_ICON	0x1896a20	0xac	data	Russian	Russia	1.063953488372093
RT_ICON	0x1896ae8	0x159	data	Russian	Russia	1.0318840579710145
RT_ICON	0x1896c48	0x1e6	data	Russian	Russia	1.022633744855967
RT_ICON	0x1896e30	0x1f6	data	Russian	Russia	1.0219123505976095
RT_ICON	0x1897028	0x26d	data	Russian	Russia	1.0177133655394526
RT_ICON	0x1897298	0x31b	data	Russian	Russia	1.0138364779874214
RT_ICON	0x18975b8	0x3e7	data	Russian	Russia	1.011011011011011
RT_ICON	0x1897a00	0xdd	data	Russian	Russia	1.0497737556561086
RT_ICON	0x1897af8	0x10f	data	Russian	Russia	1.040590405904059
RT_ICON	0x1897c20	0x25a8	data	Russian	Russia	0.9854771784232366
RT_ICON	0x189a1e0	0x12d	data	Russian	Russia	1.0365448504983388
RT_ICON	0x189a328	0x106	data	Russian	Russia	1.0419847328244274
RT_ICON	0x189a448	0x109	data	Russian	Russia	1.0415094339622641
RT_ICON	0x189a570	0x171	data	Russian	Russia	1.029810298102981
RT_ICON	0x189a700	0x109d	data	Russian	Russia	0.9891841053374089
RT_ICON	0x189b7b8	0xdd9	data	Russian	Russia	0.9616361071932299
RT_ICON	0x189c5b0	0xc0e	data	Russian	Russia	0.998703823720026
RT_ICON	0x189d1d8	0xb91	data	Russian	Russia	0.9419115163796015
RT_ICON	0x189dd88	0xdd9	data	Russian	Russia	0.9898448519040902
RT_ICON	0x189eb80	0x11c	data	Russian	Russia	1.0387323943661972
RT_ICON	0x189ecb8	0x116	data	Russian	Russia	1.039568345323741
RT_ICON	0x189ede8	0x1c4	data	Russian	Russia	1.0243362831858407
RT_ICON	0x189efc8	0x1a1	data	Russian	Russia	1.026378896882494
RT_ICON	0x189f188	0x182	data	Russian	Russia	1.028497409326425
RT_ICON	0x189f328	0x222	data	Russian	Russia	1.02014652014652
RT_ICON	0x189f568	0x11f	data	Russian	Russia	1.038327526132404
RT_ICON	0x189f6a0	0x103	data	Russian	Russia	1.0424710424710424
RT_ICON	0x189f7c0	0x1588	data	Russian	Russia	0.9704281567489115
RT_ICON	0x18a0d60	0x580	data	Russian	Russia	0.9595170454545454
RT_ICON	0x18a12f8	0x988	data	Russian	Russia	1.0045081967213114
RT_ICON	0x18a1c98	0x25a8	data	Russian	Russia	0.9699170124481328
RT_ICON	0x18a4258	0x10828	data	Russian	Russia	0.9846060570211759
RT_ICON	0x18dba28	0x163	data			1.0309859154929577
RT_ICON	0x18dbb90	0x20d	data			1.020952380952381
RT_ICON	0x18dbda0	0x21b	data			1.0204081632653061
RT_ICON	0x18dbfc0	0x282	data			1.017133956386293
RT_ICON	0x18dc248	0x33c	data			1.0132850241545894
RT_ICON	0x18dc588	0x413	data			1.0009587727708533
RT_ICON	0x18dca00	0x152	data			1.032544378698225
RT_ICON	0x18dcff8	0x10a8	data	English	United States	0.9392589118198874
RT_ICON	0x18de0b8	0x988	data	English	United States	0.9434426229508197
RT_ICON	0x18dea58	0x988	data	English	United States	0.9495901639344262
RT_ICON	0x18df3f8	0x10828	data	English	United States	0.9805690287471903
RT_MENU	0x18dcb70	0xf8	data			1.0443548387096775
RT_MENU	0x18b4d20	0xd2	data	Russian	Russia	1.0523809523809524
RT_MENU	0x18b4df8	0x66	data	Russian	Russia	1.107843137254902
RT_MENU	0x18dcc68	0x46	data			1.1571428571428573
RT_DIALOG	0x18920f0	0x490	data	Russian	Russia	0.8518835616438356
RT_DIALOG	0x1892580	0x78	data	Russian	Russia	1.075
RT_DIALOG	0x18dccb0	0x100	data			1.04296875
RT_DIALOG	0x18925f8	0x1f8	data	Russian	Russia	0.9523809523809523
RT_DIALOG	0x1892cb0	0x190	data	Russian	Russia	1.0175
RT_DIALOG	0x1892e40	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x1892f98	0xf4	data	Russian	Russia	1.0450819672131149
RT_DIALOG	0x1893090	0x12c	data	Russian	Russia	1.0366666666666666
RT_DIALOG	0x18931c0	0x110	data	Russian	Russia	1.0404411764705883
RT_DIALOG	0x18932d0	0x128	data	Russian	Russia	1.037162162162162
RT_DIALOG	0x18933f8	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x1893550	0x7e	data	Russian	Russia	1.0873015873015872
RT_DIALOG	0x1893808	0x148	data	Russian	Russia	1.0335365853658536
RT_DIALOG	0x1893738	0xd0	data	Russian	Russia	1.0528846153846154
RT_DIALOG	0x18935d0	0x164	data	Russian	Russia	1.0308988764044944
RT_DIALOG	0x1893950	0x14c	data	Russian	Russia	1.033132530120482
RT_DIALOG	0x1893aa0	0x1f0	data	Russian	Russia	1.0221774193548387
RT_DIALOG	0x1893c90	0x284	data	Russian	Russia	1.0170807453416149
RT_DIALOG	0x18dcdb8	0x232	data	English	United States	1.019572953736655
RT_DIALOG	0x1893f18	0x182	data	Russian	Russia	1.028497409326425
RT_DIALOG	0x18940a0	0x68	data	Russian	Russia	1.1057692307692308
RT_DIALOG	0x1894108	0x1f8	data	Russian	Russia	1.0218253968253967
RT_DIALOG	0x1894300	0x218	data	Russian	Russia	1.0205223880597014
RT_DIALOG	0x1894518	0x2ba	data	Russian	Russia	1.015759312320917
RT_DIALOG	0x18947d8	0x242	data	Russian	Russia	1.019031141868512
RT_DIALOG	0x18927f0	0x21c	data	Russian	Russia	0.9388888888888889
RT_DIALOG	0x1892a10	0x29a	data	Russian	Russia	0.9024024024024024
RT_DIALOG	0x1894a20	0x72	DOS executable (COM, 0x8C-variant)	Russian	Russia	1.0964912280701755
RT_STRING	0x18f1a18	0x38	data	Russian	Russia	1.1964285714285714
RT_GROUP_ICON	0x190bee8	0x5a	data	Russian	Russia	0.8
RT_GROUP_ICON	0x1895b78	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x18dc9a0	0x5a	data			1.1222222222222222
RT_GROUP_ICON	0x189f7a8	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1896ad0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18979a0	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x18a0d48	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1897ae0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x1897c08	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189a1c8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18dcb58	0x14	data			1.45
RT_GROUP_ICON	0x189a310	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189a430	0x14	SysEx File -	Russian	Russia	1.45
RT_GROUP_ICON	0x189a558	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189a6e8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189b7a0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189c598	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189d1c0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189dd70	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189eb68	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189eca0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189edd0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189efb0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f170	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f310	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f550	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f688	0x14	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	1.45
RT_GROUP_ICON	0x18a12e0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18a1c80	0x14	hp300 (68020+68881) BSD	Russian	Russia	1.45
RT_GROUP_ICON	0x18de0a0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18a4240	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18b4a80	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18dea40	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18df3e0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18efc20	0x14	data	English	United States	1.4
RT_VERSION	0x190bf48	0x284	data	Russian	Russia	0.468944099378882
RT_MANIFEST	0x190c1d0	0x87f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2115), with CRLF line terminators	English	United States	0.31264367816091954

DLL	Import
ADVAPI32.dll	FreeSid
COMCTL32.dll	_TrackMouseEvent
d3d11.dll	D3D11CreateDevice
dbghelp.dll	SymFromAddr
dxgi.dll	CreateDXGIFactory1
GDI32.dll	LineTo
gdiplus.dll	GdipFree
IPHLPAPI.DLL	GetIfEntry2
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MPR.dll	WNetGetConnectionW
msdmo.dll	MoInitMediaType
NETAPI32.dll	NetUserGetInfo
ntdll.dll	RtlGetVersion
NTDSAPI.dll	DsMakeSpnW
ole32.dll	OleCreate
OLEAUT32.dll	VarUI4FromStr
POWRPROF.dll	PowerGetActiveScheme
RPCRT4.dll	UuidEqual
SAS.dll	SendSAS
Secur32.dll	DeleteSecurityContext
SHELL32.dll
SHLWAPI.dll	PathFileExistsW
USER32.dll	GetDC
USERENV.dll	CreateEnvironmentBlock
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WINHTTP.dll	WinHttpOpen
WINMM.dll	waveInOpen
WINSPOOL.DRV	GetPrinterW
WS2_32.dll	htonl
WTSAPI32.dll	WTSFreeMemory

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 2, 2024 02:41:57.023051023 CEST	192.168.2.4	1.1.1.1	0x856d	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:00.219943047 CEST	192.168.2.4	1.1.1.1	0xbff2	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:59.681657076 CEST	192.168.2.4	1.1.1.1	0x115e	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:44:59.678242922 CEST	192.168.2.4	1.1.1.1	0xdb7d	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:46:01.506428957 CEST	192.168.2.4	1.1.1.1	0xb0a1	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 2, 2024 02:41:57.031378984 CEST	1.1.1.1	192.168.2.4	0x856d	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:41:57.031378984 CEST	1.1.1.1	192.168.2.4	0x856d	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:41:57.031378984 CEST	1.1.1.1	192.168.2.4	0x856d	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:00.227791071 CEST	1.1.1.1	192.168.2.4	0xbff2	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:00.227791071 CEST	1.1.1.1	192.168.2.4	0xbff2	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:00.227791071 CEST	1.1.1.1	192.168.2.4	0xbff2	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:59.689631939 CEST	1.1.1.1	192.168.2.4	0x115e	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:59.689631939 CEST	1.1.1.1	192.168.2.4	0x115e	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:43:59.689631939 CEST	1.1.1.1	192.168.2.4	0x115e	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:44:59.686451912 CEST	1.1.1.1	192.168.2.4	0xdb7d	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:44:59.686451912 CEST	1.1.1.1	192.168.2.4	0xdb7d	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:44:59.686451912 CEST	1.1.1.1	192.168.2.4	0xdb7d	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:46:01.523608923 CEST	1.1.1.1	192.168.2.4	0xb0a1	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:46:01.523608923 CEST	1.1.1.1	192.168.2.4	0xb0a1	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 2, 2024 02:46:01.523608923 CEST	1.1.1.1	192.168.2.4	0xb0a1	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:41:57 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:41:57 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:41:57 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-02 00:41:57 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:42:09 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:42:10 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:42:10 GMT content-length: 12 x-envoy-upstream-service-time: 8 server: lb2.getscreen.me connection: close
2024-09-02 00:42:10 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report getscreen-469829524.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe

C:\ProgramData\Getscreen.me\dztvkxlovsiqwfdjxlwevyxacycmahb-elevate.exe:Zone.Identifier

C:\ProgramData\Getscreen.me\folder\settings.dat

C:\ProgramData\Getscreen.me\logs\20240902.log

C:\ProgramData\Getscreen.me\logs\20240903.log

C:\ProgramData\Getscreen.me\logs\20240905.log

C:\ProgramData\Getscreen.me\logs\20240908.log

C:\ProgramData\Getscreen.me\logs\20240910.log

C:\ProgramData\Getscreen.me\logs\20240911.log

C:\ProgramData\Getscreen.me\logs\20240913.log

C:\ProgramData\Getscreen.me\logs\20240914.log

C:\ProgramData\Getscreen.me\logs\20240915.log

C:\ProgramData\Getscreen.me\logs\20240917.log

C:\ProgramData\Getscreen.me\logs\20240919.log

C:\ProgramData\Getscreen.me\logs\20240920.log

C:\ProgramData\Getscreen.me\logs\20240922.log

C:\ProgramData\Getscreen.me\logs\20240923.log

C:\ProgramData\Getscreen.me\logs\20240925.log

C:\ProgramData\Getscreen.me\logs\20240927.log

C:\ProgramData\Getscreen.me\logs\20240928.log

C:\ProgramData\Getscreen.me\logs\20240929.log

Windows Analysis Report
getscreen-469829524.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:42:28 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:42:29 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:42:29 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-02 00:42:29 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:42:35 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:42:36 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:42:35 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-02 00:42:36 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:42:46 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:42:46 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:42:46 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-02 00:42:46 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:43:00 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:43:01 UTC	266	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:43:01 GMT content-length: 12 x-envoy-upstream-service-time: 20 server: ov1.getscreen.me connection: close
2024-09-02 00:43:01 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:43:03 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:43:03 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:43:03 GMT content-length: 12 x-envoy-upstream-service-time: 7 server: ov1.getscreen.me connection: close
2024-09-02 00:43:03 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:43:08 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:43:08 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:43:08 GMT content-length: 12 x-envoy-upstream-service-time: 7 server: ov1.getscreen.me connection: close
2024-09-02 00:43:08 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-02 00:43:12 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-02 00:43:13 UTC	266	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Mon, 02 Sep 2024 00:43:13 GMT content-length: 12 x-envoy-upstream-service-time: 19 server: ov1.getscreen.me connection: close
2024-09-02 00:43:13 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Target ID:	0
Start time:	20:41:53
Start date:	01/09/2024
Path:	C:\Users\user\Desktop\getscreen-469829524.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\getscreen-469829524.exe"
Imagebase:	0x7ff7765f0000
File size:	4'271'408 bytes
MD5 hash:	D0BF9837CA88C67C4E4F972C686CD46C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	20:41:54
Start date:	01/09/2024
Path:	C:\Users\user\Desktop\getscreen-469829524.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\getscreen-469829524.exe" -gpipe \\.\pipe\PCommand97kipwvswuxtgtrmg -gui
Imagebase:	0x7ff7765f0000
File size:	4'271'408 bytes
MD5 hash:	D0BF9837CA88C67C4E4F972C686CD46C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	20:41:56
Start date:	01/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false