NightLedger Screenshot Capture via AppVShNotify.exe GDI Module Load (Command 36)

Duo Tech@duotech

•updated Jul 28, 2026•1•0•16

Detects the NightLedger backdoor's screenshot capture routine (C2 Command ID 36) executing within its sideloaded/hijacked host process AppVShNotify.exe, evidenced by the process loading the GDI graphics module used to capture the victim desktop. Excludes GDI loads from the legitimate Microsoft Application Virtualization Client installation path to focus on the rogue/hijacked process context.