Analysis
- max time kernel
300s - max time network
292s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 02:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
INV_No.20260813132356.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
INV_No.20260813132356.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
Behavioral task
behavioral3
Sample
pdfcore8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
pdfcore8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
General
- Target INV_No.20260813132356.exe
- Size 1.1MB
- Sample260815-denv1sysfs
- SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
- MD5 13412cd73870016f6f59125e47e076a9
- SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
- SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
- SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
- TLSH T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2664 GFExperience.NvStreamSrv.NVX.EXE 5692 GFExperience.NvStreamSrv.NVX.EXE - Loads dropped DLL 2 IoCs
pid Process 2664 GFExperience.NvStreamSrv.NVX.EXE 5692 GFExperience.NvStreamSrv.NVX.EXE - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\T: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\X: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\Z: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\B: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\G: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\I: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\K: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\M: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\P: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\R: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\S: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\D: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\J: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\N: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\O: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\Q: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\U: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\W: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\Y: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\H: GFExperience.NvStreamSrv.NVX.EXE File opened (read-only) \??\V: GFExperience.NvStreamSrv.NVX.EXE - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 13 api.ipify.org - Discovers running processes 1 TTPs 6 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3028 tasklist.exe 3712 tasklist.exe 4940 tasklist.exe 5452 tasklist.exe 3428 tasklist.exe 5300 tasklist.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5660 cmd.exe 2672 cmd.exe 1900 cmd.exe 1156 cmd.exe 3136 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFExperience.NvStreamSrv.NVX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INV_No.20260813132356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFExperience.NvStreamSrv.NVX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 6 IoCs
pid Process 3200 timeout.exe 5488 timeout.exe 2064 timeout.exe 2820 timeout.exe 4472 timeout.exe 824 timeout.exe - Kills process with taskkill 2 IoCs
pid Process 2100 taskkill.exe 4628 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open INV_No.20260813132356.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings INV_No.20260813132356.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell INV_No.20260813132356.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}/nvvad.nvi.exe/GFExperience.NvStreamSrv.NVX.EXE" INV_No.20260813132356.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell INV_No.20260813132356.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings INV_No.20260813132356.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command INV_No.20260813132356.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open INV_No.20260813132356.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" INV_No.20260813132356.exe Key deleted \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ms-settings\Shell\open\command INV_No.20260813132356.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4628 taskkill.exe Token: SeDebugPrivilege 3712 tasklist.exe Token: SeDebugPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeLoadDriverPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeTakeOwnershipPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeIncBasePriorityPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeTcbPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeDebugPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeCreateTokenPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeAssignPrimaryTokenPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeLockMemoryPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeIncreaseQuotaPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeMachineAccountPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeTcbPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeSecurityPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeTakeOwnershipPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeLoadDriverPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeSystemProfilePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeSystemtimePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeProfSingleProcessPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeIncBasePriorityPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeCreatePagefilePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeCreatePermanentPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeBackupPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeRestorePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeShutdownPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeDebugPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeAuditPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeSystemEnvironmentPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeChangeNotifyPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeRemoteShutdownPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeUndockPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeSyncAgentPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeEnableDelegationPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeManageVolumePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeImpersonatePrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeCreateGlobalPrivilege 2664 GFExperience.NvStreamSrv.NVX.EXE Token: 31 2664 GFExperience.NvStreamSrv.NVX.EXE Token: 32 2664 GFExperience.NvStreamSrv.NVX.EXE Token: 33 2664 GFExperience.NvStreamSrv.NVX.EXE Token: 34 2664 GFExperience.NvStreamSrv.NVX.EXE Token: 35 2664 GFExperience.NvStreamSrv.NVX.EXE Token: SeDebugPrivilege 2100 taskkill.exe Token: SeDebugPrivilege 4940 tasklist.exe Token: SeDebugPrivilege 5452 tasklist.exe Token: SeDebugPrivilege 3428 tasklist.exe Token: SeDebugPrivilege 5300 tasklist.exe Token: SeDebugPrivilege 3028 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 236 INV_No.20260813132356.exe 2664 GFExperience.NvStreamSrv.NVX.EXE 2664 GFExperience.NvStreamSrv.NVX.EXE 5692 GFExperience.NvStreamSrv.NVX.EXE - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 236 wrote to memory of 5660 236 INV_No.20260813132356.exe 89 PID 5660 wrote to memory of 5048 5660 cmd.exe 91 PID 5048 wrote to memory of 2664 5048 ComputerDefaults.exe 92 PID 2664 wrote to memory of 4628 2664 GFExperience.NvStreamSrv.NVX.EXE 93 PID 2664 wrote to memory of 2672 2664 GFExperience.NvStreamSrv.NVX.EXE 96 PID 2672 wrote to memory of 1900 2672 cmd.exe 98 PID 1900 wrote to memory of 3712 1900 cmd.exe 99 PID 1900 wrote to memory of 5044 1900 cmd.exe 100 PID 1900 wrote to memory of 5488 1900 cmd.exe 101 PID 5692 wrote to memory of 2100 5692 GFExperience.NvStreamSrv.NVX.EXE 104 PID 5692 wrote to memory of 1156 5692 GFExperience.NvStreamSrv.NVX.EXE 106 PID 1156 wrote to memory of 3136 1156 cmd.exe 108 PID 3136 wrote to memory of 4940 3136 cmd.exe 109 PID 3136 wrote to memory of 4136 3136 cmd.exe 110 PID 3136 wrote to memory of 2064 3136 cmd.exe 111 PID 3136 wrote to memory of 5452 3136 cmd.exe 113 PID 3136 wrote to memory of 5920 3136 cmd.exe 114 PID 3136 wrote to memory of 2820 3136 cmd.exe 115 PID 3136 wrote to memory of 3428 3136 cmd.exe 116 PID 3136 wrote to memory of 3780 3136 cmd.exe 117 PID 3136 wrote to memory of 4472 3136 cmd.exe 118 PID 3136 wrote to memory of 5300 3136 cmd.exe 119 PID 3136 wrote to memory of 5112 3136 cmd.exe 120 PID 3136 wrote to memory of 824 3136 cmd.exe 121 PID 3136 wrote to memory of 3028 3136 cmd.exe 122 PID 3136 wrote to memory of 5988 3136 cmd.exe 123 PID 3136 wrote to memory of 3200 3136 cmd.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV_No.20260813132356.exe"C:\Users\Admin\AppData\Local\Temp\INV_No.20260813132356.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\ProgramData\VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}\nvvad.nvi.exe\GFExperience.NvStreamSrv.NVX.EXE"GFExperience.NvStreamSrv.NVX.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"7⤵
- System Location Discovery: System Language Discovery
PID:5044
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5488
-
-
-
-
-
-
-
C:\ProgramData\VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}\nvvad.nvi.exe\GFExperience.NvStreamSrv.NVX.EXEC:\ProgramData\VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}\nvvad.nvi.exe\GFExperience.NvStreamSrv.NVX.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:4136
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2064
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5452
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:5920
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2820
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:3780
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4472
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:824
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.NvStreamSrv.NVX.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.NvStreamSrv.NVX.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:5988
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3200
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}\nvvad.nvi.exe\GFExperience.NvStreamSrv.NVX.EXE
- Size 1.1MB
- SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
- MD5 13412cd73870016f6f59125e47e076a9
- SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
- SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
- SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
- TLSH T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\VirtualAudio.Driver.{8C70C947-0799-4C97-B8C9-0F58FF03A58D}\nvvad.nvi.exe\Pdfcore8.dLL
- Size 5.5MB
- SHA256 84cb61ac98670cc49f919940bc54461c00223ac74fc5b01581b450d89cfe5ab1
- MD5 f168e1a06b5f8a380bd11edc5ecfc2b1
- SHA1 fe4209bef744b93ac05d0b9d7e377e62dd6a1e5f
- SHA512 3ed7b91952d04d9d117ce9ad14cd8b082412f10cdc41d83f8ca7e17a04955e9243ada87d3e02049f9b3d98e7cc55ed3b51b7062d3610707fe710c7a05be2f1f4
- SSDEEP 98304:HZ450y5i1sSv66fjpSBRzPTq0+LToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq0+QBFt7Z4O7NADtV6v+zZE
- TLSH T18146CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 e8f9cf1314b5c86225a02c7207af7369beee1bcb994694bdb6b59f735357b29a
- MD5 4a251d6eca92d3b28b3f094a8498709c
- SHA1 d4a2f7e96bd9f44153ffdead659c5835ab448c84
- SHA512 1c8d8c015a2c1e2e27f6ff224a08e83c7829e5223e8e1e2744edab88c63ae3eb55df38d4c4882b2c0ae2fccd43e55a29184ea0852ed4c603961dac6796c09456
- TLSH T1B431104EC4270E1D431402EF3786CC6BC690E003FD883190B5D8AB8523C5B8E0DA7BAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 5b3596e2379eaa4c1623c482fcc8bd490934965fa0560a662f58b02b3ca50507
- MD5 087de5c330b35c42d7dcac0a3ccf088f
- SHA1 6eed01335aa56d1bd0cd462d84564c5a9af7df4b
- SHA512 5a683fb5e21e9d064b2f5f1166b58e46b4d61da4c4a0b31be1785c7563e0ba8ae016cc30dde5539fa3f6c7852e3cd4fd9d2fc017ebbac40813ebc0783a2bb98b
- TLSH T1E931155EC4574E1D031142DF2787CC5FC650F503ED847180759C9F8413C5B8E1966BAD
- MD5 SHA1 SHA512 TLSH