File name:

nvda_2020.2.exe

Full analysis: https://app.any.run/tasks/b16e3a26-e02e-4d65-8826-2b853883c26d
Verdict: Malicious activity
Analysis date: September 01, 2020, 09:56:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

034A26F0908A63598E5765E54AA3A881

SHA1:

55CECB2DC865B344DC18039FDF2B80CB4229DAB5

SHA256:

9BEA6EB5F6DC13A7CFA48531732E6BEDA11A27F55986EDB4B0B6DDD8389B1359

SSDEEP:

393216:Xoa+tlftpQO9W8ePpTernQ5kYSBwAYUHwfNcWVii039Vn2BiJA1fbMc:4V/QO48mezQGJYwGNcWjNBiJApMc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • nvda_slave.exe (PID: 1400)
      • explorer.exe (PID: 352)
      • nvda.exe (PID: 3732)
      • nvda_eoaProxy.exe (PID: 392)
      • nvda_2020.2.exe (PID: 1064)
      • nvda_noUIAccess.exe (PID: 3832)
      • nvda_slave.exe (PID: 3804)
      • nvda.exe (PID: 2460)
      • nvda_eoaProxy.exe (PID: 3980)

    • Application was dropped or rewritten from another process

      • nvda_noUIAccess.exe (PID: 3832)
      • nvda_slave.exe (PID: 1400)
      • nvda_eoaProxy.exe (PID: 1932)
      • nvda_eoaProxy.exe (PID: 392)
      • nvda.exe (PID: 3732)
      • nvda.exe (PID: 2460)
      • nvda_eoaProxy.exe (PID: 1496)
      • nvda_slave.exe (PID: 3804)
      • nvda.exe (PID: 772)
      • nvda_eoaProxy.exe (PID: 3980)
      • nvda.exe (PID: 2864)

    • Registers / Runs the DLL via REGSVR32.EXE

      • nvda_slave.exe (PID: 1400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • nvda_2020.2.exe (PID: 1064)
      • nvda_slave.exe (PID: 1400)

    • Loads Python modules

      • nvda_slave.exe (PID: 1400)
      • nvda.exe (PID: 3732)
      • nvda_eoaProxy.exe (PID: 392)
      • nvda_noUIAccess.exe (PID: 3832)
      • nvda_slave.exe (PID: 3804)
      • nvda.exe (PID: 2460)
      • nvda_eoaProxy.exe (PID: 3980)

    • Creates a software uninstall entry

      • nvda_slave.exe (PID: 1400)

    • Modifies the open verb of a shell class

      • nvda_slave.exe (PID: 1400)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3068)
      • regsvr32.exe (PID: 2140)

    • Searches for installed software

      • nvda.exe (PID: 3732)
      • nvda.exe (PID: 2460)

    • Creates files in the user directory

      • nvda.exe (PID: 3732)
      • nvda.exe (PID: 2460)

    • Creates files in the program directory

      • nvda_slave.exe (PID: 1400)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • nvda_slave.exe (PID: 1400)
      • nvda_2020.2.exe (PID: 1064)

    • Reads settings of System Certificates

      • nvda.exe (PID: 3732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 05:20:09+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 120320
UninitializedDataSize: 1024
EntryPoint: 0x326c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2020.2.0.20631
ProductVersionNumber: 2020.2.0.20631
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
FileDescription: NVDA launcher file
FileVersion: 2020.2.0.20631
LegalCopyright: Copyright (C) 2006-2020 NVDA Contributors
ProductName: NVDA
ProductVersion: 2020.2

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-Apr-2016 03:20:09
Detected languages:
  • English - United States
FileDescription: NVDA launcher file
FileVersion: 2020.2.0.20631
LegalCopyright: Copyright (C) 2006-2020 NVDA Contributors
ProductName: NVDA
ProductVersion: 2020.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 02-Apr-2016 03:20:09
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C74
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41039
.rdata
0x00007000
0x00001196
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.20374
.data
0x00009000
0x0001B058
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.13053
.ndata
0x00025000
0x0000B000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00030000
0x000054A8
0x00005600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.48873

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22372
947
UNKNOWN
English - United States
RT_MANIFEST
2
5.9993
3752
UNKNOWN
English - United States
RT_ICON
3
6.24459
2216
UNKNOWN
English - United States
RT_ICON
4
5.01502
1384
UNKNOWN
English - United States
RT_ICON
5
6.16057
1128
UNKNOWN
English - United States
RT_ICON
6
3.34146
744
UNKNOWN
English - United States
RT_ICON
7
3.04232
296
UNKNOWN
English - United States
RT_ICON
103
2.6691
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.89384
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
17
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start nvda_2020.2.exe nvda_nouiaccess.exe explorer.exe no specs nvda_slave.exe regedit.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs nvda.exe no specs nvda.exe nvda_eoaproxy.exe no specs nvda_eoaproxy.exe nvda_slave.exe no specs nvda.exe no specs nvda.exe nvda_eoaproxy.exe no specs nvda_eoaproxy.exe

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
392"C:\Program Files\NVDA\nvda_eoaProxy.exe" C:\Program Files\NVDA\nvda_eoaProxy.exe
utilman.exe
User:
admin
Company:
NV Access
Integrity Level:
HIGH
Description:
NVDA Ease of Access proxy
Exit code:
0
Version:
2020.2.0.20631
Modules
Images
c:\program files\nvda\nvda_eoaproxy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
772"C:\Program Files\NVDA\nvda.exe" -rC:\Program Files\NVDA\nvda.exe—nvda_slave.exe
User:
admin
Company:
NV Access
Integrity Level:
MEDIUM
Description:
NVDA application
Exit code:
3221226540
Version:
2020.2.0.20631
Modules
Images
c:\program files\nvda\nvda.exe
c:\systemroot\system32\ntdll.dll
1064"C:\Users\admin\AppData\Local\Temp\nvda_2020.2.exe" C:\Users\admin\AppData\Local\Temp\nvda_2020.2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NVDA launcher file
Exit code:
0
Version:
2020.2.0.20631
Modules
Images
c:\users\admin\appdata\local\temp\nvda_2020.2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1400"C:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\nvda_slave.exe" install 1 1C:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\nvda_slave.exe
nvda_noUIAccess.exe
User:
admin
Company:
NV Access
Integrity Level:
HIGH
Description:
NVDA
Exit code:
0
Version:
2020.2.0.20631
Modules
Images
c:\users\admin\appdata\local\temp\nsv495b.tmp\app\nvda_slave.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1496"C:\Program Files\NVDA\nvda_eoaProxy.exe" C:\Program Files\NVDA\nvda_eoaProxy.exe—utilman.exe
User:
admin
Company:
NV Access
Integrity Level:
MEDIUM
Description:
NVDA Ease of Access proxy
Exit code:
3221226540
Version:
2020.2.0.20631
Modules
Images
c:\program files\nvda\nvda_eoaproxy.exe
c:\systemroot\system32\ntdll.dll
1716C:\Windows\regedit.exe /s COMRegistryFixes\oleaccProxy.regC:\Windows\regedit.exe
nvda_slave.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1932"C:\Program Files\NVDA\nvda_eoaProxy.exe" C:\Program Files\NVDA\nvda_eoaProxy.exe—utilman.exe
User:
admin
Company:
NV Access
Integrity Level:
MEDIUM
Description:
NVDA Ease of Access proxy
Exit code:
3221226540
Version:
2020.2.0.20631
Modules
Images
c:\program files\nvda\nvda_eoaproxy.exe
c:\systemroot\system32\ntdll.dll
2140C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\actxprxy.dllC:\Windows\system32\regsvr32.exe—nvda_slave.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2460"C:\Program Files\NVDA\nvda.exe" -rC:\Program Files\NVDA\nvda.exe
nvda_slave.exe
User:
admin
Company:
NV Access
Integrity Level:
HIGH
Description:
NVDA application
Exit code:
0
Version:
2020.2.0.20631
Modules
Images
c:\program files\nvda\nvda.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
5 155
Read events
2 487
Write events
2 666
Delete events
2

Modification events

(PID) Process:(3832) nvda_noUIAccess.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
nvda_noUIAccess.exe
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\afi495O.gzc\ncc\aiqn_abHVNpprff.rkr
Value:
000000000000000000000000800A0000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000004A00000071000000FC7F32000C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D020C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D020C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D02
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\afi495O.gzc\ncc\aiqn_abHVNpprff.rkr
Value:
0000000000000000000000002D100000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(352) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000004A00000071000000A98532000C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D020C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D020C00000025000000D79E13007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF7059F6740000000000000000B4E91D028575F274000400000000000018EA1D02FFFFFFFF80D93A00FFFFFFFF18323B001C333B0078D93A00E4E91D022FB19C7580B0CF7524F71D02381E9D7514639D75A017380018EA1D02B87A390070000000AEE04A38F8E91D02BE6A9D75A017380018EA1D020000000024EC1D026F629D75A017380018EA1D0200000400000000807C629D75A017380063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C0072006F0061006D0069006E0067005C006D006900630072006F0073006F00660074005C0069006E007400650072006E006500740020006500780070006C006F007200650072005C0071007500690063006B0020006C00610075006E00630068005C007500730011000000483D3800403D38006E00650064005C0030EB000082E34A38E0EA1D0282919D7530EB1D02E4EA1D0227959D75000000009C01D8020CEB1D02CD949D759C01D802B8EB1D0210FDD702E1949D750000000010FDD702B8EB1D0214EB1D02
(PID) Process:(3832) nvda_noUIAccess.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3832) nvda_noUIAccess.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1400) nvda_slave.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVDA
Operation:writeName:DisplayName
Value:
NVDA
(PID) Process:(1400) nvda_slave.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVDA
Operation:writeName:DisplayVersion
Value:
2020.2
(PID) Process:(1400) nvda_slave.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVDA
Operation:writeName:DisplayIcon
Value:
C:\Program Files\NVDA\images\nvda.ico
Executable files
197
Suspicious files
82
Text files
1 847
Unknown types
347

Dropped files

PID
Process
Filename
Type
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\Banner.dllexecutable
MD5:—
SHA256:—
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\API-MS-Win-core-xstate-l2-1-0.dllexecutable
MD5:9E683825EAE3B6375CBD63623196BE96
SHA256:CBD3FEF707ABF622B150DB1D10B5443264EB6DA8F4D7AA2ADC97C50A22D4D594
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\_ctypes.pydexecutable
MD5:35F7EDF7DD2C9C64CE5D221D1CF9FB4F
SHA256:5E64A2FD884B19F544696F197D1D91B8F205CF91C3824604AD807ED40344FD23
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\System.dllexecutable
MD5:56A321BD011112EC5D8A32B2F6FD3231
SHA256:BB6DF93369B498EAA638B0BCDC4BB89F45E9B02CA12D28BCEDF4629EA7F5E0F1
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:879920C7FA905036856BCB10875121D9
SHA256:7E4CBA620B87189278B5631536CDAD9BFDA6E12ABD8E4EB647CB85369A204FE8
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\VCRUNTIME140.dllexecutable
MD5:2EBF45DA71BD8EF910A7ECE7E4647173
SHA256:CF39E1E81F57F42F4D60ABC1D30ECF7D773E576157AA88BBC1D672BF5AD9BB8B
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:8894176AF3EA65A09AE5CF4C0E6FF50F
SHA256:C64B7C6400E9BACC1A4F1BAED6374BFBCE9A3F8CF20C2D03F81EF18262F89C60
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\MSVCP140.dllexecutable
MD5:71281C025F2CA314BF4EBCAE0F756898
SHA256:8AD3719E14FED26E18F1D33E768A0EA77C30152E30A4ECB6CA97A158C5D33435
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\_bz2.pydexecutable
MD5:8A4C977BAA9BD8C626A949AFE1678963
SHA256:D035C0D3C1815DDC61C343692EB0CB82E8F1ADF4EBEACC680E44B8903219BF27
1064nvda_2020.2.exeC:\Users\admin\AppData\Local\Temp\nsv495B.tmp\app\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:D91BF81CF5178D47D1A588B0DF98EB24
SHA256:F8E3B45FD3E22866006F16A9E73E28B5E357F31F3C275B517692A5F16918B492
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3732
nvda.exe
45.33.21.113:443
www.nvaccess.org
Linode, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
www.nvaccess.org
  • 45.33.21.113
suspicious

Threats

No threats detected
Process
Message
nvda_noUIAccess.exe
C:\PROJECTS\buildbots\win7-py27\dist-win32-py37\Phoenix\ext\wxWidgets\include\wx/msw/private.h(394): 'GetWindowRect' failed with error 0x00000578 (invalid window handle.).
nvda_noUIAccess.exe
C:\PROJECTS\buildbots\win7-py27\dist-win32-py37\Phoenix\ext\wxWidgets\include\wx/msw/private.h(394): 'GetWindowRect' failed with error 0x00000578 (invalid window handle.).
nvda_noUIAccess.exe
C:\PROJECTS\buildbots\win7-py27\dist-win32-py37\Phoenix\ext\wxWidgets\include\wx/msw/private.h(394): 'GetWindowRect' failed with error 0x00000578 (invalid window handle.).
nvda_noUIAccess.exe
..\..\src\msw\window.cpp(1962): 'MoveWindow' failed with error 0x00000578 (invalid window handle.).
nvda_noUIAccess.exe
..\..\src\msw\window.cpp(1962): 'MoveWindow' failed with error 0x00000578 (invalid window handle.).
regedit.exe
REGEDIT: CreateFile failed, GetLastError() = 2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nvda_2020.2.exe