File name:

getscreen-x86 (4).exe

Full analysis: https://app.any.run/tasks/f52d5c73-76cf-441c-a7ef-778af3c2549a
Verdict: Malicious activity
Analysis date: March 21, 2024, 05:24:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
remote
getmescreen
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

4AD11A98ADB6E5B3877DCD2F8E57495A

SHA1:

7978753DCABAE0ECEEA9EF5F45413B185C44426D

SHA256:

B1E54BE5FC56825041DB8AB7DC27D4EF4B45F37CD52B2AC0A2EFD692DA612073

SSDEEP:

98304:HqrJNNcxEpbA8Xv763d5M5ggRVA33Azr1gL/4k2u8iR/mrZZfjDv/wmM+pFo/LIY:5a+WO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • getscreen-x86 (4).exe (PID: 2724)
      • install.exe (PID: 3708)
      • install.exe (PID: 3932)
      • install.tmp (PID: 2332)

    • Changes the autorun value in the registry

      • install.tmp (PID: 2332)

    • Steals credentials from Web Browsers

      • VMForkGUI.exe (PID: 1768)

    • Creates a writable file in the system directory

      • getscreen.exe (PID: 1340)

    • GETMESCREEN has been detected (SURICATA)

      • getscreen.exe (PID: 1340)

    • Actions looks like stealing of personal data

      • VMForkGUI.exe (PID: 1768)

  • SUSPICIOUS

    • Reads the Internet Settings

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • VMForkGUI.exe (PID: 3916)

    • Application launched itself

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • getscreen.exe (PID: 1340)
      • VMForkGUI.exe (PID: 3916)

    • Reads security settings of Internet Explorer

      • getscreen-x86 (4).exe (PID: 4008)
      • VMForkGUI.exe (PID: 3916)

    • Executable content was dropped or overwritten

      • getscreen-x86 (4).exe (PID: 3488)
      • getscreen-x86 (4).exe (PID: 2724)
      • install.exe (PID: 3708)
      • install.exe (PID: 3932)
      • install.tmp (PID: 2332)

    • Changes Internet Explorer settings (feature browser emulation)

      • getscreen-x86 (4).exe (PID: 1824)
      • getscreen.exe (PID: 2668)

    • Executes as Windows Service

      • ktbryanfroonlnunfngritiotzkgvnr-elevate.exe (PID: 2960)
      • getscreen.exe (PID: 1340)

    • Creates a software uninstall entry

      • getscreen-x86 (4).exe (PID: 2724)

    • Reads the Windows owner or organization settings

      • install.tmp (PID: 2332)

    • Deletes system .NET executable

      • VMForkGUI.exe (PID: 1768)

    • Non-standard symbols in registry

      • install.tmp (PID: 2332)

    • Creates file in the systems drive root

      • VMForkGUI.exe (PID: 1768)

    • Connects to unusual port

      • getscreen.exe (PID: 1340)

  • INFO

    • Reads the computer name

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • getscreen-x86 (4).exe (PID: 1824)
      • ktbryanfroonlnunfngritiotzkgvnr-elevate.exe (PID: 2960)
      • getscreen-x86 (4).exe (PID: 2904)
      • getscreen.exe (PID: 1340)
      • getscreen-x86 (4).exe (PID: 2724)
      • getscreen.exe (PID: 2384)
      • getscreen.exe (PID: 1544)
      • install.tmp (PID: 2132)
      • getscreen.exe (PID: 2668)
      • VMForkGUI.exe (PID: 3916)
      • install.tmp (PID: 2332)
      • getscreen.exe (PID: 1644)
      • getscreen.exe (PID: 2024)
      • getscreen.exe (PID: 2020)
      • getscreen.exe (PID: 1604)

    • Checks supported languages

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • ktbryanfroonlnunfngritiotzkgvnr-elevate.exe (PID: 2960)
      • getscreen-x86 (4).exe (PID: 1824)
      • getscreen-x86 (4).exe (PID: 2904)
      • getscreen-x86 (4).exe (PID: 2724)
      • getscreen.exe (PID: 2384)
      • getscreen.exe (PID: 1340)
      • getscreen.exe (PID: 2668)
      • getscreen.exe (PID: 1544)
      • install.exe (PID: 3708)
      • install.exe (PID: 3932)
      • install.tmp (PID: 2332)
      • VMForkGUI.exe (PID: 3916)
      • VMForkGUI.exe (PID: 1768)
      • VMForkGUI.exe (PID: 3964)
      • install.tmp (PID: 2132)
      • getscreen.exe (PID: 1644)
      • getscreen.exe (PID: 2020)
      • getscreen.exe (PID: 2024)
      • getscreen.exe (PID: 1604)

    • Creates files in the program directory

      • getscreen-x86 (4).exe (PID: 4008)
      • getscreen-x86 (4).exe (PID: 3488)
      • getscreen-x86 (4).exe (PID: 2724)
      • getscreen.exe (PID: 1340)
      • install.tmp (PID: 2332)

    • Creates files or folders in the user directory

      • getscreen-x86 (4).exe (PID: 3488)

    • Manual execution by a user

      • install.exe (PID: 3708)
      • getscreen.exe (PID: 1544)

    • Create files in a temporary directory

      • dllhost.exe (PID: 920)
      • install.exe (PID: 3708)
      • install.tmp (PID: 2332)
      • install.exe (PID: 3932)

    • Reads the machine GUID from the registry

      • getscreen.exe (PID: 1340)

    • Reads mouse settings

      • getscreen.exe (PID: 1604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:13 08:18:45+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 3620864
InitializedDataSize: 20480
UninitializedDataSize: 20406272
EntryPoint: 0x16ea210
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.18.2.0
ProductVersionNumber: 2.18.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0009)
CharacterSet: Unicode
CompanyName: Getscreen.me
InternalName: Getscreen.me
OriginalFileName: getscreen.exe
ProductName: Getscreen.me
FileVersion: 2.18.2
LegalCopyright: Copyright (C) 2023
ProductVersion: 2.18.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
23
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start getscreen-x86 (4).exe no specs getscreen-x86 (4).exe getscreen-x86 (4).exe no specs ktbryanfroonlnunfngritiotzkgvnr-elevate.exe no specs getscreen-x86 (4).exe getscreen-x86 (4).exe #GETMESCREEN getscreen.exe getscreen.exe no specs getscreen.exe no specs getscreen.exe no specs Virtual Factory for Usercpl no specs Windows Parental Controls no specs install.exe install.tmp no specs install.exe install.tmp vmforkgui.exe no specs vmforkgui.exe vmforkgui.exe getscreen.exe no specs getscreen.exe no specs getscreen.exe no specs getscreen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668C:\Windows\system32\DllHost.exe /Processid:{A2D8CFE7-7BA4-4BAD-B86B-851376B59134}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
920C:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1340"C:\Program Files\Getscreen.me\getscreen.exe" -serviceC:\Program Files\Getscreen.me\getscreen.exe
services.exe
User:
SYSTEM
Company:
Getscreen.me
Integrity Level:
SYSTEM
Exit code:
0
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1544"C:\Program Files\Getscreen.me\getscreen.exe" C:\Program Files\Getscreen.me\getscreen.exe—explorer.exe
User:
admin
Company:
Getscreen.me
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1604"C:\Program Files\Getscreen.me\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -childC:\Program Files\Getscreen.me\getscreen.exe—getscreen.exe
User:
SYSTEM
Company:
Getscreen.me
Integrity Level:
SYSTEM
Exit code:
0
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1644"C:\Program Files\Getscreen.me\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -childC:\Program Files\Getscreen.me\getscreen.exe—getscreen.exe
User:
SYSTEM
Company:
Getscreen.me
Integrity Level:
SYSTEM
Exit code:
1
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1768"C:\Program Files\ForkieTools\VMForkGUI.exe" VMForkRunTool1C:\Program Files\ForkieTools\VMForkGUI.exe
VMForkGUI.exe
User:
admin
Company:
User123
Integrity Level:
HIGH
Description:
ForkieTools GUI
Exit code:
0
Version:
v0.4
Modules
Images
c:\program files\forkietools\vmforkgui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\forkietools\vmfork.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\forkietools\libgcc_s_sjlj-1.dll
1824"C:\Users\admin\AppData\Local\Temp\getscreen-x86 (4).exe" -gpipe \\.\pipe\PCommand97Getscreen.me -guiC:\Users\admin\AppData\Local\Temp\getscreen-x86 (4).exe—getscreen-x86 (4).exe
User:
admin
Company:
Getscreen.me
Integrity Level:
HIGH
Exit code:
1
Version:
2.18.2
Modules
Images
c:\users\admin\appdata\local\temp\getscreen-x86 (4).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2020"C:\Program Files\Getscreen.me\getscreen.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -childC:\Program Files\Getscreen.me\getscreen.exe—getscreen.exe
User:
SYSTEM
Company:
Getscreen.me
Integrity Level:
SYSTEM
Exit code:
1
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2024"C:\Program Files\Getscreen.me\getscreen.exe" -epipe \\.\pipe\PCommand98phqghumeaylnlfd -environmentC:\Program Files\Getscreen.me\getscreen.exe—getscreen.exe
User:
admin
Company:
Getscreen.me
Integrity Level:
MEDIUM
Exit code:
1
Version:
2.18.2
Modules
Images
c:\program files\getscreen.me\getscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
11 138
Read events
11 066
Write events
66
Delete events
6

Modification events

(PID) Process:(4008) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4008) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4008) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4008) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:getscreen-x86 (4).exe
Value:
11001
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:getscreen-x86 (4).exe
Value:
11001
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me
Operation:writeName:http
Value:
2
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\getscreen.me
Operation:writeName:https
Value:
2
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me
Operation:writeName:http
Value:
2
(PID) Process:(1824) getscreen-x86 (4).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\getscreen.me
Operation:writeName:https
Value:
2
Executable files
17
Suspicious files
9
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
1340getscreen.exeC:\ProgramData\Getscreen.me\memory\0000pipe0PCommand96Getscreen0me0 —
MD5:—
SHA256:—
3488getscreen-x86 (4).exeC:\ProgramData\Getscreen.me\memory\111B6B764C7BDA01C8490D2A507BDA01A00D0000FFFFFFFF —
MD5:—
SHA256:—
2384getscreen.exeC:\ProgramData\Getscreen.me\memory\0000pipe0PCommand96Getscreen0me0 —
MD5:—
SHA256:—
4008getscreen-x86 (4).exeC:\ProgramData\Getscreen.me\logs\20240321.logtext
MD5:96E9E4E4BFB2151223D2B37BFA8EDAC1
SHA256:61350B5F9B5C334AD4B37956D1476726EAC248AF4144A8E2C53B4625D944FC1C
3932install.exeC:\Users\admin\AppData\Local\Temp\is-LSGTB.tmp\install.tmpexecutable
MD5:6A6475DC9AE480A60A68FAA849C8AF90
SHA256:856C7186CD2411906FC3544D2C2600E065BE5A5EB3CE1DEB8A314226A74C8DFD
3488getscreen-x86 (4).exeC:\ProgramData\Getscreen.me\ktbryanfroonlnunfngritiotzkgvnr-elevate.exeexecutable
MD5:4AD11A98ADB6E5B3877DCD2F8E57495A
SHA256:B1E54BE5FC56825041DB8AB7DC27D4EF4B45F37CD52B2AC0A2EFD692DA612073
3488getscreen-x86 (4).exeC:\ProgramData\Getscreen.me\settings.datbinary
MD5:37953FA9D3A365F7564489E6A9D79BAA
SHA256:B7D9B16F65F4159E18FC5998A647A4692E2F19EA723A2BAE5DC2D6AE2D7D53A7
2724getscreen-x86 (4).exeC:\Users\admin\Desktop\Getscreen.me.lnkbinary
MD5:C55E9E6D14B70448A7BDCABC0F4A2B7C
SHA256:2232D0689B3BB248BA5B2DBAA949A95E5DA10FBE1A438453AE561267DBBED0E5
2724getscreen-x86 (4).exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Getscreen.me.lnkbinary
MD5:5ED657750BA308DDA3090C5BDAB6AB16
SHA256:9FCEE5ADEBD7090923A67644F3E5F649F1B49E6C81FB24D0197C2012A7E0C5FD
3708install.exeC:\Users\admin\AppData\Local\Temp\is-QN06G.tmp\install.tmpexecutable
MD5:6A6475DC9AE480A60A68FAA849C8AF90
SHA256:856C7186CD2411906FC3544D2C2600E065BE5A5EB3CE1DEB8A314226A74C8DFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
88
DNS requests
35
Threats
115

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3488
getscreen-x86 (4).exe
78.47.165.25:443
getscreen.me
Hetzner Online GmbH
DE
unknown
1340
getscreen.exe
78.47.165.25:443
getscreen.me
Hetzner Online GmbH
DE
unknown
1340
getscreen.exe
5.75.168.191:443
getscreen.me
Hetzner Online GmbH
DE
unknown
1340
getscreen.exe
103.43.75.192:443
px-au1.getscreen.me
AS-CHOOPA
AU
unknown
1340
getscreen.exe
5.188.225.23:443
px-br1.getscreen.me
G-Core Labs S.A.
BR
unknown
1340
getscreen.exe
45.65.9.108:443
px-us1.getscreen.me
G-Core Labs S.A.
US
unknown

DNS requests

Domain
IP
Reputation
getscreen.me
  • 78.47.165.25
  • 5.75.168.191
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
px-au1.getscreen.me
  • 103.43.75.192
unknown
px-br1.getscreen.me
  • 5.188.225.23
unknown
px-us1.getscreen.me
  • 45.65.9.108
unknown
px-eu1.getscreen.me
  • 162.55.165.163
unknown
px-us2.getscreen.me
  • 5.161.108.215
unknown
px-in1.getscreen.me
  • 95.85.71.16
unknown
image.getscreen.me
  • 5.9.146.41
unknown
px-il1.getscreen.me
  • 146.185.219.90
unknown

Threats

PID
Process
Class
Message
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
REMOTE [ANY.RUN] GetMeScreen Remote Desktop Software
1340
getscreen.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1340
getscreen.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
1340
getscreen.exe
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
getscreen-x86 (4).exe