What is nv3dappshext.dll?

nv3dappshext.dll is part of NVIDIA Shell Extensions and developed by NVIDIA Corporation according to the nv3dappshext.dll version information.

nv3dappshext.dll's description is "NVIDIA Shell Extensions"

nv3dappshext.dll is digitally signed by NVIDIA Corporation.

nv3dappshext.dll is usually located in the 'C:\Windows\system32\' folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about nv3dappshext.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on nv3dappshext.dll:

PropertyValue
Product nameNVIDIA Shell Extensions
Company nameNVIDIA Corporation
File descriptionNVIDIA Shell Extensions
Internal nameNv3DAppShExt.dll
Original filenameNv3DAppShExt.dll
Legal copyright(C) 2019 NVIDIA Corporation. All rights reserved.
Product version6.14.14.3630
File version6.14.14.3630

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product nameNVIDIA Shell Extensions
Company nameNVIDIA Corporation
File descriptionNVIDIA Shell Extensions
Internal nameNv3DAppShExt.dll
Original filenameNv3DAppShExt.dll
Legal copyright(C) 2019 NVIDIA Corporation. All rig..
Product version6.14.14.3630
File version6.14.14.3630

Digital signatures [?]

nv3dappshext.dll has a valid digital signature.

PropertyValue
Signer nameNVIDIA Corporation
Certificate issuer nameVeriSign Class 3 Code Signing 2010 CA
Certificate serial number71e68684f7a885a24abf921cbbf4e0c3

VirusTotal report

None of the 69 anti-virus programs at VirusTotal detected the nv3dappshext.dll file.

None of the 69 anti-virus programs detected the nv3dappshext.dll file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)"
    ],
    "dll_loaded": [
        "kernel32",
        "api-ms-win-core-fibers-l1-1-1",
        "kernel32.dll",
        "ADVAPI32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll",
        "api-ms-win-core-synch-l1-2-0"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
    ],
    "command_line": [
        " C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0",
        "HKEY_CLASSES_ROOT\\vbefile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL",
        "HKEY_CLASSES_ROOT\\jsfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx",
        "HKEY_CLASSES_ROOT\\lnkfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}",
        "HKEY_CLASSES_ROOT\\dllfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt",
        "HKEY_CLASSES_ROOT\\wshfile",
        "HKEY_CLASSES_ROOT\\jsefile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0",
        "HKEY_CLASSES_ROOT\\AppID",
        "HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID",
        "HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt",
        "HKEY_CLASSES_ROOT\\vbsfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID",
        "HKEY_CLASSES_ROOT\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_CLASSES_ROOT\\comfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt.1",
        "HKEY_CLASSES_ROOT\\wsffile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_CLASSES_ROOT\\cmdfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
        "HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt.1",
        "HKEY_CLASSES_ROOT\\mscfile",
        "HKEY_CLASSES_ROOT\\.dll",
        "HKEY_CLASSES_ROOT\\exefile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
        "HKEY_CURRENT_USER\\TypeLib",
        "HKEY_CLASSES_ROOT\\batfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\SysWOW64\\regsvr32.exe",
        "process_name": "regsvr32.exe",
        "pid": 2736,
        "summary": {
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            ],
            "command_line": [
                " C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            ],
            "regkey_opened": [
                "HKEY_CLASSES_ROOT\\.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
                "HKEY_CLASSES_ROOT\\dllfile"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)"
            ]
        },
        "first_seen": 1570618384.5781,
        "ppid": 2456
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1570618384.3125,
        "ppid": 376
    },
    {
        "process_path": "C:\\Windows\\System32\\regsvr32.exe",
        "process_name": "regsvr32.exe",
        "pid": 2588,
        "summary": {
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL\\AppID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)"
            ],
            "dll_loaded": [
                "kernel32",
                "api-ms-win-core-fibers-l1-1-1",
                "kernel32.dll",
                "ADVAPI32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll",
                "api-ms-win-core-synch-l1-2-0"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\VersionIndependentProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CurVer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0",
                "HKEY_CLASSES_ROOT\\vbefile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt.1\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\Nv3DAppShExt.DLL",
                "HKEY_CLASSES_ROOT\\jsfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx",
                "HKEY_CLASSES_ROOT\\lnkfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{A4CF1DBB-664A-4600-9CE3-96FBAA344504}",
                "HKEY_CLASSES_ROOT\\dllfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\NvAppShExt",
                "HKEY_CLASSES_ROOT\\wshfile",
                "HKEY_CLASSES_ROOT\\jsefile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt.1\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\ProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSEFile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.OpenGLShExt\\CurVer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0",
                "HKEY_CLASSES_ROOT\\AppID",
                "HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\ProgID",
                "HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt",
                "HKEY_CLASSES_ROOT\\vbsfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\batfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\VersionIndependentProgID",
                "HKEY_CLASSES_ROOT\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSFFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_CLASSES_ROOT\\comfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBEFile\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WSHFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_CLASSES_ROOT\\Nv3DAppShExt.OpenGLShExt.1",
                "HKEY_CLASSES_ROOT\\wsffile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\comfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\cmdfile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Nv3DAppShExt.NvAppShExt\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\mscfile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_CLASSES_ROOT\\cmdfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\NvAppShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
                "HKEY_CLASSES_ROOT\\Nv3DAppShExt.NvAppShExt.1",
                "HKEY_CLASSES_ROOT\\mscfile",
                "HKEY_CLASSES_ROOT\\.dll",
                "HKEY_CLASSES_ROOT\\exefile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\shellex\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\VBSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt",
                "HKEY_CURRENT_USER\\TypeLib",
                "HKEY_CLASSES_ROOT\\batfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\JSFile\\ShellEx\\ContextMenuHandlers\\OpenGLShExt"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\HELPDIR\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\0\\win64\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{FDBDDB6E-BA5F-41E3-9510-90F606999E91}\\1.0\\(Default)"
            ]
        },
        "first_seen": 1570618384.9062,
        "ppid": 2736
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "C:\\dvs\\p4\\build\\sw\\rel\\gpu_drv\\r435\\r436_28\\drivers\\ui\\Nv3DAppShExt\\Nv3DAppShExt\\x64\\ReleaseWin7\\Nv3DAppShExt.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "REGISTRY",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "TYPELIB",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2588,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fef08e2000"
                    },
                    "time": 1570617955.5655,
                    "tid": 2500,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2588,
                "type": "call",
                "cid": 17
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2588,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fefca66000"
                    },
                    "time": 1570617955.5655,
                    "tid": 2500,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2588,
                "type": "call",
                "cid": 19
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2588,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fefbbfa000"
                    },
                    "time": 1570617955.5655,
                    "tid": 2500,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2588,
                "type": "call",
                "cid": 21
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2588,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feff8fd000"
                    },
                    "time": 1570617955.5655,
                    "tid": 2500,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2588,
                "type": "call",
                "cid": 23
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Installs itself for autorun at Windows startup",
        "severity": 3,
        "marks": [
            {
                "type": "generic",
                "reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A929C4CE-FD36-4270-B4F5-34ECAC5BD63C}\\InprocServer32\\(Default)",
                "reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            },
            {
                "type": "generic",
                "reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{E97DEC16-A50D-49bb-AE24-CF682282E08D}\\InprocServer32\\(Default)",
                "reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68.bin.dll"
            }
        ],
        "references": [],
        "name": "persistence_autorun"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.2155239582062,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5442,
            "time": 6.1728749275208,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5770,
            "time": 4.1578447818756,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6098,
            "time": 6.1837589740753,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6426,
            "time": 4.6673028469086,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6754,
            "time": 3.0459408760071,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 7082,
            "time": 4.663890838623,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 16880,
            "time": 4.1758008003235,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 25264,
            "time": 6.2572720050812,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "2c7e5d817a69064fbfd5d0a67cb0478be441c217ceef09a394e841527a972043",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "be89b9dbf6f7d6b904f76073c836a2df0c994ee5ac75c6595453a2375963753d",
    "irc": [],
    "https_ex": []
}

Screenshots

Screenshot from the sandboxScreenshot from the sandboxScreenshot from the sandbox

Hashes [?]

PropertyValue
MD52af40f97356182ba79b4d85511858198
SHA256f5bd7d49b34b7683ee0ce63f638d68a7dbef5745403d20ee37ce56f7495fea68

What will you do with the file?

To help other users, please let us know what you will do with the file:



Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Please select the option that best describe your thoughts on the information provided on this web page


Free online surveys

And now some shameless self promotion ;)

A screenshot of FreeFixer's scan result.Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

Leave a reply