What is nv3dappshext.dll?
nv3dappshext.dll is part of NVIDIA Shell Extensions and developed by NVIDIA Corporation according to the nv3dappshext.dll version information.
nv3dappshext.dll's description is "NVIDIA Shell Extensions"
nv3dappshext.dll is digitally signed by NVIDIA Corporation.
nv3dappshext.dll is usually located in the 'C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_ba3f490ca47b4a0b\' folder.
Some of the anti-virus scanners at VirusTotal detected nv3dappshext.dll.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on nv3dappshext.dll:
| Property | Value |
|---|---|
| Product name | NVIDIA Shell Extensions |
| Company name | NVIDIA Corporation |
| File description | NVIDIA Shell Extensions |
| Internal name | Nv3DAppShExt.dll |
| Original filename | Nv3DAppShExt.dll |
| Legal copyright | (C) 2019 NVIDIA Corporation. All rights reserved. |
| Product version | 6.14.14.4112 |
| File version | 6.14.14.4112 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | NVIDIA Shell Extensions |
| Company name | NVIDIA Corporation |
| File description | NVIDIA Shell Extensions |
| Internal name | Nv3DAppShExt.dll |
| Original filename | Nv3DAppShExt.dll |
| Legal copyright | (C) 2019 NVIDIA Corporation. All rig.. |
| Product version | 6.14.14.4112 |
| File version | 6.14.14.4112 |
Digital signatures [?]
nv3dappshext.dll has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | NVIDIA Corporation |
| Certificate issuer name | VeriSign Class 3 Code Signing 2010 CA |
| Certificate serial number | 71e68684f7a885a24abf921cbbf4e0c3 |
VirusTotal report
1 of the 71 anti-virus programs at VirusTotal detected the nv3dappshext.dll file. That's a 1% detection rate.
| Scanner | Detection Name |
|---|---|
| eGambit | Unsafe.AI_Score_83% |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL\\AppID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)"
],
"dll_loaded": [
"kernel32",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll",
"api-ms-win-core-fibers-l1-1-1",
"kernel32.dll",
"ADVAPI32.dll",
"api-ms-win-core-synch-l1-2-0"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0",
"HKEY_CLASSES_ROOT\\vbefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL",
"HKEY_CLASSES_ROOT\\jsfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx",
"HKEY_CLASSES_ROOT\\lnkfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}",
"HKEY_CLASSES_ROOT\\dllfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt",
"HKEY_CLASSES_ROOT\\wshfile",
"HKEY_CLASSES_ROOT\\jsefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0",
"HKEY_CLASSES_ROOT\\AppID",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt",
"HKEY_CLASSES_ROOT\\vbsfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID",
"HKEY_CLASSES_ROOT\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers",
"HKEY_CLASSES_ROOT\\comfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt.1",
"HKEY_CLASSES_ROOT\\wsffile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CLASSES_ROOT\\cmdfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt.1",
"HKEY_CLASSES_ROOT\\mscfile",
"HKEY_CLASSES_ROOT\\.dll",
"HKEY_CLASSES_ROOT\\exefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CURRENT_USER\\TypeLib",
"HKEY_CLASSES_ROOT\\batfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt"
],
"command_line": [
" C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)"
]
}Generic
[
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1585014787.34375,
"ppid": 376
},
{
"process_path": "C:\\Windows\\SysWOW64\\regsvr32.exe",
"process_name": "regsvr32.exe",
"pid": 2740,
"summary": {
"dll_loaded": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"command_line": [
" C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"regkey_opened": [
"HKEY_CLASSES_ROOT\\.dll",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
"HKEY_CLASSES_ROOT\\dllfile"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)"
]
},
"first_seen": 1585014787.6875,
"ppid": 1664
},
{
"process_path": "C:\\Windows\\System32\\regsvr32.exe",
"process_name": "regsvr32.exe",
"pid": 2828,
"summary": {
"regkey_written": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL\\AppID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\ThreadingModel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)"
],
"dll_loaded": [
"kernel32",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll",
"api-ms-win-core-fibers-l1-1-1",
"kernel32.dll",
"ADVAPI32.dll",
"api-ms-win-core-synch-l1-2-0"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0",
"HKEY_CLASSES_ROOT\\vbefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL",
"HKEY_CLASSES_ROOT\\jsfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx",
"HKEY_CLASSES_ROOT\\lnkfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}",
"HKEY_CLASSES_ROOT\\dllfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt",
"HKEY_CLASSES_ROOT\\wshfile",
"HKEY_CLASSES_ROOT\\jsefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0",
"HKEY_CLASSES_ROOT\\AppID",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt",
"HKEY_CLASSES_ROOT\\vbsfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID",
"HKEY_CLASSES_ROOT\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers",
"HKEY_CLASSES_ROOT\\comfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt.1",
"HKEY_CLASSES_ROOT\\wsffile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CLASSES_ROOT\\cmdfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt.1",
"HKEY_CLASSES_ROOT\\mscfile",
"HKEY_CLASSES_ROOT\\.dll",
"HKEY_CLASSES_ROOT\\exefile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
"HKEY_CURRENT_USER\\TypeLib",
"HKEY_CLASSES_ROOT\\batfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)"
]
},
"first_seen": 1585014787.921875,
"ppid": 2740
}
]Signatures
[
{
"markcount": 1,
"families": [],
"description": "This executable has a PDB path",
"severity": 1,
"marks": [
{
"category": "pdb_path",
"ioc": "C:\\dvs\\p4\\build\\sw\\rel\\gpu_drv\\r440\\r441_09\\drivers\\ui\\Nv3DAppShExt\\Nv3DAppShExt\\x64\\ReleaseWin7\\Nv3DAppShExt.pdb",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "has_pdb"
},
{
"markcount": 2,
"families": [],
"description": "The file contains an unknown PE resource name possibly indicative of a packer",
"severity": 1,
"marks": [
{
"category": "resource name",
"ioc": "REGISTRY",
"type": "ioc",
"description": null
},
{
"category": "resource name",
"ioc": "TYPELIB",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "pe_unknown_resource_name"
},
{
"markcount": 4,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2828,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffffffffffff",
"base_address": "0x000007fef08e4000"
},
"time": 1585014358.565146,
"tid": 2856,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2828,
"type": "call",
"cid": 17
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2828,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffffffffffff",
"base_address": "0x000007fefca66000"
},
"time": 1585014358.565146,
"tid": 2856,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2828,
"type": "call",
"cid": 19
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2828,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffffffffffff",
"base_address": "0x000007fefbbfa000"
},
"time": 1585014358.565146,
"tid": 2856,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2828,
"type": "call",
"cid": 21
},
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtProtectVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 2828,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"length": 4096,
"protection": 64,
"process_handle": "0xffffffffffffffff",
"base_address": "0x000007feff8fd000"
},
"time": 1585014358.565146,
"tid": 2856,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE"
}
},
"pid": 2828,
"type": "call",
"cid": 23
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 2,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
"reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
},
{
"type": "generic",
"reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
"reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd.bin.dll"
}
],
"references": [],
"name": "persistence_autorun"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 662,
"time": 6.179938077926636,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 5694,
"time": 6.139101028442383,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6022,
"time": 4.136667013168335,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6350,
"time": 6.150459051132202,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6678,
"time": 4.636729001998901,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7006,
"time": 3.0183770656585693,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 7334,
"time": 4.227004051208496,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 21422,
"time": 4.175606966018677,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 29806,
"time": 6.259845972061157,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "8fdf8ee71c8b75f9f85b99a1b57d9c857a09b2b67adfc1f4e8d1209cb242a463",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "ac4cb28ef138a4c78704af278d9a1d1b68acc4277b480e3930d66ba27db9317d",
"irc": [],
"https_ex": []
}Screenshots
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 45c495d60bbe3df0a17992456be04aa9 |
| SHA256 | 28e10880edf9386ca9456eb3b51b504676d3f6f799824285bacaba5f65391dcd |
What will you do with the file?
To help other users, please let us know what you will do with the file:
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.