6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317

Analysis

max time kernel
36s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
Size 2.4MB
Sample260831-nhzf2a1alg
SHA256 6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317
MD5 f220a69a6441b4a02bccdecf7b899f03
SHA1 30631a215383672e3be76851a0c50f86dd7b497d
SHA512 e608d8da8869bd543bf7fa91a45c6028cd3456841ba242d71cb55256a85872017772bb1868ca0d2e34a8338e335439011adea66f48bfc27fd1aa4d6a3f8a8278
SSDEEP 49152:JgqKIXzbFoS4HdGieV8emYbxxfRqrKkKE4+cJDKRQmfSN:Jzv4Qig89izfR6/3cZK+ZN
TLSH
T149C5120AE7E805FCE0B7B1B8DD5A8902E77A7C491721A78F03A496971F172A0DD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3596	powershell.exe
4680	powershell.exe
4840	powershell.exe
5680	powershell.exe
5700	powershell.exe
2120	powershell.exe
6020	powershell.exe
4704	powershell.exe
4844	powershell.exe
1472	powershell.exe
1040	powershell.exe
5348	powershell.exe
5880	powershell.exe
3048	powershell.exe
5808	powershell.exe
4288	powershell.exe
4740	powershell.exe
5660	powershell.exe
1476	powershell.exe
1568	powershell.exe
4300	powershell.exe
5568	powershell.exe
5100	powershell.exe
1288	powershell.exe
1108	powershell.exe
1492	powershell.exe
3048	powershell.exe
5224	powershell.exe
1788	powershell.exe
2160	powershell.exe
1472	powershell.exe
2960	powershell.exe
4176	powershell.exe
1784	powershell.exe
3352	powershell.exe
2720	powershell.exe
2872	powershell.exe
3268	powershell.exe
4536	powershell.exe
4528	powershell.exe
6108	powershell.exe
5232	powershell.exe
5924	powershell.exe
1440	powershell.exe
4756	powershell.exe
4600	powershell.exe
2728	powershell.exe
4328	powershell.exe
4792	powershell.exe
2596	powershell.exe
3056	powershell.exe
4840	powershell.exe
2612	powershell.exe
4804	powershell.exe
5944	powershell.exe
2728	powershell.exe
6092	powershell.exe
4560	powershell.exe
2336	powershell.exe
5352	powershell.exe
3324	powershell.exe
5672	powershell.exe
3344	powershell.exe
4364	powershell.exe

Executes dropped EXE 25 IoCs

pid	Process
248	NvBackend.exe
972	新建文件夹.exe
5716	NvBackend.exe
4572	NvBackend.exe
6112	NvBackend.exe
5640	NvBackend.exe
2792	NvBackend.exe
2920	NvBackend.exe
4116	NvBackend.exe
2820	NvBackend.exe
5012	NvBackend.exe
576	NvBackend.exe
360	NvBackend.exe
4880	NvBackend.exe
3360	NvBackend.exe
5336	NvBackend.exe
4408	NvBackend.exe
4304	NvBackend.exe
3624	NvBackend.exe
1436	NvBackend.exe
1968	NvBackend.exe
5772	NvBackend.exe
4800	NvBackend.exe
5028	NvBackend.exe
4124	NvBackend.exe

Loads dropped DLL 24 IoCs

pid	Process
248	NvBackend.exe
5716	NvBackend.exe
4572	NvBackend.exe
6112	NvBackend.exe
5640	NvBackend.exe
2792	NvBackend.exe
2920	NvBackend.exe
4116	NvBackend.exe
2820	NvBackend.exe
5012	NvBackend.exe
576	NvBackend.exe
360	NvBackend.exe
4880	NvBackend.exe
3360	NvBackend.exe
5336	NvBackend.exe
4408	NvBackend.exe
4304	NvBackend.exe
3624	NvBackend.exe
1436	NvBackend.exe
1968	NvBackend.exe
5772	NvBackend.exe
4800	NvBackend.exe
5028	NvBackend.exe
4124	NvBackend.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\downlevel\detoured.dll	新建文件夹.exe
File created	C:\Windows\SysWOW64\downlevel\__tmp_rar_sfx_access_check_240743265	新建文件夹.exe
File created	C:\Windows\SysWOW64\downlevel\NvBackend.exe	新建文件夹.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\NvBackend.exe	新建文件夹.exe
File created	C:\Windows\SysWOW64\downlevel\detoured.dll	新建文件夹.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\新建文件夹.exe	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File created	C:\Windows\appcompat\detoured.dll	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File opened for modification	C:\Windows\appcompat\detoured.dll	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File created	C:\Windows\appcompat\__tmp_rar_sfx_access_check_240742406	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File created	C:\Windows\appcompat\NvBackend.exe	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File opened for modification	C:\Windows\appcompat\NvBackend.exe	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
File created	C:\Windows\appcompat\新建文件夹.exe	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NvBackend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
248	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
5716	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
4572	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe
6112	NvBackend.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeIncreaseQuotaPrivilege	2596	powershell.exe
Token: SeSecurityPrivilege	2596	powershell.exe
Token: SeTakeOwnershipPrivilege	2596	powershell.exe
Token: SeLoadDriverPrivilege	2596	powershell.exe
Token: SeSystemProfilePrivilege	2596	powershell.exe
Token: SeSystemtimePrivilege	2596	powershell.exe
Token: SeProfSingleProcessPrivilege	2596	powershell.exe
Token: SeIncBasePriorityPrivilege	2596	powershell.exe
Token: SeCreatePagefilePrivilege	2596	powershell.exe
Token: SeBackupPrivilege	2596	powershell.exe
Token: SeRestorePrivilege	2596	powershell.exe
Token: SeShutdownPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeSystemEnvironmentPrivilege	2596	powershell.exe
Token: SeRemoteShutdownPrivilege	2596	powershell.exe
Token: SeUndockPrivilege	2596	powershell.exe
Token: SeManageVolumePrivilege	2596	powershell.exe
Token: 33	2596	powershell.exe
Token: 34	2596	powershell.exe
Token: 35	2596	powershell.exe
Token: 36	2596	powershell.exe
Token: SeIncreaseQuotaPrivilege	4956	powershell.exe
Token: SeSecurityPrivilege	4956	powershell.exe
Token: SeTakeOwnershipPrivilege	4956	powershell.exe
Token: SeLoadDriverPrivilege	4956	powershell.exe
Token: SeSystemProfilePrivilege	4956	powershell.exe
Token: SeSystemtimePrivilege	4956	powershell.exe
Token: SeProfSingleProcessPrivilege	4956	powershell.exe
Token: SeIncBasePriorityPrivilege	4956	powershell.exe
Token: SeCreatePagefilePrivilege	4956	powershell.exe
Token: SeBackupPrivilege	4956	powershell.exe
Token: SeRestorePrivilege	4956	powershell.exe
Token: SeShutdownPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeSystemEnvironmentPrivilege	4956	powershell.exe
Token: SeRemoteShutdownPrivilege	4956	powershell.exe
Token: SeUndockPrivilege	4956	powershell.exe
Token: SeManageVolumePrivilege	4956	powershell.exe
Token: 33	4956	powershell.exe
Token: 34	4956	powershell.exe
Token: 35	4956	powershell.exe
Token: 36	4956	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe
Token: SeCreatePagefilePrivilege	4844	powershell.exe
Token: SeBackupPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	4844	powershell.exe
Token: SeShutdownPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeSystemEnvironmentPrivilege	4844	powershell.exe
Token: SeRemoteShutdownPrivilege	4844	powershell.exe
Token: SeUndockPrivilege	4844	powershell.exe
Token: SeManageVolumePrivilege	4844	powershell.exe
Token: 33	4844	powershell.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5716	NvBackend.exe
6112	NvBackend.exe
5640	NvBackend.exe
2792	NvBackend.exe
2920	NvBackend.exe
4116	NvBackend.exe
2820	NvBackend.exe
5012	NvBackend.exe
576	NvBackend.exe
360	NvBackend.exe
4880	NvBackend.exe
3360	NvBackend.exe
5336	NvBackend.exe
4408	NvBackend.exe
4304	NvBackend.exe
3624	NvBackend.exe
1436	NvBackend.exe
1968	NvBackend.exe
5772	NvBackend.exe
4800	NvBackend.exe
5028	NvBackend.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 248	1080	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe	89
PID 1080 wrote to memory of 972	1080	6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe	90
PID 972 wrote to memory of 5716	972	新建文件夹.exe	91
PID 5716 wrote to memory of 6112	5716	NvBackend.exe	94
PID 6112 wrote to memory of 2792	6112	NvBackend.exe	97
PID 6112 wrote to memory of 4956	6112	NvBackend.exe	98
PID 5640 wrote to memory of 2920	5640	NvBackend.exe	100
PID 2920 wrote to memory of 4116	2920	NvBackend.exe	101
PID 2920 wrote to memory of 2596	2920	NvBackend.exe	102
PID 4116 wrote to memory of 2820	4116	NvBackend.exe	104
PID 2820 wrote to memory of 4844	2820	NvBackend.exe	106
PID 4116 wrote to memory of 5012	4116	NvBackend.exe	108
PID 5012 wrote to memory of 1568	5012	NvBackend.exe	109
PID 4116 wrote to memory of 576	4116	NvBackend.exe	111
PID 576 wrote to memory of 3056	576	NvBackend.exe	112
PID 4116 wrote to memory of 360	4116	NvBackend.exe	114
PID 360 wrote to memory of 5100	360	NvBackend.exe	115
PID 4116 wrote to memory of 4880	4116	NvBackend.exe	117
PID 4880 wrote to memory of 1472	4880	NvBackend.exe	164
PID 4116 wrote to memory of 3360	4116	NvBackend.exe	120
PID 3360 wrote to memory of 4536	3360	NvBackend.exe	121
PID 4116 wrote to memory of 5336	4116	NvBackend.exe	123
PID 5336 wrote to memory of 5672	5336	NvBackend.exe	124
PID 4116 wrote to memory of 4408	4116	NvBackend.exe	126
PID 4408 wrote to memory of 4840	4408	NvBackend.exe	182
PID 4116 wrote to memory of 4304	4116	NvBackend.exe	129
PID 4304 wrote to memory of 1476	4304	NvBackend.exe	130
PID 4116 wrote to memory of 3624	4116	NvBackend.exe	132
PID 3624 wrote to memory of 1288	3624	NvBackend.exe	133
PID 4116 wrote to memory of 1436	4116	NvBackend.exe	135
PID 1436 wrote to memory of 3324	1436	NvBackend.exe	136
PID 4116 wrote to memory of 1968	4116	NvBackend.exe	138
PID 1968 wrote to memory of 3048	1968	NvBackend.exe	263
PID 4116 wrote to memory of 5772	4116	NvBackend.exe	142
PID 5772 wrote to memory of 2728	5772	NvBackend.exe	143
PID 4116 wrote to memory of 4800	4116	NvBackend.exe	145
PID 4800 wrote to memory of 3596	4800	NvBackend.exe	303
PID 4116 wrote to memory of 5028	4116	NvBackend.exe	148
PID 5028 wrote to memory of 2120	5028	NvBackend.exe	149
PID 4116 wrote to memory of 4124	4116	NvBackend.exe	151

C:\Users\Admin\AppData\Local\Temp\6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
"C:\Users\Admin\AppData\Local\Temp\6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\appcompat\NvBackend.exe
  "C:\Windows\appcompat\NvBackend.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Windows\appcompat\新建文件夹.exe
  "C:\Windows\appcompat\新建文件夹.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\downlevel\NvBackend.exe
    "C:\Windows\SysWOW64\downlevel\NvBackend.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6112
    - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
        
        "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --b --watch=6112
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2792
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956

C:\Windows\appcompat\NvBackend.exe
C:\Windows\appcompat\NvBackend.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\SysWOW64\downlevel\NvBackend.exe
C:\Windows\SysWOW64\downlevel\NvBackend.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\SysWOW64\downlevel\NvBackend.exe
  "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\downlevel\NvBackend.exe
    "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --b --watch=2920
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3056
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5100
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1472
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4536
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:5672
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4840
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1476
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1288
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3324
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3048
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5772
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2728
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3596
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:2120
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6092
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3344
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5072
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2612
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1040
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1472
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:564
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4756
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:1228
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4436
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4364
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4860
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4680
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1108
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3148
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4840
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4356
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6020
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2924
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4600
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4736
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5808
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1456
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:3464
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2960
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5100
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4300
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:256
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4176
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3888
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5568
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2692
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:4772
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5912
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:3352
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:4920
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1352
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4804
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5044
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4528
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4680
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4288
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3052
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:5328
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2400
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5680
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4748
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:1152
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:1520
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6108
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1492
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:432
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5924
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5776
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:4780
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4792
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:428
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4740
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:1724
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1784
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4492
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3048
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:920
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4896
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5944
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4344
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:3712
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5700
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4552
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:6068
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2744
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5660
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2168
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4704
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2184
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5348
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3484
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3352
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5876
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5880
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2652
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1440
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:6016
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:5816
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:5040
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3596
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5216
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5232
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2728
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1892
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4560
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4556
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5224
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:3648
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2720
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1168
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2336
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5848
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2872
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:6024
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5352
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1056
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4328
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:4084
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1788
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:2060
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        
        PID:1692
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1068
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2160
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:1184
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3268
  - - C:\Windows\SysWOW64\downlevel\NvBackend.exe
      "C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=4116
      4⤵
      PID:5260
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact