Edit tour

Windows Analysis Report
getscreen-226997704-x86.exe

Overview

General Information

Sample name:	getscreen-226997704-x86.exe
Analysis ID:	1627312
MD5:	42b9b44450da427b105d6af4a31e4d6a
SHA1:	8c620e55cf892a0e4f5c3d892c8eb18ed19a4c45
SHA256:	68cd32e87599efba54f6efb172f3b56a183bffb8209865847d48d658d3d45779
Infos:

Detection

Score:	51
Range:	0 - 100
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64native

getscreen-226997704-x86.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\getscreen-226997704-x86.exe" MD5: 42B9B44450DA427B105D6AF4A31E4D6A)

getscreen-226997704-x86.exe (PID: 8204 cmdline: "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -gpipe \\.\pipe\PCommand97ganyuuasgxkwvpe1 -gui MD5: 42B9B44450DA427B105D6AF4A31E4D6A)

getscreen-226997704-x86.exe (PID: 8228 cmdline: "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -cpipe \\.\pipe\PCommand96zvvnazikzfalhbg -cmem 0000pipe0PCommand96zvvnazikzfalhbgosfzk23ai5osclf -child MD5: 42B9B44450DA427B105D6AF4A31E4D6A)

tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe (PID: 1264 cmdline: "C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe" -elevate \\.\pipe\elevateGS512tqcebwhlhccnmvlzbgjdymdxhfnpwbt MD5: 42B9B44450DA427B105D6AF4A31E4D6A)

svchost.exe (PID: 2224 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: F586835082F632DC8D9404D83BC16316)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: getscreen-226997704-x86.exe PID: 6924	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 908, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon, ProcessId: 2224, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: getscreen-226997704-x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: getscreen-226997704-x86.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-226997704-x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc.pdbdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\CoreUIComponents.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007786000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\twinapi.appcore.pdbyK source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A3C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdsapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\twinapi.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e3samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemcomn.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fwpuclnt.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\CoreMessaging.pdbdllKP source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbll (10 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\symbols\dll\InputHost.pdbndow source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009349000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\rasadhlp.pdb! source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdbi source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000097EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000771E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpOAV.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A315000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleacc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009349000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MFWMAAEC.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdb` source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc.pdbdb4 source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemsvc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\InputHost.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: secur32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008FF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000847F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.UI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FWPolicyIOMgr.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009AFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\bcryptprimitives.pdb5 source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasadhlp.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009C72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007779000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fastprox.pdbbO source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinapi.appcore.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A0D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdbR source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdsapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000847F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\WindowManagementAPI.pdb\*0.0./ source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000848A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000927D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000846E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A3C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinapi.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A0D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfperfhelper.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009D33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000777F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000771E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: avrt.pdbe=C:SystemRoot=C:\W source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\InputHost.pdbb{ source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A06B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleacc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samcli.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000940F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000846E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\exe\getscreen-226997704-x86.pdbL source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.0000000002908000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wtsapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009409000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MFWMAAEC.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowManagementAPI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009E4C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: owManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\twinapi.appcore.pdbYH source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009730000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009220000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008DBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\FWPolicyIOMgr.pdbYK source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samlib.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244238163483.000000000A87A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc6.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007779000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008DBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: top\symbols\dll\InputHost.pdbSER3< source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000848A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A06B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpOAV.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A315000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fastprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A25B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244238163483.000000000A87A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fastprox.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A25B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wbemcomn.pdbd source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FWPolicyIOMgr.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009AFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TextInputFramework.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000099D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fwpuclnt.pdb*? source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Github-runner\_work\agent-windows\agent-windows\console\Win32\Release\getscreen.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: netapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008ECE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000097EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009D33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.UI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008641000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\samlib.pdb\*U3 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\wbemsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\bcryptprimitives.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb] source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\dll\WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InputHost.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\Windows.UI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000927D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wmswsock.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009C72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemcomn.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000076A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc6.pdb< source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\CoreMessaging.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\JSAMSIProvider32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DLL\audioses.pdbemory source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000083F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdb: 3.2.D source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wmswsock.pdbB source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samcli.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000940F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008ECE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreUIComponents.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009FB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wbemprox.pdbdbQ source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: i.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InputHost.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: top\dll\TextInputFramework.pdb6. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinTypes.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008641000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MMDevAPI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009BBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000076A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PI.pdbv source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: secur32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008FF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TextInputFramework.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\samlib.pdb4) source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdb*K source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinTypes.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rasadhlp.pdbl source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009E4C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fastprox.pdbM source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UI.pdb2. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000083F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wbemprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MMDevAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009BBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FirewallAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dll\InputHost.pdbows\M source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000099D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreUIComponents.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004B8A000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009FB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\rasadhlp.pdbp source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009220000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbdbghel source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fastprox.pdbB source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemprox.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdbdbf source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A36E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rasadhlp.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rk.pdb90 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\exe\getscreen-226997704-x86.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.0000000002908000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wbemcomn.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc6.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009730000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000967B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\WinTypes.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wtsapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009409000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\TextInputFramework.pdb\*\ntdll source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000777F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UIComponents.pdbbdo source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1A2000.00000004.00000020.00020000.00000000.sdmp

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 51.89.95.37 51.89.95.37

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /signal/agent HTTP/1.1Host: getscreen.meUpgrade: websocketConnection: UpgradeSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Origin: https://getscreen.meSec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13User-Agent: Getscreen.me/3.2.12 (Win, getscreen.me, 327)

Source: global traffic

DNS traffic detected: DNS query: getscreen.me

Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://proxy.contoso.com:3128/
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/exper
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.we
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/color-space
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/inband-cn
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-id
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.g
Source: getscreen-226997704-x86.exe, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.ge
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.getsa
Source: getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.getsc
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscree
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/e
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/en
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/en/rules
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/en/rules/privacy-poli
Source: getscreen-226997704-x86.exe, getscreen-226997704-x86.exe, 00000005.00000002.244249242964.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000005.00000003.244241437357.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000005.00000003.244241171383.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.getscreen.me/en/rules/privacy-polic
Source: getscreen-226997704-x86.exe, 00000005.00000003.244241062309.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.getscreen.me/en/rules/privacy-policy/
Source: getscreen-226997704-x86.exe	String found in binary or memory: https://docs.getscreen.me/en/rules/ter
Source: getscreen-226997704-x86.exe, 00000005.00000003.244241062309.0000000002A6C000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244249069870.0000000002A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.getscreen.me/en/rules/terms-of-use/
Source: getscreen-226997704-x86.exe, 00000004.00000003.244250288863.0000000007678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.getscreen.me/user-guides/agent/

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a raw input device (often for capturing keystrokes)

Source: getscreen-226997704-x86.exe, 00000000.00000002.244229791187.000000000893F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_fd09006f-6

Yara detected Keylogger Generic

Source: Yara match

File source: Process Memory Space: getscreen-226997704-x86.exe PID: 6924, type: MEMORYSTR

System Summary

PE file contains executable resources (Code or Archives)

Source: getscreen-226997704-x86.exe	Static PE information: Resource name: RT_ICON type: x86 executable not stripped
Source: tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe.0.dr	Static PE information: Resource name: RT_ICON type: x86 executable not stripped

Sample file is different than original file name gathered from version info

Source: getscreen-226997704-x86.exe, 00000000.00000002.244221947699.00000000022BD000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe
Source: getscreen-226997704-x86.exe, 00000000.00000000.244165272720.00000000022BD000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe
Source: getscreen-226997704-x86.exe, 00000004.00000002.244275083922.00000000022BD000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe
Source: getscreen-226997704-x86.exe, 00000004.00000000.244201184835.00000000022BD000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe
Source: getscreen-226997704-x86.exe, 00000005.00000002.244248144464.00000000022BD000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe
Source: getscreen-226997704-x86.exe, 00000005.00000000.244201300715.00000000022BD000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegetscreen.exe: vs getscreen-226997704-x86.exe

Uses 32bit PE files

Source: getscreen-226997704-x86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal51.evad.winEXE@8/11@1/1

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

File created: C:\Users\user\AppData\Local\Getscreen.me

Jump to behavior

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\PCommandMutextTurbo96phqghum

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: getscreen-226997704-x86.exe	String found in binary or memory: marker-start
Source: getscreen-226997704-x86.exe	String found in binary or memory: t-application-status: '{"value":"connecting"}' 02:40:18.953INFOGui send event event-install-status: '{"value":false}' 02:40:18.984INFOGui send event event-domain: '{"value":""}' 02:40:18.984INFOGui send event event-
Source: getscreen-226997704-x86.exe	String found in binary or memory: IP-address

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

File read: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe"
Source: unknown	Process created: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe "C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe" -elevate \\.\pipe\elevateGS512tqcebwhlhccnmvlzbgjdymdxhfnpwbt
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -gpipe \\.\pipe\PCommand97ganyuuasgxkwvpe1 -gui
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -cpipe \\.\pipe\PCommand96zvvnazikzfalhbg -cmem 0000pipe0PCommand96zvvnazikzfalhbgosfzk23ai5osclf -child
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -gpipe \\.\pipe\PCommand97ganyuuasgxkwvpe1 -gui	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -cpipe \\.\pipe\PCommand96zvvnazikzfalhbg -cmem 0000pipe0PCommand96zvvnazikzfalhbgosfzk23ai5osclf -child	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mfwmaaec.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: symsrv.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: seclogon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: icm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sas.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Section loaded: winsta.dll	Jump to behavior

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: getscreen-226997704-x86.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: getscreen-226997704-x86.exe

Static file information: File size 7010088 > 1048576

PE file has a big raw section

Source: getscreen-226997704-x86.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x6a9800

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: getscreen-226997704-x86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc.pdbdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\CoreUIComponents.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007786000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\twinapi.appcore.pdbyK source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A3C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdsapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\twinapi.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e3samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemcomn.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fwpuclnt.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\CoreMessaging.pdbdllKP source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbll (10 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\symbols\dll\InputHost.pdbndow source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009349000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\rasadhlp.pdb! source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdbi source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000097EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000771E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpOAV.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A315000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleacc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winspool.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009349000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MFWMAAEC.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdb` source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc.pdbdb4 source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemsvc.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\InputHost.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: secur32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008FF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000847F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.UI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FWPolicyIOMgr.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009AFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\bcryptprimitives.pdb5 source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasadhlp.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009C72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007779000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fastprox.pdbbO source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinapi.appcore.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A0D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdbR source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdsapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F36000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000847F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\WindowManagementAPI.pdb\*0.0./ source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000848A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000927D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000846E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A3C9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinapi.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A0D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfperfhelper.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009D33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000777F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000771E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: avrt.pdbe=C:SystemRoot=C:\W source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\InputHost.pdbb{ source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A06B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleacc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008F98000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samcli.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000940F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000846E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\exe\getscreen-226997704-x86.pdbL source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.0000000002908000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wtsapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009409000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MFWMAAEC.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowManagementAPI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009E4C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: owManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\twinapi.appcore.pdbYH source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009730000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009220000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008DBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\FWPolicyIOMgr.pdbYK source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.000000000295F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samlib.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244238163483.000000000A87A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fwpuclnt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DLL\dhcpcsvc6.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007779000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008DBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: top\symbols\dll\InputHost.pdbSER3< source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wgdi32full.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.000000000848A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A06B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpOAV.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A315000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fastprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A25B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244238163483.000000000A87A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fastprox.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A25B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wbemcomn.pdbd source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FWPolicyIOMgr.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009AFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TextInputFramework.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\samlib.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000099D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\fwpuclnt.pdb*? source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Github-runner\_work\agent-windows\agent-windows\console\Win32\Release\getscreen.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: netapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008ECE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000097EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mfperfhelper.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009D33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.UI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009DED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008641000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\samlib.pdb\*U3 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\wbemsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\bcryptprimitives.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb] source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\dll\WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InputHost.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\Windows.UI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000927D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wmswsock.pdbb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cfgmgr32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009C72000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemcomn.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000076A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc6.pdb< source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\CoreMessaging.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\JSAMSIProvider32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009916000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DLL\audioses.pdbemory source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000083F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdb: 3.2.D source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wmswsock.pdbB source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: samcli.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000940F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008ECE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreUIComponents.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009FB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wbemprox.pdbdbQ source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: i.appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InputHost.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: top\dll\TextInputFramework.pdb6. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinTypes.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008641000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MMDevAPI.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009BBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wrpcrt4.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000076A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PI.pdbv source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: secur32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000008FF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TextInputFramework.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009EA6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\samlib.pdb4) source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fwpuclnt.pdb*K source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WinTypes.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A011000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rasadhlp.pdbl source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WindowManagementAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009E4C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\fastprox.pdbM source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UI.pdb2. source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000083F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsspicli.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.000000000941A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wbemprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MMDevAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009BBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: FirewallAPI.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dll\InputHost.pdbows\M source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\rasadhlp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnsapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000099D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: userenv.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009168000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wimm32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreUIComponents.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004B8A000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009FB6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\rasadhlp.pdbp source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wwin32u.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009220000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009849000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbdbghel source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\fastprox.pdbB source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemprox.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\JSAMSIProvider32.pdbdbf source: getscreen-226997704-x86.exe, 00000000.00000002.244223787408.0000000004BB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A36E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\rasadhlp.pdb* source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rk.pdb90 source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\exe\getscreen-226997704-x86.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.0000000002908000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\dll\wbemcomn.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wmswsock.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\symbols\DLL\dhcpcsvc6.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.00000000098AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wUxTheme.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009730000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptbase.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000967B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\dll\WinTypes.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.0000000007590000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.0000000009791000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb( source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.00000000075AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wtsapi32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244230163609.0000000009409000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Desktop\TextInputFramework.pdb\*\ntdll source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: oleaut32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.0000000008484000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244226458375.000000000777F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UIComponents.pdbbdo source: getscreen-226997704-x86.exe, 00000000.00000002.244228105506.00000000084A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wbemprox.pdb source: getscreen-226997704-x86.exe, 00000000.00000002.244232628650.000000000A1A2000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

PE file contains an invalid checksum

Source: tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe.0.dr	Static PE information: real checksum: 0x6bdc2f should be: 0x6b69f4
Source: getscreen-226997704-x86.exe	Static PE information: real checksum: 0x6bdc2f should be: 0x6b69f4

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 4_3_027DA789 push eax; ret	4_3_027DA78A
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 5_3_02A389C9 push ds; retf	5_3_02A389DA
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 5_3_02A2C040 push es; iretd	5_3_02A2C041
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 5_3_02A7C6E5 push eax; iretd	5_3_02A7C792
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 5_3_02A7CD28 pushad ; iretd	5_3_02A7CD29
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Code function: 5_3_02A7C70E push eax; iretd	5_3_02A7C792

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

File created: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe

Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

File created: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, Manufacturer, MACAddress, Speed, InterfaceIndex, Index, GUID FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 8
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 8
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 7
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT DHCPServer, DNSServerSearchOrder, IPAddress FROM Win32_NetworkAdapterConfiguration WHERE InterfaceIndex = 7
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 'True'

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BankLabel, DeviceLocator, DataWidth, Manufacturer, PartNumber, SerialNumber, Capacity FROM Win32_PhysicalMemory

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, VolumeName, FileSystem, Size, FreeSpace FROM Win32_LogicalDisk

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption FROM Win32_SoundDevice

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\ProgramData\Getscreen.me\tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	System information queried: FirmwareTableInformation	Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe TID: 8216	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe TID: 8364	Thread sleep count: 230 > 30			Jump to behavior

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT BIOSVersion, Name, ReleaseDate FROM Win32_BIOS

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem
Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model, Name, Domain, Workgroup FROM Win32_ComputerSystem

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed, Caption FROM Win32_Processor

Source: getscreen-226997704-x86.exe, 00000005.00000003.244239767676.0000000002A26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ?WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=
Source: getscreen-226997704-x86.exe, 00000000.00000002.244216272390.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001952000.00000040.00000001.01000000.00000004.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244271035507.00000000010B2000.00000040.00000001.01000000.00000003.sdmp, getscreen-226997704-x86.exe, 00000005.00000002.244243221966.00000000010B2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V console (use port 2179, disable negotiation)
Source: getscreen-226997704-x86.exe, 00000005.00000001.244201588893.0000000000CA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMnet
Source: tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244184170196.0000000001541000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: WebRTC-AllowMACBasedIPv6WebRTC-BindUsingInterfaceNameVMnetWebRTC-UseDifferentiatedCellularCostsWebRTC-AddNetworkCostToVpnNet[:id=
Source: getscreen-226997704-x86.exe	Binary or memory string: Hyper-V RAW
Source: getscreen-226997704-x86.exe, 00000004.00000003.244256741195.0000000002829000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000004.00000003.244266654873.000000000282D000.00000004.00000020.00020000.00000000.sdmp, getscreen-226997704-x86.exe, 00000004.00000002.244276239100.0000000002831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'
Source: tqcebwhlhccnmvlzbgjdymdxhfnpwbt-elevate.exe, 00000002.00000002.244183682713.00000000009B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: getscreen-226997704-x86.exe, 00000000.00000002.244222430201.0000000002946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\svchost.exe

Process created: C:\Users\user\Desktop\getscreen-226997704-x86.exe "C:\Users\user\Desktop\getscreen-226997704-x86.exe" -cpipe \\.\pipe\PCommand96zvvnazikzfalhbg -cmem 0000pipe0PCommand96zvvnazikzfalhbgosfzk23ai5osclf -child

Jump to behavior

Source: getscreen-226997704-x86.exe, 00000000.00000002.244229791187.000000000893F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: getscreen-226997704-x86.exe, 00000000.00000002.244229791187.000000000893F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\getscreen-226997704-x86.exe

Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	631 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	11 Input Capture	731 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	541 Virtualization/Sandbox Evasion	LSASS Memory	541 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	132 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
getscreen-226997704-x86.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report getscreen-226997704-x86.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
getscreen-226997704-x86.exe