Edit tour

Windows Analysis Report
getscreen-941605629.exe

Overview

General Information

Sample name:	getscreen-941605629.exe
Analysis ID:	1503276
MD5:	68a2084d2c6e3110e4cd3acb4448d049
SHA1:	d98646c8de52442a09317a799da25ffc964e039e
SHA256:	d4af13599ab7d33b6f280a03140eb6183c26e142227493a4ebe447b1557f213c
Tags:	exe
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	62
Range:	0 - 100

Signatures

Modifies Internet Explorer zonemap settings

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Abnormal high CPU Usage

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: IE Change Domain Zone

Classification

Process Tree

System is w10x64

getscreen-941605629.exe (PID: 6128 cmdline: "C:\Users\user\Desktop\getscreen-941605629.exe" MD5: 68A2084D2C6E3110E4CD3ACB4448D049)

getscreen-941605629.exe (PID: 5268 cmdline: "C:\Users\user\Desktop\getscreen-941605629.exe" -gpipe \\.\pipe\PCommand97cnxqwmieduwtdve -gui MD5: 68A2084D2C6E3110E4CD3ACB4448D049)

getscreen-941605629.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\getscreen-941605629.exe" -cpipe \\.\pipe\PCommand96zasbdhxrjslrbjj -cmem 0000pipe0PCommand96zasbdhxrjslrbjj4lktjsmfh540dwi -child MD5: 68A2084D2C6E3110E4CD3ACB4448D049)

jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe (PID: 940 cmdline: "C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe" -elevate \\.\pipe\elevateGS512jvngvlqxfhugokvuuudzsqqeudgxczk MD5: 68A2084D2C6E3110E4CD3ACB4448D049)

svchost.exe (PID: 1268 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4072 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

Sigma detected: IE Change Domain Zone

Source: Registry Key set

Author: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\getscreen-941605629.exe, ProcessId: 5268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me\http

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, ProcessId: 1268, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Bitcoin Miner

Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-941605629.exe			Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION getscreen-941605629.exe			Jump to behavior

Compliance

PE / OLE file has a valid certificate

Source: getscreen-941605629.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-941605629.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp

Networking

Source: Joe Sandbox View	IP Address: 78.47.165.25 78.47.165.25
Source: Joe Sandbox View	IP Address: 5.75.168.191 5.75.168.191

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
Source: global traffic	HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)

Source: global traffic

DNS traffic detected: DNS query: getscreen.me

Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.contoso.com:3128/
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B4872000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.pcommand.com:3128
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/exper
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.we
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-id
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://%S/%S/agent/chat$.typeoutprocessDataH
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policy
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link
Source: getscreen-941605629.exe, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56043
Source: unknown	Network traffic detected: HTTP traffic on port 53844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56051
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56050
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56064
Source: unknown	Network traffic detected: HTTP traffic on port 53856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56061
Source: unknown	Network traffic detected: HTTP traffic on port 53729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56076
Source: unknown	Network traffic detected: HTTP traffic on port 53820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56072
Source: unknown	Network traffic detected: HTTP traffic on port 54712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56003
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56008
Source: unknown	Network traffic detected: HTTP traffic on port 53819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56009
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56014
Source: unknown	Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56010
Source: unknown	Network traffic detected: HTTP traffic on port 55923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56019
Source: unknown	Network traffic detected: HTTP traffic on port 55911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56021
Source: unknown	Network traffic detected: HTTP traffic on port 53615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56034
Source: unknown	Network traffic detected: HTTP traffic on port 54928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56036
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56030
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56032
Source: unknown	Network traffic detected: HTTP traffic on port 53807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 56803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 53537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 54989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 56929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 56930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 56917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 53910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 54851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 56065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 53664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 56827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 53893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 56089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 54838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56080
Source: unknown	Network traffic detected: HTTP traffic on port 55299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56083
Source: unknown	Network traffic detected: HTTP traffic on port 55628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 55616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56099
Source: unknown	Network traffic detected: HTTP traffic on port 54953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56094
Source: unknown	Network traffic detected: HTTP traffic on port 56077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 53640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 55161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 54430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 54965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 55882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 53513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 56839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 55058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 54466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown	Network traffic detected: HTTP traffic on port 53550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown	Network traffic detected: HTTP traffic on port 55996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 54544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 56041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 56840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53790
Source: unknown	Network traffic detected: HTTP traffic on port 53286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53797
Source: unknown	Network traffic detected: HTTP traffic on port 56647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56168
Source: unknown	Network traffic detected: HTTP traffic on port 54677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56163
Source: unknown	Network traffic detected: HTTP traffic on port 53466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56164
Source: unknown	Network traffic detected: HTTP traffic on port 56858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56160
Source: unknown	Network traffic detected: HTTP traffic on port 54436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56169
Source: unknown	Network traffic detected: HTTP traffic on port 56846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56179
Source: unknown	Network traffic detected: HTTP traffic on port 53339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56171
Source: unknown	Network traffic detected: HTTP traffic on port 56148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53900
Source: unknown	Network traffic detected: HTTP traffic on port 53352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53904
Source: unknown	Network traffic detected: HTTP traffic on port 54689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56189
Source: unknown	Network traffic detected: HTTP traffic on port 54298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56183
Source: unknown	Network traffic detected: HTTP traffic on port 55052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56186

System Summary

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Process Stats: CPU usage > 49%

Source: getscreen-941605629.exe	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)
Source: jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	Static PE information: Resource name: RT_DIALOG type: DOS executable (COM, 0x8C-variant)

Source: getscreen-941605629.exe, 00000000.00000000.2036678420.00007FF760029000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe, 00000000.00000002.4505490111.00007FF760029000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe, 00000001.00000000.2039920866.00007FF760029000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe, 00000001.00000002.4503381736.00007FF760029000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe, 00000005.00000002.2223819826.00007FF760029000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe, 00000005.00000000.2069421837.00007FF760029000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe
Source: getscreen-941605629.exe	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-941605629.exe

Source: classification engine

Classification label: mal54.phis.evad.winEXE@9/276@5/2

Source: C:\Users\user\Desktop\getscreen-941605629.exe

File created: C:\Users\user\AppData\Local\Getscreen.me

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\PCommandMutextTurbo96phqghum

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe

File read: C:\Users\user\Desktop\getscreen-941605629.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe"
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe" -gpipe \\.\pipe\PCommand97cnxqwmieduwtdve -gui
Source: unknown	Process created: C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe "C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe" -elevate \\.\pipe\elevateGS512jvngvlqxfhugokvuuudzsqqeudgxczk
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe" -cpipe \\.\pipe\PCommand96zasbdhxrjslrbjj -cmem 0000pipe0PCommand96zasbdhxrjslrbjj4lktjsmfh540dwi -child
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe" -gpipe \\.\pipe\PCommand97cnxqwmieduwtdve -gui	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe" -cpipe \\.\pipe\PCommand96zasbdhxrjslrbjj -cmem 0000pipe0PCommand96zasbdhxrjslrbjj4lktjsmfh540dwi -child	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: mfwmaaec.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: getscreen-941605629.exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: getscreen-941605629.exe

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: getscreen-941605629.exe

Static file information: File size 4271408 > 1048576

PE file has a big raw section

Source: getscreen-941605629.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x40b600

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-941605629.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Project\agent-windows\console\x64\Release\getscreen.pdb source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Code function: 0_2_00007FF7600280C0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF7600280C0

Source: getscreen-941605629.exe	Static PE information: real checksum: 0x416874 should be: 0x41733a
Source: jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe.0.dr	Static PE information: real checksum: 0x416874 should be: 0x41733a

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe

File created: C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe

Jump to dropped file

Source: C:\Users\user\Desktop\getscreen-941605629.exe

File created: C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\getscreen-941605629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-941605629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, Manufacturer, MACAddress, Speed, InterfaceIndex, Index, GUID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Users\user\Desktop\getscreen-941605629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 1
Source: C:\Users\user\Desktop\getscreen-941605629.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, VolumeName, FileSystem, Size, FreeSpace FROM Win32_LogicalDisk

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption FROM Win32_SoundDevice

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\getscreen-941605629.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	System information queried: FirmwareTableInformation	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 518	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 1124	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 506	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 473	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 557	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 9993	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Window / User API: threadDelayed 930	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 1216	Thread sleep count: 518 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 6024	Thread sleep count: 1124 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 5776	Thread sleep count: 506 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 1816	Thread sleep count: 473 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 1216	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 1492	Thread sleep count: 557 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 6504	Thread sleep count: 218 > 30	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe TID: 5656	Thread sleep count: 930 > 30	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\getscreen-941605629.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Last function: Thread delayed

Source: getscreen-941605629.exe, 00000000.00000002.4502622442.000001BD8349E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $VMware Virtual RAM]2o
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V console (use port 2179, disable negotiation)
Source: getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMnet
Source: getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75FF43000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: RAM slot #0RAM slot #0@VMware Virtual RAMVMW-4096MB00000001
Source: getscreen-941605629.exe, 00000000.00000002.4495825572.0000000F365F4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {"token":"","uid":"2ED92742-89DC-DD72-92E8-869FA5A66493","turbo":"1359221725237812acCwFfvTAh5JGga0Hc1p","turbo_old":"","invite":"","brand":"","install":false,"admin":true,"isadmin":true,"onetime":true,"file_download":true,"name":"675052","nonadmin":true,"islock":false,"blackscreen_available":true,"hibernate":true,"power_supply":true,"silent":false,"os":"win","rdp":false,"os_user":"user","os_username":"","build":2,"version":"2.21.3","hardware":"{\"CPU\":\"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\",\"CPUSpeed\":2000,\"CPUCores\":4,\"CPUCoresLogical\":1,\"CPUFamily\":\"Intel64 Family 6 Model 143 Stepping 8\",\"BIOS\":\"OWE4KGXFBH\",\"BIOSVersion\":\"20221121\",\"BIOSDate\":\"\",\"RAMPhys\":8191,\"RAMPhysAvail\":2317,\"RAMVirt\":134217727,\"RAMVirtAvail\":134213422,\"RAMPageFile\":8191,\"RAMBanks\":[{\"Bank\":\"RAM slot #0\",\"Locator\":\"RAM slot #0\",\"DataWidth\":64,\"Manufacturer\":\"VMware Virtual RAM\",\"PartNumber\":\"VMW-4096MB\",\"SerialNumber\":\"00000001\",\"Capacity\":4096}],\"VideoName\":\"3KX14BB580
Source: getscreen-941605629.exe, 00000000.00000002.4495825572.0000000F365F4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {"CPU":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","CPUSpeed":2000,"CPUCores":4,"CPUCoresLogical":1,"CPUFamily":"Intel64 Family 6 Model 143 Stepping 8","BIOS":"OWE4KGXFBH","BIOSVersion":"20221121","BIOSDate":"","RAMPhys":8191,"RAMPhysAvail":2317,"RAMVirt":134217727,"RAMVirtAvail":134213422,"RAMPageFile":8191,"RAMBanks":[{"Bank":"RAM slot #0","Locator":"RAM slot #0","DataWidth":64,"Manufacturer":"VMware Virtual RAM","PartNumber":"VMW-4096MB","SerialNumber":"00000001","Capacity":4096}],"VideoName":"3KX14BB58","VideoRAM":1024,"VideoCards":[{"Name":"3KX14BB58","RAM":1024,"Integrated":false}],"Locale":"0809","LocaleOemPage":"1252","LocaleCountry":"Switzerland","LocaleCurrency":"CHF","LocaleTimezone":120,"LocaleFormatTime":"HH:mm:ss","LocaleFormatDate":"dd\/MM\/yyyy","ComputerModel":"GxTvgo3C","ComputerDomain":"gFKCE","ComputerWorkgroup":"WORKGROUP","ComputerName":"user-PC","ComputerIP":["192.168.2.5","fe80::357a:d50d:a849:be2d"],"OSName":"Microsoft Windows 10 Pro","OSVersion":"10.0.19045","HDD":[{"Model":"N2RW_BMS
Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75FF43000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Virtual RAM
Source: getscreen-941605629.exe, 00000005.00000002.2222009092.0000021D93B29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRR2
Source: getscreen-941605629.exe, 00000000.00000002.4495825572.0000000F365F4000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: {"token":"","uid":"2ED92742-89DC-DD72-92E8-869FA5A66493","turbo":"1359221725237812acCwFfvTAh5JGga0Hc1p","turbo_old":"","invite":"","brand":"","install":false,"admin":true,"isadmin":true,"onetime":true,"file_download":true,"name":"675052","nonadmin":true,"islock":false,"blackscreen_available":true,"hibernate":true,"power_supply":true,"silent":false,"os":"win","rdp":false,"os_user":"user","os_username":"","build":2,"version":"2.21.3","hardware":"{\"CPU\":\"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\",\"CPUSpeed\":2000,\"CPUCores\":4,\"CPUCoresLogical\":1,\"CPUFamily\":\"Intel64 Family 6 Model 143 Stepping 8\",\"BIOS\":\"OWE4KGXFBH\",\"BIOSVersion\":\"20221121\",\"BIOSDate\":\"\",\"RAMPhys\":8191,\"RAMPhysAvail\":2317,\"RAMVirt\":134217727,\"RAMVirtAvail\":134213422,\"RAMPageFile\":8191,\"RAMBanks\":[{\"Bank\":\"RAM slot #0\",\"Locator\":\"RAM slot #0\",\"DataWidth\":64,\"Manufacturer\":\"VMware Virtual RAM\",\"PartNumber\":\"VMW-4096MB\",\"SerialNumber\":\"00000001\",\"Capacity\":4096}],\"VideoName\":\"3KX14BB58
Source: jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2052907964.00000147E01A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: getscreen-941605629.exe, 00000000.00000002.4499631348.000001BD81538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll``
Source: getscreen-941605629.exe, 00000001.00000002.4491146624.0000016D76E57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZZ

Source: C:\Users\user\Desktop\getscreen-941605629.exe	API call chain: ExitProcess graph end node	graph_0-79
Source: C:\Users\user\Desktop\getscreen-941605629.exe	API call chain: ExitProcess graph end node	graph_1-79
Source: C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe	API call chain: ExitProcess graph end node	graph_3-79
Source: C:\Users\user\Desktop\getscreen-941605629.exe	API call chain: ExitProcess graph end node	graph_5-79

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\getscreen-941605629.exe

Code function: 0_2_00007FF7600280C0 LoadLibraryA,GetProcAddressForCaller,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00007FF7600280C0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\svchost.exe

Process created: C:\Users\user\Desktop\getscreen-941605629.exe "C:\Users\user\Desktop\getscreen-941605629.exe" -cpipe \\.\pipe\PCommand96zasbdhxrjslrbjj -cmem 0000pipe0PCommand96zasbdhxrjslrbjj4lktjsmfh540dwi -child

Jump to behavior

Source: getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp

Binary or memory string: loselink.button.copymain.isntall.howconnection.session.titleconnection.menu.copyconnection.menu.generatelogin.password.titlelogin.password.ennterlogin.active.help.1login.link.dashboard.1login.link.dashboard.2login.link.registerlogin.link.restorelogin.link.help.1login.link.help.2login.active.device.titlelogin.active.contactlogin.menu.dashboardlogin.menu.logoutsettings.common.titlesettings.common.agentsettings.common.languagesettings.common.startupsettings.common.onetimesettings.common.adminsettings.permission.titlesettings.permission.controlsettings.permission.audiosettings.permission.micsettings.permission.filesettings.permission.lock_inputsettings.permission.confirmsettings.proxy.buttoninvite.disableinvite.button.agreecall.income.textcall.income.acceptcall.income.rejectcall.out.textcall.out.cancelcall.connect.textcall.connect.closecall.active.closecall.rejecet.textcall.rejecet.againcall.rejecet.closecall.finish.textcall.finish.closeturbo.button.hideturbo.button.endturbo.button.proxyturbo.button.closeturbo.button.callturbo.button.chatturbo.confirm.closeturbo.confirm.close.yesturbo.confirm.close.noturbo.menu.exitturbo.menu.chatturbo.menu.showsettings.proxy.usesettings.proxy.serversettings.proxy.loginsettings.proxy.passwordsettings.proxy.applysettings.proxy.cancelconnection.confirm.acceptinstall.turbo.line2install.turbo.confirmconnection.link.titleconnection.link.text.4connection.link.title.2connection.link.title.3connection.link.getlogin.active.help.title.headlogin.active.help.title.2login.active.help.title.3connection.menu.clipboardconnection.menu.diactivateconnection.menu.disableShell_traywnd

Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me https	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me http	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-941605629.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me https	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	631 Windows Management Instrumentation	1 Scripting	12 Process Injection	1 Masquerading	OS Credential Dumping	721 Security Software Discovery	Remote Services	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	53 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	53 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Modify Registry	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	122 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
getscreen-941605629.exe	3%	Virustotal		Browse
getscreen-941605629.exe	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe	3%	ReversingLabs
C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	URL Reputation	safe
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	0%	URL Reputation	safe
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Avira URL Cloud	safe
https://%S/%S/agent/chat$.typeoutprocessDataH	0%	Avira URL Cloud	safe
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	0%	Avira URL Cloud	safe
http://proxy.contoso.com:3128/	0%	Avira URL Cloud	safe
https://getscreen.me/signal/agent	0%	Avira URL Cloud	safe
https://getscreen.me/agent-policy	0%	Avira URL Cloud	safe
http://proxy.pcommand.com:3128	0%	Avira URL Cloud	safe
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	1%	Virustotal		Browse
http://proxy.contoso.com:3128/	0%	Virustotal		Browse
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	0%	Virustotal		Browse
https://getscreen.me/agent-policy	0%	Virustotal		Browse
https://getscreen.me/signal/agent	0%	Virustotal		Browse
http://proxy.pcommand.com:3128	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://getscreen.me/agent-policyhttps://%s/docs/agenthttps://%s/?utm_source=agent&utm_campaign=link	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.contoso.com:3128/	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://%S/%S/agent/chat$.typeoutprocessDataH	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B2FE1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75E721000.00000040.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getscreen.me/agent-policy	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B38B1000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75EFF1000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://proxy.pcommand.com:3128	getscreen-941605629.exe, 00000000.00000002.4503799590.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp, getscreen-941605629.exe, 00000001.00000002.4499446110.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp, jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe, 00000003.00000002.2053077816.00007FF6B4872000.00000040.00000001.01000000.00000006.sdmp, getscreen-941605629.exe, 00000005.00000002.2222277296.00007FF75FFB2000.00000040.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.47.165.25	unknown	Germany		24940	HETZNER-ASDE	false
5.75.168.191	getscreen.me	Germany		24940	HETZNER-ASDE	true

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503276
Start date and time:	2024-09-03 09:45:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	getscreen-941605629.exe
Detection:	MAL
Classification:	mal54.phis.evad.winEXE@9/276@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
78.47.165.25	getscreen-156413884-x86.exe	Get hash	malicious	Unknown	Browse
	getscreen-156413884-x86.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse
	getscreen-447303723.exe	Get hash	malicious	Unknown	Browse
5.75.168.191	getscreen-469829524.exe	Get hash	malicious	Unknown	Browse
	getscreen-469829524.exe	Get hash	malicious	Unknown	Browse
	getscreen-156413884-x86.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-511588515.exe	Get hash	malicious	Unknown	Browse
	getscreen-973519027.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-959987858.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	116.203.55.214
	http://instagrab000.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	116.202.167.133
	SecuriteInfo.com.Exploit.CVE-2017-0199.121.20522.7152.xlsx	Get hash	malicious	FormBook	Browse	88.99.66.38
	66d5ddcec1520_shtr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.220.8
	66d5ddcbb9f86_vyre.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.220.8
	Unlock_Tool_5.0.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	116.203.12.50
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	SecuriteInfo.com.Win32.TrojanX-gen.12944.32631.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	176.9.8.206
	Thermo Fisher RFQ_TFS-1705.xls	Get hash	malicious	GuLoader	Browse	88.99.66.38
HETZNER-ASDE	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	116.203.55.214
	http://instagrab000.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	116.202.167.133
	SecuriteInfo.com.Exploit.CVE-2017-0199.121.20522.7152.xlsx	Get hash	malicious	FormBook	Browse	88.99.66.38
	66d5ddcec1520_shtr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	5.75.220.8
	66d5ddcbb9f86_vyre.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.220.8
	Unlock_Tool_5.0.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	116.203.12.50
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	Setup_IDM.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	SecuriteInfo.com.Win32.TrojanX-gen.12944.32631.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	176.9.8.206
	Thermo Fisher RFQ_TFS-1705.xls	Get hash	malicious	GuLoader	Browse	88.99.66.38

Process:	C:\Users\user\Desktop\getscreen-941605629.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.875
Encrypted:	false
SSDEEP:	3:Bv5ByGsbIOM+C8uzP:LURJuj
MD5:	D26DA4EAF65DADD3122C739C257AAAB3
SHA1:	385EC3F4159189352D7830389715BFAC7D43B05D
SHA-256:	E5BCFE7DD9FCA6B25BB5D430C8350DAC05A0C758D8FD74FA5A10A744CA3790EB
SHA-512:	59E372BA6747FF4AB42C1296F40CE506233A2024C559D6D6A2F36E59AC192D88E20F864A472EBC4E15FB9144079874F53B5DE956F67D963442408CBD70841EA0
Malicious:	false
Reputation:	low
Preview:	...J.+.q....:.O&...8./....3az-....,.6.<.....2.@\.%.+.#.K.jK..

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9438513313160914
TrID:	Win64 Executable GUI (202006/5) 81.26% UPX compressed Win32 Executable (30571/9) 12.30% Win64 Executable (generic) (12005/4) 4.83% Generic Win/DOS Executable (2004/3) 0.81% DOS Executable Generic (2002/1) 0.81%
File name:	getscreen-941605629.exe
File size:	4'271'408 bytes
MD5:	68a2084d2c6e3110e4cd3acb4448d049
SHA1:	d98646c8de52442a09317a799da25ffc964e039e
SHA256:	d4af13599ab7d33b6f280a03140eb6183c26e142227493a4ebe447b1557f213c
SHA512:	9f9d61fb7fbc19d081d2db3b32ca01518da7eb1c76ed78c8bebe1879a0dd2226bd687cc0ba2d28657d1a6e8e5c57e4b869d501a065a9c9ec4a7f68b9f482576a
SSDEEP:	98304:+8YlQbDbj6CKUW4p2wgoQBVPJ77vmUkR2u/CTsTqRvsuG:+PKNWSrtWPJ7QR5/CTsQvs
TLSH:	311633298EDB9B41E191B7F63B1DAEB5D67CE8221149C1D09F8F8DC6E03178067F9209
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........,...BE..BE..BE..AD..BE5}.E..BE5}FD..BE..FD..BE..BEa.BE..ED..BE5}AD..BE5}GD..BE..FD..BE..GD..BE..DD..BE..CD..BE..CE..BE.zKDi.B

Entrypoint:	0x141908050
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66912FB0 [Fri Jul 12 13:29:20 2024 UTC]
TLS Callbacks:	0x41908298, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6d672e4bd356e5397fdadac0bf3134f4

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	28/05/2024 15:50:28 28/06/2026 16:36:10
Subject Chain	CN=POINT B LTD, O=POINT B LTD, L=Limassol, S=Limassol, C=CY, OID.1.3.6.1.4.1.311.60.2.1.3=CY, SERIALNUMBER=HE 430957, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9B083870477F4699693EEECABF351BF8
Thumbprint SHA-1:	B3C999E29AED18DEA59733F3CAA94E788B1AC3A1
Thumbprint SHA-256:	3E73B7C28C18DC6A03B9816F200365F1DF1FF80A7BD0D55DB920F1B24BBD74E7
Serial:	7AE0E9C1CFE2DCE0E21C4327

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x993770	0x548c	UPX0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x190ca50	0x7c8	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1909000	0x3a50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1850000	0x3fb88	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x40fe00	0x2f30	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x190d218	0x24	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x19082c0	0x28	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1908340	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x14fc000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x14fd000	0x40c000	0x40b600	6616965f06d8ac67aec214a0c5e92f8f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1909000	0x5000	0x4400	7e0a4896226c7d62a4db110d4d1d8361	False	0.45588235294117646	data	5.020294468398366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x1894a98	0x2	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894aa0	0x2	ASCII text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b08	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x18dcdb0	0x2	OpenPGP Public Key			5.0
AFX_DIALOG_LAYOUT	0x1894aa8	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b00	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894b10	0x2a	data	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x1894b40	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894b68	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894b90	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894bb8	0x22	data	Russian	Russia	1.2647058823529411
AFX_DIALOG_LAYOUT	0x1894be0	0x2a	data	Russian	Russia	1.2142857142857142
AFX_DIALOG_LAYOUT	0x1894c10	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c28	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c20	0x2	International EBCDIC text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c18	0x2	ISO-8859 text, with no line terminators, with overstriking	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c30	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c38	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c40	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x18dcff0	0x2	ISO-8859 text, with no line terminators	English	United States	5.0
AFX_DIALOG_LAYOUT	0x1894c48	0x2	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c50	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c58	0x2	ASCII text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c60	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c68	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c70	0x2	data	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894ab0	0x42	data	Russian	Russia	1.1666666666666667
AFX_DIALOG_LAYOUT	0x1894af8	0x2	ISO-8859 text, with no line terminators	Russian	Russia	5.0
AFX_DIALOG_LAYOUT	0x1894c78	0x2	data	Russian	Russia	5.0
INI	0x18dba18	0xa	data	Russian	Russia	1.8
LANG	0x18b4e60	0x1b82	data	Russian	Russia	0.9679068446464073
LANG	0x18b69e8	0x26fb	data	Russian	Russia	0.9749473895179878
LANG	0x18b90e8	0x1e2b	OpenPGP Secret Key	Russian	Russia	0.989382364366179
LANG	0x18baf18	0x1e5d	data	Russian	Russia	0.9117457866975428
LANG	0x18bcd78	0x1ca1	data	Russian	Russia	0.22663392004366217
LANG	0x18bea20	0x21fd	data	Russian	Russia	0.9332260659694288
LANG	0x18c0c20	0x1de4	data	Russian	Russia	0.9303450078410873
LANG	0x18c2a08	0x1a50	data	Russian	Russia	0.9318586698337292
LANG	0x18c4458	0x1d25	data	Russian	Russia	0.9304382790510656
LANG	0x18c6180	0x1e03	data	Russian	Russia	0.9288038526617207
LANG	0x18efc38	0x1ddc	data	English	United States	0.9743589743589743
OPUS	0x18c7f88	0xa5e5	data	Russian	Russia	0.9239916174150556
OPUS	0x18d2570	0x94a4	data	Russian	Russia	0.9105434668348575
RT_ICON	0x1894c80	0x139	data	Russian	Russia	1.035143769968051
RT_ICON	0x1894dc0	0x1ef	data	Russian	Russia	1.0222222222222221
RT_ICON	0x1894fb0	0x225	data	Russian	Russia	1.0200364298724955
RT_ICON	0x18951d8	0x26b	data	Russian	Russia	1.0177705977382876
RT_ICON	0x1895448	0x326	data	Russian	Russia	1.0136476426799008
RT_ICON	0x1895770	0x402	data	Russian	Russia	1.010721247563353
RT_ICON	0x190b0f0	0x13b	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.034920634920635
RT_ICON	0x190b230	0x1c5	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0242825607064017
RT_ICON	0x190b3fc	0x1ee	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0222672064777327
RT_ICON	0x190b5f0	0x253	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0184873949579831
RT_ICON	0x190b848	0x2e7	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0148048452220726
RT_ICON	0x190bb34	0x3ad	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	Russian	Russia	1.0116896918172158
RT_ICON	0x1896a20	0xac	data	Russian	Russia	1.063953488372093
RT_ICON	0x1896ae8	0x159	data	Russian	Russia	1.0318840579710145
RT_ICON	0x1896c48	0x1e6	data	Russian	Russia	1.022633744855967
RT_ICON	0x1896e30	0x1f6	data	Russian	Russia	1.0219123505976095
RT_ICON	0x1897028	0x26d	data	Russian	Russia	1.0177133655394526
RT_ICON	0x1897298	0x31b	data	Russian	Russia	1.0138364779874214
RT_ICON	0x18975b8	0x3e7	data	Russian	Russia	1.011011011011011
RT_ICON	0x1897a00	0xdd	data	Russian	Russia	1.0497737556561086
RT_ICON	0x1897af8	0x10f	data	Russian	Russia	1.040590405904059
RT_ICON	0x1897c20	0x25a8	data	Russian	Russia	0.9854771784232366
RT_ICON	0x189a1e0	0x12d	data	Russian	Russia	1.0365448504983388
RT_ICON	0x189a328	0x106	data	Russian	Russia	1.0419847328244274
RT_ICON	0x189a448	0x109	data	Russian	Russia	1.0415094339622641
RT_ICON	0x189a570	0x171	data	Russian	Russia	1.029810298102981
RT_ICON	0x189a700	0x109d	data	Russian	Russia	0.9891841053374089
RT_ICON	0x189b7b8	0xdd9	data	Russian	Russia	0.9616361071932299
RT_ICON	0x189c5b0	0xc0e	data	Russian	Russia	0.998703823720026
RT_ICON	0x189d1d8	0xb91	data	Russian	Russia	0.9419115163796015
RT_ICON	0x189dd88	0xdd9	data	Russian	Russia	0.9898448519040902
RT_ICON	0x189eb80	0x11c	data	Russian	Russia	1.0387323943661972
RT_ICON	0x189ecb8	0x116	data	Russian	Russia	1.039568345323741
RT_ICON	0x189ede8	0x1c4	data	Russian	Russia	1.0243362831858407
RT_ICON	0x189efc8	0x1a1	data	Russian	Russia	1.026378896882494
RT_ICON	0x189f188	0x182	data	Russian	Russia	1.028497409326425
RT_ICON	0x189f328	0x222	data	Russian	Russia	1.02014652014652
RT_ICON	0x189f568	0x11f	data	Russian	Russia	1.038327526132404
RT_ICON	0x189f6a0	0x103	data	Russian	Russia	1.0424710424710424
RT_ICON	0x189f7c0	0x1588	data	Russian	Russia	0.9704281567489115
RT_ICON	0x18a0d60	0x580	data	Russian	Russia	0.9595170454545454
RT_ICON	0x18a12f8	0x988	data	Russian	Russia	1.0045081967213114
RT_ICON	0x18a1c98	0x25a8	data	Russian	Russia	0.9699170124481328
RT_ICON	0x18a4258	0x10828	data	Russian	Russia	0.9846060570211759
RT_ICON	0x18dba28	0x163	data			1.0309859154929577
RT_ICON	0x18dbb90	0x20d	data			1.020952380952381
RT_ICON	0x18dbda0	0x21b	data			1.0204081632653061
RT_ICON	0x18dbfc0	0x282	data			1.017133956386293
RT_ICON	0x18dc248	0x33c	data			1.0132850241545894
RT_ICON	0x18dc588	0x413	data			1.0009587727708533
RT_ICON	0x18dca00	0x152	data			1.032544378698225
RT_ICON	0x18dcff8	0x10a8	data	English	United States	0.9392589118198874
RT_ICON	0x18de0b8	0x988	data	English	United States	0.9434426229508197
RT_ICON	0x18dea58	0x988	data	English	United States	0.9495901639344262
RT_ICON	0x18df3f8	0x10828	data	English	United States	0.9805690287471903
RT_MENU	0x18dcb70	0xf8	data			1.0443548387096775
RT_MENU	0x18b4d20	0xd2	data	Russian	Russia	1.0523809523809524
RT_MENU	0x18b4df8	0x66	data	Russian	Russia	1.107843137254902
RT_MENU	0x18dcc68	0x46	data			1.1571428571428573
RT_DIALOG	0x18920f0	0x490	data	Russian	Russia	0.8518835616438356
RT_DIALOG	0x1892580	0x78	data	Russian	Russia	1.075
RT_DIALOG	0x18dccb0	0x100	data			1.04296875
RT_DIALOG	0x18925f8	0x1f8	data	Russian	Russia	0.9523809523809523
RT_DIALOG	0x1892cb0	0x190	data	Russian	Russia	1.0175
RT_DIALOG	0x1892e40	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x1892f98	0xf4	data	Russian	Russia	1.0450819672131149
RT_DIALOG	0x1893090	0x12c	data	Russian	Russia	1.0366666666666666
RT_DIALOG	0x18931c0	0x110	data	Russian	Russia	1.0404411764705883
RT_DIALOG	0x18932d0	0x128	data	Russian	Russia	1.037162162162162
RT_DIALOG	0x18933f8	0x154	data	Russian	Russia	1.0323529411764707
RT_DIALOG	0x1893550	0x7e	data	Russian	Russia	1.0873015873015872
RT_DIALOG	0x1893808	0x148	data	Russian	Russia	1.0335365853658536
RT_DIALOG	0x1893738	0xd0	data	Russian	Russia	1.0528846153846154
RT_DIALOG	0x18935d0	0x164	data	Russian	Russia	1.0308988764044944
RT_DIALOG	0x1893950	0x14c	data	Russian	Russia	1.033132530120482
RT_DIALOG	0x1893aa0	0x1f0	data	Russian	Russia	1.0221774193548387
RT_DIALOG	0x1893c90	0x284	data	Russian	Russia	1.0170807453416149
RT_DIALOG	0x18dcdb8	0x232	data	English	United States	1.019572953736655
RT_DIALOG	0x1893f18	0x182	data	Russian	Russia	1.028497409326425
RT_DIALOG	0x18940a0	0x68	data	Russian	Russia	1.1057692307692308
RT_DIALOG	0x1894108	0x1f8	data	Russian	Russia	1.0218253968253967
RT_DIALOG	0x1894300	0x218	data	Russian	Russia	1.0205223880597014
RT_DIALOG	0x1894518	0x2ba	data	Russian	Russia	1.015759312320917
RT_DIALOG	0x18947d8	0x242	data	Russian	Russia	1.019031141868512
RT_DIALOG	0x18927f0	0x21c	data	Russian	Russia	0.9388888888888889
RT_DIALOG	0x1892a10	0x29a	data	Russian	Russia	0.9024024024024024
RT_DIALOG	0x1894a20	0x72	DOS executable (COM, 0x8C-variant)	Russian	Russia	1.0964912280701755
RT_STRING	0x18f1a18	0x38	data	Russian	Russia	1.1964285714285714
RT_GROUP_ICON	0x190bee8	0x5a	data	Russian	Russia	0.8
RT_GROUP_ICON	0x1895b78	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x18dc9a0	0x5a	data			1.1222222222222222
RT_GROUP_ICON	0x189f7a8	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1896ad0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18979a0	0x5a	data	Russian	Russia	1.1222222222222222
RT_GROUP_ICON	0x18a0d48	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x1897ae0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x1897c08	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189a1c8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18dcb58	0x14	data			1.45
RT_GROUP_ICON	0x189a310	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189a430	0x14	SysEx File -	Russian	Russia	1.45
RT_GROUP_ICON	0x189a558	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189a6e8	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189b7a0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189c598	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189d1c0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189dd70	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x189eb68	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189eca0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189edd0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189efb0	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f170	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f310	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f550	0x14	data	Russian	Russia	1.45
RT_GROUP_ICON	0x189f688	0x14	Non-ISO extended-ASCII text, with no line terminators	Russian	Russia	1.45
RT_GROUP_ICON	0x18a12e0	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18a1c80	0x14	hp300 (68020+68881) BSD	Russian	Russia	1.45
RT_GROUP_ICON	0x18de0a0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18a4240	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18b4a80	0x14	data	Russian	Russia	1.4
RT_GROUP_ICON	0x18dea40	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18df3e0	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x18efc20	0x14	data	English	United States	1.4
RT_VERSION	0x190bf48	0x284	data	Russian	Russia	0.468944099378882
RT_MANIFEST	0x190c1d0	0x87f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2115), with CRLF line terminators	English	United States	0.31264367816091954

DLL	Import
ADVAPI32.dll	FreeSid
COMCTL32.dll	_TrackMouseEvent
d3d11.dll	D3D11CreateDevice
dbghelp.dll	SymFromAddr
dxgi.dll	CreateDXGIFactory1
GDI32.dll	LineTo
gdiplus.dll	GdipFree
IPHLPAPI.DLL	GetIfEntry2
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
MPR.dll	WNetGetConnectionW
msdmo.dll	MoInitMediaType
NETAPI32.dll	NetUserGetInfo
ntdll.dll	RtlGetVersion
NTDSAPI.dll	DsMakeSpnW
ole32.dll	OleCreate
OLEAUT32.dll	VarUI4FromStr
POWRPROF.dll	PowerGetActiveScheme
RPCRT4.dll	UuidEqual
SAS.dll	SendSAS
Secur32.dll	DeleteSecurityContext
SHELL32.dll
SHLWAPI.dll	PathFileExistsW
USER32.dll	GetDC
USERENV.dll	CreateEnvironmentBlock
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WINHTTP.dll	WinHttpOpen
WINMM.dll	waveInOpen
WINSPOOL.DRV	GetPrinterW
WS2_32.dll	htonl
WTSAPI32.dll	WTSFreeMemory

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 3, 2024 09:46:03.408277035 CEST	192.168.2.5	1.1.1.1	0xe8af	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:41.501441956 CEST	192.168.2.5	1.1.1.1	0x8d54	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:47:41.110177994 CEST	192.168.2.5	1.1.1.1	0xa313	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:48:41.110388041 CEST	192.168.2.5	1.1.1.1	0xcd7d	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:49:33.110580921 CEST	192.168.2.5	1.1.1.1	0x9590	Standard query (0)	getscreen.me	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 3, 2024 09:46:03.415807009 CEST	1.1.1.1	192.168.2.5	0xe8af	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:03.415807009 CEST	1.1.1.1	192.168.2.5	0xe8af	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:03.415807009 CEST	1.1.1.1	192.168.2.5	0xe8af	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:41.509476900 CEST	1.1.1.1	192.168.2.5	0x8d54	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:41.509476900 CEST	1.1.1.1	192.168.2.5	0x8d54	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:46:41.509476900 CEST	1.1.1.1	192.168.2.5	0x8d54	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:47:41.119781017 CEST	1.1.1.1	192.168.2.5	0xa313	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:47:41.119781017 CEST	1.1.1.1	192.168.2.5	0xa313	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:47:41.119781017 CEST	1.1.1.1	192.168.2.5	0xa313	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:48:41.117897987 CEST	1.1.1.1	192.168.2.5	0xcd7d	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:48:41.117897987 CEST	1.1.1.1	192.168.2.5	0xcd7d	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:48:41.117897987 CEST	1.1.1.1	192.168.2.5	0xcd7d	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:49:33.119503021 CEST	1.1.1.1	192.168.2.5	0x9590	No error (0)	getscreen.me	78.47.165.25	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:49:33.119503021 CEST	1.1.1.1	192.168.2.5	0x9590	No error (0)	getscreen.me	51.89.95.37	A (IP address)	IN (0x0001)	false
Sep 3, 2024 09:49:33.119503021 CEST	1.1.1.1	192.168.2.5	0x9590	No error (0)	getscreen.me	5.75.168.191	A (IP address)	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report getscreen-941605629.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Getscreen.me\folder\settings.dat

C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe

C:\ProgramData\Getscreen.me\jvngvlqxfhugokvuuudzsqqeudgxczk-elevate.exe:Zone.Identifier

C:\ProgramData\Getscreen.me\logs\20240903.log

C:\ProgramData\Getscreen.me\logs\20240905.log

C:\ProgramData\Getscreen.me\logs\20240907.log

C:\ProgramData\Getscreen.me\logs\20240908.log

C:\ProgramData\Getscreen.me\logs\20240909.log

C:\ProgramData\Getscreen.me\logs\20240912.log

C:\ProgramData\Getscreen.me\logs\20240913.log

C:\ProgramData\Getscreen.me\logs\20240915.log

C:\ProgramData\Getscreen.me\logs\20240917.log

C:\ProgramData\Getscreen.me\logs\20240920.log

C:\ProgramData\Getscreen.me\logs\20240922.log

C:\ProgramData\Getscreen.me\logs\20240924.log

C:\ProgramData\Getscreen.me\logs\20240925.log

C:\ProgramData\Getscreen.me\logs\20240927.log

C:\ProgramData\Getscreen.me\logs\20240929.log

C:\ProgramData\Getscreen.me\logs\20241001.log

C:\ProgramData\Getscreen.me\logs\20241003.log

C:\ProgramData\Getscreen.me\logs\20241005.log

Windows Analysis Report
getscreen-941605629.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:46:04 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:46:04 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:46:04 GMT content-length: 12 x-envoy-upstream-service-time: 2 server: lb2.getscreen.me connection: close
2024-09-03 07:46:04 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:46:16 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:46:16 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:46:16 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-03 07:46:16 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:46:35 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:46:35 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:46:35 GMT content-length: 12 x-envoy-upstream-service-time: 3 server: lb2.getscreen.me connection: close
2024-09-03 07:46:35 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:46:42 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:46:42 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:46:42 GMT content-length: 12 x-envoy-upstream-service-time: 1 server: lb1.getscreen.me connection: close
2024-09-03 07:46:42 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:46:52 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:46:53 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:46:53 GMT content-length: 12 x-envoy-upstream-service-time: 0 server: lb1.getscreen.me connection: close
2024-09-03 07:46:53 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:47:05 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:47:06 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:47:06 GMT content-length: 12 x-envoy-upstream-service-time: 0 server: lb1.getscreen.me connection: close
2024-09-03 07:47:06 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:47:09 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:47:09 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:47:09 GMT content-length: 12 x-envoy-upstream-service-time: 1 server: lb1.getscreen.me connection: close
2024-09-03 07:47:09 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:47:13 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:47:15 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:47:14 GMT content-length: 12 x-envoy-upstream-service-time: 0 server: lb1.getscreen.me connection: close
2024-09-03 07:47:15 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:47:20 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:47:20 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:47:20 GMT content-length: 12 x-envoy-upstream-service-time: 1 server: lb1.getscreen.me connection: close
2024-09-03 07:47:20 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
2024-09-03 07:50:07 UTC	292	OUT	GET /signal/agent HTTP/1.1 Host: getscreen.me Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Origin: https://getscreen.me Sec-WebSocket-Protocol: chat, superchat Sec-WebSocket-Version: 13 User-Agent: Getscreen.me/2.21.3 (Win64, getscreen.me, 2)
2024-09-03 07:50:07 UTC	265	IN	HTTP/1.1 400 Bad Request content-type: text/plain; charset=utf-8 sec-websocket-version: 13 x-content-type-options: nosniff date: Tue, 03 Sep 2024 07:50:07 GMT content-length: 12 x-envoy-upstream-service-time: 2 server: lb1.getscreen.me connection: close
2024-09-03 07:50:07 UTC	12	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 0a Data Ascii: Bad Request