Edit tour

Windows Analysis Report
DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Overview

General Information

Sample name:	DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
Analysis ID:	1538410
MD5:	dacc5eb0638261f3c44a3f0bd1cc5ea1
SHA1:	bb57e14f1df59b3ad73f388c7a37bd008b57f22f
SHA256:	680614bf60ff1f1f408e8457ff288ca8a22e1939ba5415fe0c9df082b04dd594
Infos:

Detection

Score:	29
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	49
Range:	0 - 100

Signatures

Tries to delay execution (extensive OutputDebugStringW loop)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates processes with suspicious names

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution From GUID Like Folder Names

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe (PID: 1388 cmdline: "C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe" MD5: DACC5EB0638261F3C44A3F0BD1CC5EA1)

additional.exe (PID: 6692 cmdline: "C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\" MD5: 1CFBB324EEB5BB5635F593AABC2CBAB5)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DL6C3C.exe (PID: 6296 cmdline: DL6C3C.exe /exelang 2057 DL_INSTALL_AUDIO=Yes DL_NO_EULA=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{82526EEF-64FA-465A-9900-592AA20D44BD}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6D95.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror0 DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_VMM_FIRMWARE_INCLUDED="No" DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG" MD5: 3A6406BA15C24660FD43A91B81E6AB45)

DL6C3C.exe (PID: 6748 cmdline: "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1 MD5: 3A6406BA15C24660FD43A91B81E6AB45)

msiexec.exe (PID: 4872 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6628 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 94024F9F8BD1D3638DCAEE8B74C7EA90 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6716 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 974BD1C330F60C48087D2F1BF259B4BF C MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3268 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7D931FF378BB0B801383919D978EEAE0 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3652 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 74644EEC4A25804F6BC0B9ED2A06AE76 MD5: E5DA170027542E25EDE42FC54C929077)

taskkill.exe (PID: 4336 cmdline: taskkill.exe /f /im DisplayLinkTrayApp.exe /im DisplayLinkUI.exe /t MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 4736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 3744 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 23A62B8C91BCD058BBC9425B5A3E0538 E Global\MSI0000 MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4984 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3AE1FDA64AA5ECDB06105BC78B949EB3 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

drvinst.exe (PID: 6384 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{073afcc1-74b6-014d-a1ff-5f367b711623}\dlusbaudio.inf" "9" "7d2fb252b" "00000000000000D4" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\DisplayLink Core Software\Drivers" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 4204 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{45f50a8f-b0eb-b54b-a38a-d204d968e6fa}\dlcdcncm.inf" "9" "72d21657f" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\DisplayLink Core Software\Drivers" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe" -basicMode, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 4872, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DisplayLinkTrayApp

Sigma detected: Suspicious Execution From GUID Like Folder Names

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1, CommandLine: "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe, ParentCommandLine: DL6C3C.exe /exelang 2057 DL_INSTALL_AUDIO=Yes DL_NO_EULA=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{82526EEF-64FA-465A-9900-592AA20D44BD}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6D95.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror0 DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_VMM_FIRMWARE_INCLUDED="No" DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG", ParentImage: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe, ParentProcessId: 6296, ParentProcessName: DL6C3C.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1, ProcessId: 6748, ProcessName: DL6C3C.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\AddOnApi64.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\3rd_party_licences.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\dl.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm660.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb4.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio_x64.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\ella-dock-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\firefly-monitor-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\navarro-dock-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\ridge-dock-release.spkg

Creates install or setup log file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\INF\setupapi.app.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\End User Licence Agreement_EN.rtf
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf

PE / OLE file has a valid certificate

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: z:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: x:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: v:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: t:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: r:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: p:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: n:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: l:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: j:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: h:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: f:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: b:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: y:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: w:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: u:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: s:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: q:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: o:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: m:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: k:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: i:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: g:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: e:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: c:
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local

Networking

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

System Summary

Creates driver files

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe

File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\ARM64\dlcdcncm660.sys

Creates files inside the driver directory

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{cece1d3f-e74a-f249-88a0-1b90332bb107}

Creates files inside the system directory

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: C:\Windows\INF\oem0.PNF
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: C:\Windows\INF\oem1.PNF
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: C:\Windows\INF\oem3.PNF
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\44e40c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE62F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE67E.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8D0.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE92F.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE99E.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE9CD.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEA2C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEA8B.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEAF9.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB39.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB69.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB89.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEBA9.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF06.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF26.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF75.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFA15.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFA64.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFAB3.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFB50.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFBBF.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC4C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC9B.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD87.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFDB7.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEC1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI26C.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI328.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI377.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\controlPanelIcon.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BA.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI60A.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI639.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF7.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB538.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\INF\setupapi.app.log
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\dlusbaudio.inf_amd64_a428131a0367c25a
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE62F.tmp

PE file contains executable resources (Code or Archives)

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Resource name: EXE type: PE32 executable (console) Intel 80386, for MS Windows
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Resource name: EXE type: Microsoft Cabinet archive data, many, 2407 bytes, 3 files, at 0x44 +A "AddProduct.reg" +A "ImportSettings.reg", flags 0x4, ID 4937, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression

Uses 32bit PE files

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus29.evad.winEXE@26/93@1/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\DisplayLink Core Software

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DisplayLinkSetupPrevInstanceDetector

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

File created: C:\Users\user\AppData\Local\Temp\DLSD610.log

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe

File read: C:\Windows\win.ini

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe "C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe"
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe "C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\"
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe "C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\"
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe DL6C3C.exe /exelang 2057 DL_INSTALL_AUDIO=Yes DL_NO_EULA=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{82526EEF-64FA-465A-9900-592AA20D44BD}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6D95.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror0 DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_VMM_FIRMWARE_INCLUDED="No" DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 94024F9F8BD1D3638DCAEE8B74C7EA90 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 974BD1C330F60C48087D2F1BF259B4BF C
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe DL6C3C.exe /exelang 2057 DL_INSTALL_AUDIO=Yes DL_NO_EULA=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{82526EEF-64FA-465A-9900-592AA20D44BD}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6D95.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror0 DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_VMM_FIRMWARE_INCLUDED="No" DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 94024F9F8BD1D3638DCAEE8B74C7EA90 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 974BD1C330F60C48087D2F1BF259B4BF C
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D931FF378BB0B801383919D978EEAE0
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 74644EEC4A25804F6BC0B9ED2A06AE76
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /f /im DisplayLinkTrayApp.exe /im DisplayLinkUI.exe /t
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 23A62B8C91BCD058BBC9425B5A3E0538 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3AE1FDA64AA5ECDB06105BC78B949EB3 E Global\MSI0000
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{073afcc1-74b6-014d-a1ff-5f367b711623}\dlusbaudio.inf" "9" "7d2fb252b" "00000000000000D4" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\DisplayLink Core Software\Drivers"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7D931FF378BB0B801383919D978EEAE0
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 74644EEC4A25804F6BC0B9ED2A06AE76
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 23A62B8C91BCD058BBC9425B5A3E0538 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3AE1FDA64AA5ECDB06105BC78B949EB3 E Global\MSI0000
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{45f50a8f-b0eb-b54b-a38a-d204d968e6fa}\dlcdcncm.inf" "9" "72d21657f" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\DisplayLink Core Software\Drivers"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /f /im DisplayLinkTrayApp.exe /im DisplayLinkUI.exe /t

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: devobj.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: spinf.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: devrtl.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: drvstore.dll
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: lpk.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msihnd.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msiso.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: srpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: jscript9.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msimtf.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d2d1.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: jscript.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: lpk.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msihnd.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: tsappcmp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: newdev.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Creates a directory in C:\Program Files

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\AddOnApi64.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\3rd_party_licences.txt
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\dl.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlcdcncm660.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb2.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb3.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlidusb4.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\dlusbaudio_x64.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\ella-dock-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\firefly-monitor-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\navarro-dock-release.spkg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\DisplayLink Core Software\Drivers\ridge-dock-release.spkg

PE / OLE file has a valid certificate

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: certificate valid

PE file has a big code size

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static file information: File size 66460600 > 1048576

PE file has a big raw section

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x151600
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x3da9a00

PE file contains a mix of data directories often seen in goodware

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

PE file contains a valid data directory to section mapping

Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Creates processes with suspicious names

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: \displaylink usb graphics software for windows11.5 m1-exe.exe
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: \displaylink usb graphics software for windows11.5 m1-exe.exe
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: \displaylink usb graphics software for windows11.5 m1-exe.exe
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: \displaylink usb graphics software for windows11.5 m1-exe.exe

Drops PE files

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\cl_5963.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF75.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\FileOperations.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkDriverSwapService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\shi8D41.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9096.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\DisplayLink Core Software\AddOnApi64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\decoder.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm660.sys	Jump to dropped file
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC9B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tempFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkHotDeskService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb3.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEF75.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC9B.tmp			Jump to dropped file

Creates install or setup log file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\INF\setupapi.app.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File created: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\End User Licence Agreement_EN.rtf
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf

Boot Survival

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DisplayLinkTrayApp
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DisplayLinkTrayApp

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Section loaded: OutputDebugStringW count: 322
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: OutputDebugStringW count: 871
Source: C:\Windows\System32\msiexec.exe	Section loaded: OutputDebugStringW count: 488

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 7390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 8270000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 8340000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 8990000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 79D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 88D0000 memory commit \| memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Memory allocated: 79F0000 memory commit \| memory reserve \| memory write watch

Found dropped PE file which has not been started or loaded

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cl_5963.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIEF75.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\FileOperations.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkDriverSwapService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi8D41.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9096.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\DisplayLink Core Software\AddOnApi64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\decoder.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm660.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFC9B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tempFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkHotDeskService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD} FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	File opened: C:\Users\user\AppData\Local

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe

Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe "C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe" /i C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi /lv C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG AI_EUIMSI=1 APPDIR="C:\Program Files\DisplayLink Core Software" M_DIR="C:\ProgramData\Microsoft" SECONDSEQUENCE="1" CLIENTPROCESSID="6296" AI_MORE_CMD_LINE=1

Uses taskkill to terminate processes

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\taskkill.exe taskkill.exe /f /im DisplayLinkTrayApp.exe /im DisplayLinkUI.exe /t

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe dl6c3c.exe /exelang 2057 dl_install_audio=yes dl_no_eula=yes dl_promote_store_app=yes dl_product_name="displaylink graphics" dl_branding_upgrade_code="{78a36acd-80d5-490f-b4c4-83d7fcc08391}" dl_branding_product_code="{82526eef-64fa-465a-9900-592aa20d44bd}" dl_branding_cab="c:\users\user\appdata\local\temp\dl2.tmp\dl6d95.tmp" dl_branding_new_device_activity=mirror0 dl_id_usbdriver_path="c:\users\user\appdata\local\temp\dl2.tmp\dlidusb\x64" dl_hotdesk_service="no" dl_install_analytics=yes dl_vmm_firmware_included="no" dl_temp_dir="c:\users\user\appdata\local\temp\dl2.tmp\" /lv "c:\users\user\appdata\local\temp\dlc6cde.log"
Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe dl6c3c.exe /exelang 2057 dl_install_audio=yes dl_no_eula=yes dl_promote_store_app=yes dl_product_name="displaylink graphics" dl_branding_upgrade_code="{78a36acd-80d5-490f-b4c4-83d7fcc08391}" dl_branding_product_code="{82526eef-64fa-465a-9900-592aa20d44bd}" dl_branding_cab="c:\users\user\appdata\local\temp\dl2.tmp\dl6d95.tmp" dl_branding_new_device_activity=mirror0 dl_id_usbdriver_path="c:\users\user\appdata\local\temp\dl2.tmp\dlidusb\x64" dl_hotdesk_service="no" dl_install_analytics=yes dl_vmm_firmware_included="no" dl_temp_dir="c:\users\user\appdata\local\temp\dl2.tmp\" /lv "c:\users\user\appdata\local\temp\dlc6cde.log"
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe "c:\users\user\appdata\local\temp\dl2.tmp\dl6c3c.exe" /i c:\users\user\appdata\local\temp\{34cd39a3-d094-47b4-86f9-5bc6461cc0ad}\61cc0ad\displaylinkidd.msi /lv c:\users\user\appdata\local\temp\dlc6cde.log ai_euimsi=1 appdir="c:\program files\displaylink core software" m_dir="c:\programdata\microsoft" secondsequence="1" clientprocessid="6296" ai_more_cmd_line=1
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe "c:\users\user\appdata\local\temp\dl2.tmp\dl6c3c.exe" /i c:\users\user\appdata\local\temp\{34cd39a3-d094-47b4-86f9-5bc6461cc0ad}\61cc0ad\displaylinkidd.msi /lv c:\users\user\appdata\local\temp\dlc6cde.log ai_euimsi=1 appdir="c:\program files\displaylink core software" m_dir="c:\programdata\microsoft" secondsequence="1" clientprocessid="6296" ai_more_cmd_line=1

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackground.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackground.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackground.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlProgress.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{cece1d3f-e74a-f249-88a0-1b90332bb107}\dlusbaudio.cat VolumeInformation

Source: C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	32 Masquerading	OS Credential Dumping	111 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	111 Virtualization/Sandbox Evasion	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	0%	ReversingLabs
DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm660.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm660.sys	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb2.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb4.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb4.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\FileOperations.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\lzmaextractor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tempFiles.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI9096.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\cl_5963.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi8D41.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\decoder.dll	0%	ReversingLabs
C:\Program Files\DisplayLink Core Software\AddOnApi64.dll	0%	ReversingLabs
C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe	0%	ReversingLabs
C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkDriverSwapService.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkHotDeskService.exe	0%	ReversingLabs
C:\Windows\Installer\MSIEF75.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFC9B.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538410
Start date and time:	2024-10-21 08:51:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
Detection:	SUS
Classification:	sus29.evad.winEXE@26/93@1/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb3.dll

Created / dropped Files

C:\Config.Msi\44e40d.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11108705
Entropy (8bit):	6.4342482001436085
Encrypted:	false
SSDEEP:
MD5:	CCDA91CF3D8248F50C0961750E796126
SHA1:	81262FFC0269602896F28116B4A08E200EFF589C
SHA-256:	1232BBBEDFA512230E2C287B7B3388518EDF1C29AA9353DE74B3FAC2B6850473
SHA-512:	49ACEA26EFCCE7AB1464E154A2B2CBA849E667DAA583C719532393B8B6B60FB79022407C12DB63A70F7C7606DE76A7A570CEC315AF0C28017930EC1629E05EF0
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@..UY.@.....@.....@.....@.....@.....@......&.{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}..DisplayLink Graphics..DisplayLinkIDD.msi.@.....@K....@.....@......controlPanelIcon.exe..&.{58E52469-F55E-445A-A4F9-A0EE0C20EE2E}.....@.....@.....@.....@.......@.....@.....@.......@......DisplayLink Graphics......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ClearStoredProperties....AI_RemoveAllTempFilesL...AI_RemoveAllTempFiles.@.......-..MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........y.L..VL..VL..V...WA..V...W..V...WZ..V,..W]..V,..W[..V,..W...V...WN..V...WC..VL..V..V(..W\..V(..WM..V(..VM..VL..VM..V(..WM..VRichL..V........................PE..L...\|..b.........."!... ............N........................................@......\.....@.................................x...<........................#... ..........p...........................8...@.........................

C:\Program Files\DisplayLink Core Software\AddOnApi64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1721272
Entropy (8bit):	6.506365658346394
Encrypted:	false
SSDEEP:
MD5:	66DA70C6F085218FA73381491F36DA9D
SHA1:	3DBA8DA1F2FBF16BF22731E168A3B18C6711BACA
SHA-256:	A0CE846B7ABC16396AF2D78C6635B8B99B69DDE62685D39BA1EAAB8C01AED705
SHA-512:	6DEC3031869C60AA12C07372D3A34C031A82227F5A28910D6A60E872BE9A8057A614DC507A5705735AA8EFDF3CDA8DB1D3B2929997C515E98BC12F3CDB637944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........#...B...B...B......B.....?B..)/...B..)/...B..)/..jB......B..`,...B......B...B...C..`,...B..`,...B..`,...B..`,N..B..`,...B..Rich.B..........................PE..d...(..f.........." .................................................................y....`....................................................................L........).......,...[..p....................]..(....\..................X............................text............................... ..`.rdata...".......$..................@..@.data............>..................@....pdata..L...........................@..@_RDATA.......p......................@..@.rsrc...............................@..@.reloc...,..........................@..B........................................................................................................................................................................

C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6122424
Entropy (8bit):	4.399015877632032
Encrypted:	false
SSDEEP:
MD5:	EBDF3036F2884BB8F28A1FF8DF0FF3DD
SHA1:	C04341D98196DFB9A016E882B08A59197BD909FD
SHA-256:	33BFF0F8456CB75034A60C21DA647B05149BCD078602E244B9F51E0C70C37B54
SHA-512:	984577BFAB324E40233431427298F60E4CA1AE74656F3E229A091CB0AB1D5DA7D77EDC7B3A6BBC0D88D45A8C6FBEB2CA0C340F22B94A0444B69AACDB9D993A40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........=i..S:..S:..S:..P;..S:..V;2.S:".W;..S:".P;..S:".V;j.S:..W;..S:k.W;..S:k.V;..S:..R;..S:..R:).S:k.Z;..S:k..:..S:...:..S:k.Q;..S:Rich..S:........................PE..d...>..f.........."......N...TM......X.........@..............................].....Q.]...`.........................................................P...eF..p.......B]..)....]..%..@...p.......................(....5...............`......<}..@....................text...\M.......N.................. ..`.rdata..tF...`...H...R..............@..@.data...$........P..................@....pdata.......p......................@..@_RDATA.......@......................@..@.rsrc....eF..P...fF.................@..@.reloc...%....]..&....].............@..B........................................................................................................................................................................

C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	56067
Entropy (8bit):	5.16422043734917
Encrypted:	false
SSDEEP:
MD5:	41C47062484445C291D260D320E7CD39
SHA1:	587DEDAC7636744330FDF60026968A30F4C084B9
SHA-256:	ECDCEA167DC5EDDE79816EFA4FAAB03F5BAC8229225468258689A151B61CFCD1
SHA-512:	7919D89CD8632E525A3844335471C95CE879E3325D7DB7B145F104A6D3F19598844F140AB8D4EB580ED6882354494D39FE434F7B30005DBE890231C4512DA262
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang2057\deflangfe2057\themelang2057\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}userbri;}{\f39\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}@MS Mincho;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\f

C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	909752
Entropy (8bit):	6.462819696596566
Encrypted:	false
SSDEEP:
MD5:	DEA24FDA43B7B4B71A2200979EE152C4
SHA1:	516E2ABB86FCD81646A4BCBF5B479FB1803B6B07
SHA-256:	89B0123D3D85252D17A615EDBD7E4284D3A5A3042372630131586EA584750B7D
SHA-512:	31A27F6FE4A3566C9FAB722604AFDC0C3D79320309AFC5CD05B33919535BE6228B903A19181786B190DBDD07D7EBFCB321E388777CF2A28A144271810D6F31FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......hsS.,.=.,.=.,.=.wz>. .=.wz8...=...9.=.=...>.%.=...8...=.wz9.:.=..\|9...=..\|8.u.=.wz<.;.=.,.<...=..\|4.-.=..\|..-.=.,...-.=..\|?.-.=.Rich,.=.........................PE..d..."..f.........."..................o.........@.............................P......*.....`.......................................................... ..........\\|.......)...0..........p...................8...(...0................0...............................text............................... ..`.rdata..&....0......................@..@.data...8........6..................@....pdata..\\|.......~..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\FileOperations.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	479176
Entropy (8bit):	6.579492288216804
Encrypted:	false
SSDEEP:
MD5:	17D3E07283643D9621648D3CCAB4F8C8
SHA1:	BE59D0E5F1DC92AA3B7D52F6EA3D9370BD6EB3D5
SHA-256:	ADE92C12D1386228EC71C706FBCF545750308E3EAF34D3203FB8E68B99382DA7
SHA-512:	31BC09F9504F86F58519DC205CBF808190926883A0ADD70F4740B67C0CF03A385D0FCD8011191BC68C53FFAF55434917F24AE0AA61C62C7FD32C1EBB44B12976
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......B..(...{...{...{..z...{..z...{..z...{f.z...{f.z...{f.zI..{d.z...{b.z...{b.z...{..z...{...{,..{b.z0..{b.z...{b.X{...{..0{...{b.z...{Rich...{........................PE..L...N..b.........."!... ............e........0...............................p............@.............................D............................,...#... ...A..XO..p....................P.......N..@............0...............................text...O........................... ..`.rdata.......0....... ..............@..@.data...,...........................@....rsrc...............................@..@.reloc...A... ...B..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\New

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.034441580055181
Encrypted:	false
SSDEEP:
MD5:	C23CBF002D82192481B61ED7EC0890F4
SHA1:	DD373901C73760CA36907FF04691F5504FF00ABE
SHA-256:	4F92E804A11453382EBFF7FB0958879BAE88FE3366306911DEC9D811CD306EED
SHA-512:	5CC5AD0AE9F8808DEA013881E1661824BE94FB89736C3CB31221E85BE1F3A408D6E5951ACCD40EE34B3BAF76D8E9DD8820D61A26345C00CDDC0A884375EE1185
Malicious:	false
Reputation:	unknown
Preview:	..............(.......(....... ...........................................................................................................................................................................................................................................................................}..................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\Up

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.0369361465218003
Encrypted:	false
SSDEEP:
MD5:	83730AC00391FB0F02F56FE2E4207A10
SHA1:	139FED8F0216132450E66BDA0FBBDC2A5BD333AF
SHA-256:	573E3260EED63604F24F6F10CE5294E25E22FDA9E5BFD9010134DE6E684BAB98
SHA-512:	E3DBE1956BB743FD68319517D1D993DDA316C12BBBBBBD6F582ECDD60C4FDE24CC4814C7AB36ED571F720349931EAC10B03E9C911BA0F4309B10604B2C56C6A9
Malicious:	false
Reputation:	unknown
Preview:	..............(.......(....... ...............................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\banner.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 59 x 8, 1 compression, image size 2298, resolution 3779 x 3779 px/m, 5 important colors, cbSize 2372, bits offset 74
Category:	dropped
Size (bytes):	2372
Entropy (8bit):	2.6114732592489567
Encrypted:	false
SSDEEP:
MD5:	DAF14D3480C7AA73A53415FF483B10A1
SHA1:	DB240A22410AC7536F5C833CA98322CCA4180C3D
SHA-256:	0D2715E6689EA0CCCC6CDFAD328DAB66F61DF466FBBAF043CEF2D05F9AD420C4
SHA-512:	7741A04025317179EAF14F7843F313F0E8922FD219C1D45DB91E65E58229A1C948FB12120806507162D064B03DD4A45A8380210545A8A61910E622F0B3C736C7
Malicious:	false
Reputation:	unknown
Preview:	BMD.......J...(.......;............................................................................................1...........................................................1...........................................................1..............................................................-..............1..............................................................-..............1..............................................................-..............1..............................................................-..............1..............................................................-................................................................................................................................................................................................................1...................................................................................................1................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\cmdlinkarrow

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Reputation:	unknown
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\completi

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.359062242965858
Encrypted:	false
SSDEEP:
MD5:	45B0E074F96A859ADAE198187AB9FA11
SHA1:	AB89AD71FC239D10C71476E42CDB66B080D75BED
SHA-256:	050282E679AC80F6A357FFF92F1E7A95D30A06B35247E25CBFD2DD8CEEE1A412
SHA-512:	5B0A2ABAED2E285E8F0D25148C03A05F090FF8FB69D9A178DA21B779427ED138AB16876163500D266123B036C23F3AC56DCDE8D4D103B37102B4FC46A2B04520
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................................w................{..................p..........x.{.wp............{.w..........xxx...................w.........w~...xx.........~......www......z..xx...w..............w..........p...........................w......p.........wwwwwx...............x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x.......................................................?.........................................................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\custicon

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.298568796986908
Encrypted:	false
SSDEEP:
MD5:	3EAEBDADE778394F06B29659C9C01ED7
SHA1:	3E2A80761C8A44E509C4E06D275BFB25E704DDB0
SHA-256:	719E644C31D0CC6B891F6A1253655DFBA39A3B78E06D24817BE1D8492B172B48
SHA-512:	14628B5C737045B9916AF5F3ECC9343EF6349C9988F45D1E93846CD79FD38A20F9E7922EC2E6A846CCF14F02AAC84E518279548E8BC9B29AAA3EE553D7A74F59
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................................w................{..................p..........x.{.wp............{.w..........xxx...................w.........w~...xx.........~......www......z..xx...w..............w..........p...........................w......p.........wwwwwx...............x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x.......................................................?.........................................................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialog.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 316 x 8, 1 compression, image size 36830, resolution 3779 x 3779 px/m, 5 important colors, cbSize 36904, bits offset 74
Category:	dropped
Size (bytes):	36904
Entropy (8bit):	1.6592122603583341
Encrypted:	false
SSDEEP:
MD5:	ABF1076064505DEE794FA7AED67252B8
SHA1:	358D4E501BB3007FEECE82A4039CC1050F23FAB4
SHA-256:	FB0D133F05DE6AA6A7A3491AE532191A60C438B35D9FF7BFEC9E63131F6F0C73
SHA-512:	9A4680A8D186C1D7550B5E03CBDD095B0C88B2E0249A3AF75FA0253D2C9A6F0AA1DD570ECF1A273683A14E6C7B5FB11678BE3DA439A3BF23EAB790372E96E321
Malicious:	false
Reputation:	unknown
Preview:	BM(.......J...(.......<..................................................N..U........................................................................................R...S..P..................................................................................R...V..M................................................................................R...[..H..........................................................................R...^..E........................................................................R...a..B....................................................................R...f..=................................................................R...i..:............................................................R...l..7..........................................................R...o..4......................................................R...r..1....................................................R...u...................................................R.......................g..+......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackground.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 10 x 24, image size 320, resolution 3780 x 3780 px/m, cbSize 374, bits offset 54
Category:	dropped
Size (bytes):	374
Entropy (8bit):	1.0090244268172435
Encrypted:	false
SSDEEP:
MD5:	3200BCB62A21A451EF63623CCE0C2B29
SHA1:	02AC159F40618D9FE96FB5B1F8E7675805F1CCD8
SHA-256:	0E63FCA0804774EA90B96C096EA9678DEB3DD0B864EFD3B57659B447FE890C05
SHA-512:	68589D3672412C99C54984A25A7B4DC16789361ECD03F9644C2E1C00BA5F2B68A73B67A002EF3A5AC71BCC00945DFBB1F56C319B98CACCF10EF0E8B8F1F163F0
Malicious:	false
Reputation:	unknown
Preview:	BMv.......6...(...................@...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 10 x 24, image size 320, resolution 3780 x 3780 px/m, cbSize 374, bits offset 54
Category:	dropped
Size (bytes):	374
Entropy (8bit):	1.7456253632245882
Encrypted:	false
SSDEEP:
MD5:	2068072848BB0F9AEE0C0C53755A86E0
SHA1:	0741B94EFD729AB0E71C4B5613D9856D9425B93F
SHA-256:	0DD79BDE0B2D581E1BCC10F40A5D09BF2A833FFF25A05CC92150AEB4B11F42B7
SHA-512:	A210BF3DDCD3A795091EA1AE01C461F249AB1642E46F16D7BA094F5F106B900BA2037CECE6CF4E8159F34A8F6B6CE1094FDFF781AEC1C05ADE8E89420DC7957C
Malicious:	false
Reputation:	unknown
Preview:	BMv.......6...(...................@...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 1176 x 46 x 24, image size 162288, resolution 3779 x 3779 px/m, cbSize 162342, bits offset 54
Category:	dropped
Size (bytes):	162342
Entropy (8bit):	1.9726207922214154
Encrypted:	false
SSDEEP:
MD5:	7D2A780A05F478EF4044C7AAB4EEBD42
SHA1:	BAB3342FD98115ABDD035E63982DC4DFD98DFD82
SHA-256:	DED57492AB39F46D51C9009BC65B8B4E3554DC27285BAAB60E0B9FC079505FE1
SHA-512:	9D548B3307F3D6439B178F9CA81014FF2044611AB67AAE189AA6E01229914D949A427BEE7EB4A778DE6217955E8566EB38D54EAF298A2851E22A1BFFB603F92A
Malicious:	false
Reputation:	unknown
Preview:	BM&z......6...(....................y...................z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlProgress.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PNG image data, 121 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.214905302136987
Encrypted:	false
SSDEEP:
MD5:	76027E9C26C1097039E21726D822A12F
SHA1:	D5B4135A211E02BD52EC7F640CD796F97F62F077
SHA-256:	7DA30EFB432B8D156BC06E0834F0E4A9FFA90A858A91F6D62E4AED6E497ACDD6
SHA-512:	FDACF15B470406C177BD234F70EA7EFCB8CD61A230F6D40766E6E4BDD11D8F6A66A797560CDE6CD2745F0C3C4D20E6AC93356F2FC744620C309EFA5C03C34383
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...y.........2.......gAMA......a.....sRGB.........pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<...cIDATXG..... .@..^N.........I....I...6.....w.z...\|./r_.j.\#..W......F.02.....`d.#.......(.<5..q..4#.c.$....IEND.B`.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\exclamic

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Category:	dropped
Size (bytes):	766
Entropy (8bit):	3.3484862648999827
Encrypted:	false
SSDEEP:
MD5:	3DBA38E7A6085876E79F162F9985618C
SHA1:	F89B4B20EB5379BA139BBED4FCB4246C7707A8A8
SHA-256:	593F94EF1405422B3E453F4422B22C990D84303668D60344C6FD257318E92428
SHA-512:	E8F1EAC1A9009C06DDD1CF99F876819B57B4D2798D02F93465487DD2FFFE3A4239F171FFB02D98DCA358BC47420205A2CC0877ABC02C6B21269C3D07EC78A836
Malicious:	false
Reputation:	unknown
Preview:	...... ..............(... ...@...............................................................................................331............332333333333333.33$DDDDDDDDDDD@1.2DDDDDDDDDDDDD..2DDDDDD@DDDDDDC.2DDDDDD34DDDDDC.2DDDDD@30DDDDD..3$DDDDD34DDDDD1.3$DDDDD@DDDDD@1332DDDDDDDDDDDC.332DDDDDCDDDDD..333$DDDD..DDDD1.333$DDDD#$DDD@133332DDDD34DDDC.33332DDD@30DDD..33333$DDB32DDD1.33333$DDC33DD@13333332DDC33DDC.3333332DDC33DD..3333333$DC33DD1.3333333$DC33D@1333333332D@30DC.333333332DDDDD..333333333$DDDD1.333333333$DDD@133333333332DDDC.33333333332DDD..33333333333$DD1.33333333333$D@13333333333332D..3333333333333"#33333333333333333333333...................................................................?...?........................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\info

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	2.8642269548572474
Encrypted:	false
SSDEEP:
MD5:	554FF4C199562515D758C9ABFF5C2943
SHA1:	9E3BAB3A975E638EAD9E03731AE82FA1DBCD178C
SHA-256:	9AE4A96BF2A349667E844ACC1E2AC4F89361A6182268438F4D063DF3A6FC47BC
SHA-512:	E302EDF3DAB3A0E9EEB5AFA34E4910EE177099C017B42F86847CF972143C87E8C40BC47689A3C8845051EAB98258A392CCAF331F414C271A1B6B751F503CE221
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&...........(.......(... ...@.........................................................................................................p..............wp...............p...............p...............p...............p..........ww...ww........wp....www..............wwp..............ww...............wp..............ww...............wp..............wp...............w...............wx..............w...............w...............w...............w...............w...............px..............p............................................................................................p......w.......w........wx....w...........wwwp.....................................?...............................................................................?................(....... .............................................................................................................................p.......w..x.....p.......p.......w.................................................w

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\insticon

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.4065352120502395
Encrypted:	false
SSDEEP:
MD5:	66C842AF0B4FC1C918F531D2E1087B82
SHA1:	CEB74A196559DB607824FDDC51D1243E1DEE491C
SHA-256:	48278165490487EE414BE65E20501B19A65EDAF1B6F473EB7D8C55023175EC88
SHA-512:	F7DE9BA9107DBB6C71B4F585EA54B571F469CF2815A3AB0DB2A408BA3ED794A5F0C21A987CBF5AE93197B7E5B6BFE3E78A75C2B56B5BA836C236B31563A7C560
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&... ..............(... ...@.......................................................................................................................{...............w..........p..x....w........x...w..w.......p..xx..w~........x.....~........p..xx....p.......x.w............p...z..xxp.......x................z....x........xx......ww.....ww..w....w.....ww...wp...w.....ww..............ww..............ww.........p.....w.wwwwwwwx......w........x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x..........................p... .........?...?...?...?...?...?....................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\lzmaextractor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16328
Entropy (8bit):	6.530762223829305
Encrypted:	false
SSDEEP:
MD5:	F1F56D26D0244DC52C1932C72BC27D7C
SHA1:	58D42600E3B54227DF0A2C600D8783C1B7B282B0
SHA-256:	43E55A6CBE1AB609A23BA1A462BC688FB1CD4CDD5E6EDFB79031FA8F502E6DDC
SHA-512:	B94D886136016A832663D7F423D6CA9ABB4C1342930CE46B6B8F319AF7C96350C4DB421C79254EEF4A8431831F5CABE758E7C8B3E5FD36A6CE93405AC8334012
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.t9z..jz..jz..j...ku..jz..jJ..j...k...j...k{..j...j{..jz.j{..j...k{..jRichz..j........................PE..L...x..b.........."!... ............@........ ...............................`............@.........................P".......$.......@..h................#...P..\....!..p............................................ ..X............................text...)........................... ..`.rdata..X.... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..\....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 2000 x 180 x 24, resolution 3780 x 3780 px/m, cbSize 1080054, bits offset 54
Category:	dropped
Size (bytes):	1080054
Entropy (8bit):	0.8657325879428006
Encrypted:	false
SSDEEP:
MD5:	FCC599B9CC44A38DBC6F1635461AB647
SHA1:	D488EF3795A29B3F0998B06C949276DB92D5BF3B
SHA-256:	83C9326DE5A0B3F34524D57985C9624741B387B6417FCCFC1EC8FA51645004B4
SHA-512:	B6D643B6469C130722CE2FF37002F6F02B51B61FEB08FD057579FBAFB951DC2EE2EE69C2D6854029E51A41715CD08967B5D9D018067EAB3657221C5A14BAC15E
Malicious:	false
Reputation:	unknown
Preview:	BM.z......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 115 x 115 x 24, image size 40020, resolution 3780 x 3780 px/m, cbSize 40074, bits offset 54
Category:	dropped
Size (bytes):	40074
Entropy (8bit):	1.434815195894921
Encrypted:	false
SSDEEP:
MD5:	673F64A2575B5CD12A940117B1840EFA
SHA1:	8E4AC98E120CD96C675FA6E14D1CE47E7FE93CD8
SHA-256:	3596760E94D6A751DC03BF528DFF5E2852E17B38BBC95CFBA6699BC8D2F557CA
SHA-512:	F6EC6F075FEC9E6B4E93B42301E8DB075685E97B8514E2664BA5FE862CFFC77B70FC5A2C69E2DF3341496F0E975E8B5509A0F5AA5B4A7766AD01A18864117AC9
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...s...s...........T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.396867070981835
Encrypted:	false
SSDEEP:
MD5:	948D7421704967E5CF99A84E405CEBB8
SHA1:	0F227A99C74A30AB294A9BB9367F2B0884780F35
SHA-256:	311C77E1FC78FDD63A885E0DCCDA015B01666DF94CC071056BE13D95E370D8A2
SHA-512:	7DD9DB910BD7D149FC9A8AF63C234CC351679DD9D0E16B5326921EBE7C145005CEB5A57836E28E595013B0B6EB7B0325C64588C348762DFE85325054B7C71A57
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 24.7 24.8" enable-background="new 0 0 24.7 24.8" xml:space="preserve">..<g>...<path fill="#007AC2" d="M12.3,2.6c5.5,0,10,4.5,10,10s-4.5,10-10,10s-10-4.5-10-10S6.8,2.6,12.3,2.6 M12.3,0.9....C5.9,0.9,0.7,6.1,0.7,12.5s5.2,11.7,11.7,11.7S24,19,24,12.5S18.8,0.9,12.3,0.9L12.3,0.9z"/>..</g>..</svg>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PNG image data, 115 x 115, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2521
Entropy (8bit):	7.864107382063005
Encrypted:	false
SSDEEP:
MD5:	DE200D796FDBF0B5B731C7600BFAEC45
SHA1:	0108D89035F5D31D00920FBC19D5E6CE719927B4
SHA-256:	E57FFE806D2B90411309128AAED5FE991ABAFA01225FA20BF43F04CC05D9579E
SHA-512:	D6454615DF6D53B9ACA025B7AD127797F6E1D4458EAC3EFC8D039BB3E106DD173123980548F87D318B0E9E9B1499E00A30E95E8316992BB6E25DDC82C63BA764
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...s...s......C=.....sBIT....\|.d.....sRGB.........gAMA......a.....pHYs...t...t..f.x....tEXtSoftware.www.inkscape.org..<....9IDATx^.yL....?s,,..........U..c...)JI\|4..r.(J..Q.Tn..j+.j........q.JNd...J..)ubS7.....9b.c`Yl`Yn..M.I.vg.......V;.-..~..k..?. ,A..',...$.B.L.......Yh.N@.g.n...!?..f`jn.&f.a\|z.f...b.W@.-..Q.....I.P.J`/;...P..q...;a!.ot.......Qh`._...acN"l.w.......l.....4...x.........&&..,.....jo..5?..9.....C...].<7..,p..&..k...h3c..m...'.p....9.k.2.b`.:......v.k.B......$~.~...I.=..(N._.^...y.9....98z..N\..Y..^.YM}zK6..'....2....b...q.t..3.)M...._ u.V.Pa.L.^.z.....<.ZT....U.!+...Cd.i..g...i.cMV9mp....T...c.U...<..I\|..~...<.-.^\|.P.q2..dz.g.`].\|.~..D.......e.J0nl..L.7>z.....yNd.!+..k......Y....6[......88}....&.....B.....=..J......m..<G....W.(....n.fx.....X8sp..5THw...8.8.L"..ol..Z....^h..}w.......!E......h...}...dN.q...j.f.~.6.......V..;!D.I./...>.i.u.p......._.8T......x.P.K....x..........)B-8....w.R,.[z..KcI.`.>...J.X..+.p.u...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.363748752888614
Encrypted:	false
SSDEEP:
MD5:	48F047E09A16B0C9897F641C69E16C91
SHA1:	BF4C4471F899E45C1FD18EEC2B959A4E5EE3A158
SHA-256:	1B94FF2A3BCB540A2ADD62A8ADE0F4BE9EFF525D20AB4AB5A12A82EC9B28FC84
SHA-512:	761C848C9CC28663ECDEEB4E72F0A87655CBE1708C5B2A34075EA07C632C45B06ABB60CCDD6BF638581A2D571700583F6C3FDDB2FE62CED9BF58047858EC8634
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 24.7 24.8" enable-background="new 0 0 24.7 24.8" xml:space="preserve">..<g>...<circle fill="#007AC2" cx="12.4" cy="12.5" r="11.7"/>..</g>..</svg>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioError.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PNG image data, 115 x 115, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3233
Entropy (8bit):	7.878303376957383
Encrypted:	false
SSDEEP:
MD5:	0EF26DD960994F218886FCFB97433CD9
SHA1:	B4A5B7A5CBA921C350CD0F3377CA05244C2A3578
SHA-256:	4EA2725625BCEEB0C716F7A3B1E38974D93830C762268A66CF032981ED3F43EF
SHA-512:	DD891A904449A08240DBB68B13E03E8CEFC899EBD325ABB111AA280157A16E4BAE298574158D53FA3688E141209FD93B8B1132BACF769D3105DA721B0D7A434E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...s...s......C=.....sBIT....\|.d.....sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....IDATx^..pT.....M6fs..........tF....8... b..P..T........E9.....D.H.:.W.......p%!.d.6...........w....d...d......{......A..^-..Kf.a..",.A.).@-...).oa!x.WOa.4WTB...-...r.&@cS./...-2.l........I...d~zBx...-&..wM.)d6]...'.}.$......../.................saX..s..W^...8..R.j..G.D...1S'3..~...C.l....D..QT_.....'...I. .S.E..!dz.~...o@.....b.E.EHX.#t<$,...^=)j,t.y..g..ko@../.+..l6..9.:....../....2[..j.*........"$4....9.....V&s....A.W......&4).....b.Lf.f.E.A3.x{Q...p.o_R$...9...}...M...h".n.'P....z.fl....!z.X.h..2[o.....[.{...OA.....6.&....\.>..N...E....e.V.wL....".../M..../Q..$,.+.....T.^...NC...y.Hc.E(.9..N}M.uQ.d.C..S....z.X .0J..."....:(&..Spq..l...n...u_.D..G..QD&>./{l<..\.....!..>..8..E.e.-..{a44..S....W.v...uM..r.j.......D....U.......H..%.bq.x.~C9......2g).C.LW.n..p;.,.R...\.{)....3....=.6p.B2.u.~.b...L.}..-....bQ...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioError.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	680
Entropy (8bit):	5.294439036155466
Encrypted:	false
SSDEEP:
MD5:	652982D18C80F264080220232E7C49DA
SHA1:	41C73C4303F53698AD42DB903826AD2529ED7C44
SHA-256:	0F2C0A639FB5B1F7470B9CCE97375FD671BDA36C002A6A1272FFB0E7DF9F4E7F
SHA-512:	7404DF04B6F224A6C5918DB2E53F64323C23A4B8DC8CA3322AF94F31BEBB5C0F7562D512B7AD52E35DFF62990907EC1F44A3B291F857A180578E2C5FBB9A9F5E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 24.7 24.8" enable-background="new 0 0 24.7 24.8" xml:space="preserve">..<g>...<circle fill="#D80F16" cx="12.3" cy="12.4" r="11.7"/>..</g>..<g>...<line fill="none" stroke="#FFFFFF" stroke-width="1.7008" stroke-miterlimit="10" x1="8.1" y1="16.6" x2="16.5" y2="8.2"/>...<line fill="none" stroke="#FFFFFF" stroke-width="1.7008" stroke-miterlimit="10" x1="16.5" y1="16.6" x2="8.1" y2="8.2"/>..</g>..</svg>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 115 x 115 x 24, image size 40020, cbSize 40074, bits offset 54
Category:	dropped
Size (bytes):	40074
Entropy (8bit):	1.2683920260243833
Encrypted:	false
SSDEEP:
MD5:	43824AB2C94B0A12EF747DA1DB2B0489
SHA1:	231E497C235DCD86E04AB586A88627A05A37920F
SHA-256:	5E73558FBA12F062107E9AB9CB70D2C138FC4635738C13978DAAA73D2424BF1B
SHA-512:	0BEC55B7264939E37BCC4B36E718A4296A44B290ED2D3A934EDDE4AC503DCAF0F327ED9F77C2C1413504CA4455FE2B7CA04252644F06D4CD1335234926A6F934
Malicious:	false
Reputation:	unknown
Preview:	BM........6...(...s...s...........T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.407996945106585
Encrypted:	false
SSDEEP:
MD5:	7F1CDB56A065D97065A2FBC889C02D81
SHA1:	2C4592F6309606DA564DB541CC0F552900C08498
SHA-256:	2BBCDB97F2192F09D96FE42B181DBF544FE24B53BB93D45CB23E28DD963257A7
SHA-512:	1D44B21E132BA0287383371D3D9C8A6A3D474E6D70EFFA71D9788857E7B9962015D52AEF5D42F61E0EBABC293309A215FFB14BEF9E2EB2FBC92210868E236A7B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 24.7 24.8" enable-background="new 0 0 24.7 24.8" xml:space="preserve">..<g>...<path fill="#D8D9D9" d="M12.3,2.5c5.5,0,10,4.5,10,10s-4.5,10-10,10s-10-4.5-10-10S6.8,2.5,12.3,2.5 M12.3,0.7....C5.9,0.7,0.7,6,0.7,12.4s5.2,11.7,11.7,11.7S24,18.9,24,12.4S18.8,0.7,12.3,0.7L12.3,0.7z"/>..</g>..</svg>..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	GIF image data, version 89a, 115 x 115
Category:	dropped
Size (bytes):	76317
Entropy (8bit):	7.625936445519031
Encrypted:	false
SSDEEP:
MD5:	DA786DA31E7231C7DDABABF3F87B0E2E
SHA1:	A013F2BFF699F3D4CC263F5611DB36115B664ABC
SHA-256:	1029BEFF65A5EC7B3CFB11882ED6F5E9C9DE585EC04F9329039AEA6E56F3C9FD
SHA-512:	830E7FAF8A5B09FCA2794306706CBEBA98B77236DA3FE468DF48D3CCFA38448D73C68DCB636E93964B4D0DCD00256AEFF7605A0B72089A8F8566B80B5775AA5A
Malicious:	false
Reputation:	unknown
Preview:	GIF89as.s....R..k...........q.3..q..b...\|...C...y.#..).........x........{......y...t....K........9....I........B...v..i....Z...\|.3...m.=........y.....r..}.}...l.......".......Y......................~.....~.-...b....]...\|.....t.....e.......;..h...x.....v........v..q......a.........t..............y.......................m."...\.u.....y........x.!.........u.......p....(.. }.....n.....j.P..+...r............B...........m.(...}....Z..U...g...........{...`...i.........q..z..............p.....n....g..p........._.....y..z....i.U........I...w.5..............n.~...........O.......W.........{..e......................................................................................................................................t..t..c........i."\|....g........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\removico

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.922835628524122
Encrypted:	false
SSDEEP:
MD5:	20D25E871A244B94574C47726DE745D6
SHA1:	1FB26622978ECD2D00B107D83C1AD61366452214
SHA-256:	88DD7EE9FA22ECDBDC6B3D47DB83BC3D72360AEB43588E6A9A008B224389CB1C
SHA-512:	AEE04C9BE3C65676ABF2C8E20E9F6A954539C23E9BD4971539D3A86B45C7C85A5E62BAEF0C465345909C602C5B70CD86B7112B3F24ED9DA69EC27D81D59A7F71
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&... ..............(... ...@.......................................................................................................................p.........................w......ww............w.f.w......w.....vvf.w...........nffl.w....w......w\|.w...........g.w.w....w.......g.\|w...........g.w\|w....w.....g...\|w............wwww....w....g..tDDw.........~..w..w....w....~w.w\|.w...........ww..w....w.......ll.w..........~ff.tw....w......vlgtw.....wwwwwwwwwtw....w.....wwwwww.....xD\....wwww.....Gwww....w.w.....e..p;....w......v_....{{..p.....we....g..........v\!0~v{.7.p.........o.g.p8p........{4o.?..............o.8..........0.3F........................?...........................................................................................................?(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\repairic

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.667661526304198
Encrypted:	false
SSDEEP:
MD5:	D234CA0358B21BDCFC5E3F9B2E7C7A22
SHA1:	95356780EA21C43A129FA560365FE5B7A216CC8E
SHA-256:	99D490C2BDEF5115F306A595964663540370141F65A25C5052352155F2603F68
SHA-512:	AE47D796C758E53FC7AA183CD8754EE382ED19A6B2F1834167E896F3A31260260F9B02E20D5403557B78A1C36FFF1423B8A742B20970C20F169F9D3AEA48C4EE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................w................{..................p..........x.{.wp........(...{.w.........(xxx............(......w........(w~...xx........(~......www....(.z..xx...w.... .........w.... .....p........ ............. ....w......p... .....wwwwwx....p..........x...".....DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx...wx.......vfOx....w....~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx.....w.........x.....w.............................................................?.................................................................................................0...........................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tabback

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 200 x 24, cbSize 854, bits offset 54
Category:	dropped
Size (bytes):	854
Entropy (8bit):	3.802531598764924
Encrypted:	false
SSDEEP:
MD5:	4C3DDA35E23D44E273D82F7F4C38470A
SHA1:	B62BC59F3EED29D3509C7908DA72041BD9495178
SHA-256:	E728F79439E07DF1AFBCF03E8788FA0B8B08CF459DB31FC8568BC511BF799537
SHA-512:	AB27A59ECCDCAAB420B6E498F43FDFE857645E5DA8E88D3CFD0E12FE96B3BB8A5285515688C7EEC838BBE6C2A40EA7742A9763CF5438D740756905515D9B0CC5
Malicious:	false
Reputation:	unknown
Preview:	BMV.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tempFiles.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208328
Entropy (8bit):	6.592041163384343
Encrypted:	false
SSDEEP:
MD5:	57A03F57B0DFF77D20B4E586206BE50E
SHA1:	18B9E1E4905A719336B88BF6CB5EA192CC9CB09D
SHA-256:	161D02419CEA35746FF865ECF866E697E65D6F7455CD2D574727508AFA03260E
SHA-512:	82DBFBB1B907FD5A1F20E27C4B032654EABF355F7DD54347C3BDCC39C9129B9345AE0E526D7062E277B7E4A8CE95DBE48F1F40DEF20551B4EF3CD72639BD83CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........y.L..VL..VL..V...WA..V...W..V...WZ..V,..W]..V,..W[..V,..W...V...WN..V...WC..VL..V..V(..W\..V(..WM..V(..VM..VL..VM..V(..WM..VRichL..V........................PE..L...\|..b.........."!... ............N........................................@......\.....@.................................x...<........................#... ..........p...........................8...@............................................text............................... ..`.rdata..~...........................@..@.data...,...........................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AiFilesRemoveImpers_34CD39A3_D094_47B4_86F9_5BC6461CC0AD.bak

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	89
Entropy (8bit):	1.518622607788485
Encrypted:	false
SSDEEP:
MD5:	6F3C76DA7405563DE2A122209ADAEEC8
SHA1:	552B61ED12BC40967ED7F66C95D31985116C4A0D
SHA-256:	EE2B960AFA4E2D88096363CA64FA670B8EE8793687A2C1E0F5C2C3B569227990
SHA-512:	641C783FFF042DBCC82CEB4F39446F79278D2A0AC2FE826528951BB955DB90591B70FB39903E25C401F584687D3EB9858E566BC87C7827FDD78DEE9AE529BB7F
Malicious:	false
Reputation:	unknown
Preview:	........C.:.\...........................C.:.\.....D.:.\...........................D.:.\..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18112968
Entropy (8bit):	5.48477756514338
Encrypted:	false
SSDEEP:
MD5:	3A6406BA15C24660FD43A91B81E6AB45
SHA1:	23CDA8561C5FB81359B9A713D9838A831F88BADC
SHA-256:	0F697EF6C4289D9416D49E87D5BF9CB5A9D64D65B850F1E203498EED1F109E8F
SHA-512:	B6DCE965EC6C440CB89E9DDDC973D313CF3887F672B75282C2EEBFA09C8EB55E01523EF7A33A82A1CA4535642F97F35F35C26F00CBDB7FE72E0DBD741A7CEA15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w._.3.1.3.1.3.1..2.>.1..4...1..7.2.1.S.5. .1.S.2.+.1.Q.4.0.1.S.4.V.1..5.).1..0.0.1..6.2.1.3.0...1.W.8.~.1.W..2.1.3..2.1.W.3.2.1.Rich3.1.........PE..L...,..b..........".... .\|#..........Q........#...@...........................6.....R'....@...................................+.(.....,..b..........@8...)....4..h..X\|&.p....................}&.......#.@.............#.......+.`....................text....{#......\|#................. ..`.rdata..,v....#..x....#.............@..@.data...$.....,..l....+.............@....rsrc....b....,..d...d,.............@..@.reloc...h....4..j....3.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6D95.tmp

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	Microsoft Cabinet archive data, many, 2407 bytes, 3 files, at 0x44 +A "AddProduct.reg" +A "ImportSettings.reg", flags 0x4, ID 4937, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	13071
Entropy (8bit):	7.735654536186593
Encrypted:	false
SSDEEP:
MD5:	68359E8596D2B01EFB671BCFD2734CB0
SHA1:	904DAB1F6008C07E36E292A5C700CAEB7E99C57E
SHA-256:	B7ED82262AC1211EF0ED7CD767FB2C07B24265DCBFAFC4971D5A64874BF61D89
SHA-512:	37353F7928E36CC316E5147C73EE812E3FFD1CD41069D05D60F3277CAD6D2BCAB2DC32A9C6A268AEC3AFEDF087776AB87C8894475611BAA9B41CEDEC3563C4C7
Malicious:	false
Reputation:	unknown
Preview:	MSCF....g.......D...............I...........g....)............................IYE. .AddProduct.reg.8K........IYE. .ImportSettings.reg......Q....IYE. .RemoveProduct.reg..=I...._CK..o.8..._i....M..$#.t$.6.tZ5I...iD.m\|C ....t....t....}Ug:E.~.~...._.;...6Sn.#.P..x!DI..4.I.X]U......./.o..W#g....]L>y.Y.~....6..<...u..y...I.<.7+.d....`.......uK.=o...1m..........k.C..gX..<.~.v.^.1lg.v..ku.....#..7..x4R..@....X.i].k...U...t5..97....i....KH.Q.. Fe~.E....Q.\|].H.jf(.....+..?..~...T...E.6 G.....0.Z.....~....cac...PK.CO...34.....==OU.C.]..cQ...{fU...l.r.KbVe.......je.....u.mjY..mX+.]....cY..vEj.-..(.....W.,..].)..WA.+{C...V-.83.l..E..W6E..~.5.E.M.V...n_z,h.....fG.z..}.;.h..r.o+Y...gT.#?@X.@..a.G.A.G.S.....>..n......&.....US.>....p.........m..w..\|.IR...A.6.$&....>......d...Z...t.?$.}....J..&.. .......9C`..op.b.&.&i.Q. L.B.. o...{`.c.U_*Te..?.xe.....).7..p...p.......m.X.{....?.4...b.}J.^............_^..X:.(...T..<.#p.^.a...e...LqS....M....w.........~..r9L.8.7G..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\ARM64\dlcdcncm.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	66277
Entropy (8bit):	5.0290705026175
Encrypted:	false
SSDEEP:
MD5:	316EAAD6ED59BD46BF8AEDC18171320D
SHA1:	3D824897E0D033274228956FD94BAA2F9878CED8
SHA-256:	232E8C6D087CB09C2F7884B2A129AAF04A8B542785C80775EBE300213A0893DC
SHA-512:	F72640E35E41DA92FD3535C8A06459DD39DC6A9DCD95A8E2A55CC323523168E0ABE8A36396AF511C1A4FB544901C6DAE4BF481D6B69AE644087DC596C5F85FE1
Malicious:	false
Reputation:	unknown
Preview:	0......*.H...........0.......1.0...`.H.e......0.....+.....7......0...0...+.....7...... .....N.Z../s...240808144115Z0...+.....7.....0..d0.... N..'.~.S,...E-...]....7....\^.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... d.l.c.d.c.n.c.m.6.6.0...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... N..'.~.S,...E-...]....7....\^.0........[<C.35...s..>!1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... d.l.c.d.c.n.c.m.6.6.0...s.y.s...0.....O.PL.e....w.@.,.}.51..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.c.d.c.n.c.m...i.n.f...0.... .}Y.CA.EE.......v...J.....A...C1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.c.d.c.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}Y.CA.EE.......v...J.....A

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	66298
Entropy (8bit):	5.031542374950392
Encrypted:	false
SSDEEP:
MD5:	D185137549D8C70B6CE289A0275774B1
SHA1:	65DACE3A467A3F2CE33534EA7A9685D27D158699
SHA-256:	97FBEF8D6C1746C020285C30482C77BB13CE3921969C0738F0D2DEA510977C85
SHA-512:	1A79AE976E1E8435DD1C01A3F5C33F0F4CB8E240D1264CCB23937524D95E985083EAA4897A5CE16DA0EFEB875C662E6D170D8E15941C6C8C3D2954928CA0F8D2
Malicious:	false
Reputation:	unknown
Preview:	0.......H...........0.......1.0...`.H.e......0.....+.....7......0...0...+.....7......1.] .M....P....240808144124Z0...+.....7.....0..d0.... 05..rf.o..'..pk..uO.8.>......a1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... d.l.c.d.c.n.c.m.6.6.0...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... 05..rf.o..'..pk..uO.*8.>......a0....U.....T.i..@...fPL.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.c.d.c.n.c.m...i.n.f...0....y..KJ..,....&C.u.(.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0B..+.....7...1402...F.i.l.e....... d.l.c.d.c.n.c.m.6.6.0...s.y.s...0.... ..a0.g$A....K&]@....{....l.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.c.d.c.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..a0.g$A....K&]@....{....l.

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	61509
Entropy (8bit):	5.649822034063761
Encrypted:	false
SSDEEP:
MD5:	779EDE344B31C889A750C0E99D2096DA
SHA1:	55AEFD0DD7871A541869FB934010E2D366504CD2
SHA-256:	B6AC613083672441C0CBDE054B265D40810810F17B0DBCBEEF6CCB9EAAFE1AB2
SHA-512:	11E2587C2CCDF8CE6B4F6B26013750C337A72EC5896782CC800C61AC6CBD5CC65EE6DCD10271C850126F6FF313A20E60DF9FE418295ED4BBD0FCF8709ED13D3C
Malicious:	false
Reputation:	unknown
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2024 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 10 x64 Windows 11 x64..;..;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..PnpLockdown = 1..DriverVer = 08/07/2024,11.5.5452.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}......;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 10.0 - Windows 10 and later..%S_Mfg%=_Models, ntamd64......;****************************************************************************..; Models Section..;------------------------------------------------------------------------------..[_Mod

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM_W10\x64\dlcdcncm660.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	151952
Entropy (8bit):	6.58681698975725
Encrypted:	false
SSDEEP:
MD5:	9286606F5D2211FA05EE8B40A9A46518
SHA1:	503C244256A05886086A9A27F950ECE7FE296633
SHA-256:	53C230B4EB901EE01FAEE3CCB194D7E4EA0DDFF292E07E506B09D17344C08C78
SHA-512:	9440DD14D7FA9691FC9F090A7CB45D24BBDCA3260F4747F98C0E6F03E21DE9A2D7A4879BDC0D2CB7CD9805F48D242D8AD5636D5DE3ED3EBDC17B0D252C1CCC8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1.M.1.M.1.M,C.L.1.M,C.L.1.M.F.M.1.M,C.L.1.M.1.M.1.M,C.L.1.M,C.L.1.M&E.L.1.M&EPM.1.M&E.L.1.MRich.1.M........PE..d...z..d.........."..........Z......`..........@.............................p......4T....`A................................................0@..P....P..(.......d........O...`..........T...........................@...8............................................text.............................. ..h.rdata..0).......*..................@..H.data...\...........................@....pdata..d...........................@..HPAGE....u....0...................... ..`INIT....~....@...................... ..b.rsrc........P......................@..B.reloc.......`......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	303263
Entropy (8bit):	4.422229533711185
Encrypted:	false
SSDEEP:
MD5:	237A9F2CD38AD956F72B610E1BA5167F
SHA1:	0A2F483CA17234A4F6DC9EC517457113C1939C57
SHA-256:	54EFD0FD1B0A18978903B17DF4BEC76EEB98121CCBC5522722395FE91E49E1EA
SHA-512:	C3B36E6BD6D23B15ACDAE2C20B06A6B1CFACA1D06C905077C21D1D15418BBC547B5E1E18E4F0C0A77428837A6710AEF0523CC5D770A41C645DBCE30DC4F3E506
Malicious:	false
Reputation:	unknown
Preview:	0......*.H...........0.......1.0...`.H.e......0..z...+.....7.....z.0..z.0...+.....7......;e/;%~O..B.v.....241003092431Z0...+.....7.....0...0........z.J.N.C.q.?H.'1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0R..+.....7...1D0B...F.i.l.e.......0r.i.d.g.e.-.d.o.c.k.-.r.e.l.e.a.s.e...s.p.k.g...0.... ..9..Y..4.{...T.T...\|..^S.&....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.i.d.u.s.b.3...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..9..Y..4.{...T.T...\|..^S.&....0....,@..9...v.(..l.wo.$1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0\..+.....7...1N0L...F.i.l.e.......:f.i.r.e.f.l.y.-.m.o.n.i.t.o.r.-.r.e.l.e.a.s.e...s.p.k.g...0....=,s...9m~^~)ZD...\X1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.i.d.u.s.b.4...d.l.l...0.... Ch....._IV......3..+.e{jz....1..0...+.....

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	9641560
Entropy (8bit):	6.327332147898098
Encrypted:	false
SSDEEP:
MD5:	11BE497E75BD6A18A4F08B1EADB2648F
SHA1:	91F253E89CF2151A8768339DCA4535A7B7F53CC8
SHA-256:	1AE54BBF4FE9B45B64627C1D3E18C17D5D97AB9533EE433A722BFAE2C7B05283
SHA-512:	CFAC2E0CBCFC97FC16AFD5CE25E5E95A16E99653D95B90EDDC070F499E87E2D8A892CDB43362E9970CF71EBA3C9703F2E436B699F3A3CDC6E48A0C22CB1FE657
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......b,m*&M.y&M.y&M.y}%.x.M.y. .x6M.y. .x/M.y}%.x.M.y. .x.M.y}%.x.M.y.#.x.M.y}%.x%M.y/5.y.M.y&M.y^L.y.#.xQL.y}%.x'M.y.#.xZL.y.#.x'M.y.#.y'M.y.#.x'M.yRich&M.y................PE..d...:..f.........." .....TY...@..... .;......................................`.......4....`A......... ................................}.P.....}.............. ..@.......X&........0.h.8...................h.h.(.....b..............pY. ...`.}.@....................text....SY......TY................. ..`.rdata..r.#..pY...#..XY.............@..@.data........0}.......}.............@....pdata..@.... .....................@..@.didat..@............h..............@....rsrc................j..............@..@.reloc.............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	706354
Entropy (8bit):	5.144917895233585
Encrypted:	false
SSDEEP:
MD5:	D2B52A237A337372D14F2C8B225F1584
SHA1:	55E33CDB6BA693E673F39A7C7480B3AA07B8DA6D
SHA-256:	CBDB44CD82159D7F3F37CEE27E314EFCCB31D448B42FD47B1F232BF430D407B6
SHA-512:	B5479A78CE1A722F43B10A87E1DF20F2F7A33B312729B337C580E91DDF873288851219C419B351649E6CB2D5CC97748A1D679CC0270B0687152689A59B09A3CC
Malicious:	false
Reputation:	unknown
Preview:	;.. ; Installation inf for DisplayLink USB Display Adapters... ; Copyright (c) 2016 - 2022 DisplayLink (UK) Ltd... ;....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=dlidusb.cat..DriverVer = 10/01/2024,11.5.5963.0..PnpLockdown=1....[Manufacturer]..%ManufacturerName%=Standard, NTARM64, NTARM64.10.0...16209, NTARM64.10.0...17134, NTARM64.10.0...22621....[Standard.NTARM64]..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0010..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0011..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0012..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0013..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0014..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0015..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0016..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0017..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0018..%DeviceName%=dlidusb_Install, USB\V

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	9642584
Entropy (8bit):	6.330058563490515
Encrypted:	false
SSDEEP:
MD5:	C897FABC9F50420F21A35C5F4CDF1437
SHA1:	16E3522A9B5116729F9FE323F258E8ADA10A43FE
SHA-256:	022046E086634D83D96215E9B5ED2A60DA1C7D947BFF883DF30349C83CBFE962
SHA-512:	2CEB1D3DD34AF3FDA337F58C2100AA6BF1240B073A9CDE4D97CE133FF42159CD018BB8B74C9F618968E2957E5608A9379BBBCA5E9A394738DA117855F56E8B39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......b,m*&M.y&M.y&M.y}%.x.M.y. .x6M.y. .x/M.y}%.x.M.y. .x.M.y}%.x.M.y.#.x.M.y}%.x%M.y/5.y.M.y&M.y^L.y.#.xQL.y}%.x'M.y.#.xZL.y.#.x'M.y.#.y'M.y.#.x'M.yRich&M.y................PE..d...;..f.........." .....XY...@.....`.;......................................`...........`A......... ................................}.P...@.}.............. ..@.......X&........0.h.8...................h.h.(.....b..............pY. .....}.@....................text...,VY......XY................. ..`.rdata....#..pY...#..\Y.............@..@.data........0}.......}.............@....pdata..@.... .....................@..@.didat..@............l..............@....rsrc................n..............@..@.reloc.............r..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	9650264
Entropy (8bit):	6.326654619623203
Encrypted:	false
SSDEEP:
MD5:	6A47F66AE0A9D428C1EBB0405FF00A21
SHA1:	12FAA28CFC89CFE7E80B0FC8166C48A3305A2677
SHA-256:	CC273A9D6D16944BCE05DA247FAF2E5D789D77ACF9C82D9F8EE62765DA5C970D
SHA-512:	D7F3CDFDCE98CDAAC0AC429AA8AFCBD22F4DD826149FD2B65569F108674C0F062F3A2B5494FB724D342ACAB509DD2814F085299FD7D5F6A6CEC2B45B2A8A1E9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......b,m*&M.y&M.y&M.y}%.x.M.y. .x6M.y. .x/M.y}%.x.M.y. .x.M.y}%.x.M.y.#.x.M.y}%.x%M.y/5.y.M.y&M.y^L.y.#.xQL.y}%.x'M.y.#.xZL.y.#.x'M.y.#.y'M.y.#.x'M.yRich&M.y................PE..d...$..f.........." .....nY...@.....@.;......................................p...........`A......... ................................}.P...P.}.............0..........X&.........0.h.8...................h.h.(.....b...............Y. .....}.@....................text....lY......nY................. ..`.rdata...#...Y...#..rY.............@..@.data...p....@}......0}.............@....pdata.......0......................@..@.didat..@...........................@....rsrc..............................@..@.reloc.............................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\dlidusb4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	9650264
Entropy (8bit):	6.326646341390529
Encrypted:	false
SSDEEP:
MD5:	92E885EFC02ED80E5DA1E3A445386AC9
SHA1:	339A07E0CA7B3F4802BE4871593138FEF7DA1A9A
SHA-256:	A53AC75AC464B30052146A66E72A5AB99D72D31543DA33A3B2C0AD90F61CEE8D
SHA-512:	3889AF1E9598F6480235643D88C8121E0A9FF3A9D043B4B45DB20C4A8E1AE6AB18B1271F2F05C11F0FD008F3BC844796CBD9D8D5DEAE1A24C80AE241A96E038B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......b,m*&M.y&M.y&M.y}%.x.M.y. .x6M.y. .x/M.y}%.x.M.y. .x.M.y}%.x.M.y.#.x.M.y}%.x%M.y/5.y.M.y&M.y^L.y.#.xQL.y}%.x'M.y.#.xZL.y.#.x'M.y.#.y'M.y.#.x'M.yRich&M.y................PE..d...<..f.........." .....nY...@.....@.;......................................p.......`....`A......... ................................}.P...P.}.............0..........X&.........0.h.8...................h.h.(.....b...............Y. .....}.@....................text....lY......nY................. ..`.rdata...#...Y...#..rY.............@..@.data...p....@}......0}.............@....pdata.......0......................@..@.didat..@...........................@....rsrc..............................@..@.reloc.............................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\ARM64\ella-dock-release.spkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	924928
Entropy (8bit):	7.999802242650956
Encrypted:	true
SSDEEP:
MD5:	21AE869CA3C8153C5A457C03FB974738
SHA1:	751DB5F5DE3E59A2041916C82DE98F9B8F4F814B
SHA-256:	4A5442C5B55EAE9021C6F7D6F00B9EEE7D20C19C0487107BBA4BC450405FA2AD
SHA-512:	7C0717BBED54ACD7F9E09DBCACDB9E66D424F8F5411748776FF9F5648EEE05F71834CD6DB11F9EC1B4C0CB5CD0C85D6893A89B235297C534C147FB83EED6A3CF
Malicious:	false
Reputation:	unknown
Preview:	ELLA....._\...._.3.-.S...5C..8M.x.I.+..iP..ZJB..%...\4...!B....~.]~..Go=9..%...L.=.x.J^l..#.W...AS[..W.i.B........F@..'..1.1..m`....J..b.{}....?...o`@...GmOi.6.k.Y.A.[...Z....(.F.;..Y.6',}..R=.q.ON}H.W.}j.5R..k.J.PC....>.UW.../..)......K..m.>2.AjR..r.7..........B.C.@J...>..gH..<..y.h4_.:[Z..C.J.87..5$..,.i4Z2..1V..a.....L.9.w.yBp?.dY.....Qkn.J...B.0..kc.d;+.#...M.h.Oz...\n.=.....>.s..]_m...M.&..:..c..2...B..f>j"#.o.VU.c._.t.i\.z..:..e..#.2...G^./..^.&.gJD..JX.9...~.T.y....hm..h..o..!..(..E..&M.OD;.^.)Mq....AE~.......K.d.:..y0Fv.&'%>..0............k.\#...........C...-...z....X..A......d..w........,.F.....tG......m..c..N....k7..n..h.G..A..C..vX..:...i..U..<A..A{..!....6m@UsS.Jq.&.6)...w.....2x...../..t.y\|..Hw.+Ib.<...V1..=w...._C..(..M..U.\...u.^-U..Y.P.-...`...$.#......+`9.v...&.....;.gl{.".q@./.j.......,.[.0....H4.=.....Yu.l.........7....;....4R...e../...!:Fj..(.u........<_........b......D.(.....KP..Z...8.1....Z..h...4qgVv.}..@.......z.:%.\|

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	303300
Entropy (8bit):	4.422563478098496
Encrypted:	false
SSDEEP:
MD5:	8277E67E578154F8D84A89295DC694E4
SHA1:	D2FDBCB3A32DAD086511A047C0831E15B18CED88
SHA-256:	2CE3B4D8586716ED22CA02F5B4F05CBD0223F289475E313FEDA4D114643F96F9
SHA-512:	38893934CFDD63BAB228EA61FA027A43B0951F0A673BB0413DA3F450A16B2566C3C90E8371BCE805A1916521434B694669122592687B0C5D73AFA954D4DCCB5F
Malicious:	false
Reputation:	unknown
Preview:	0.......H...........0.......1.0...`.H.e......0..z...+.....7.....z.0..z.0...+.....7.....\P.992.B.xfZJ.:...241002063041Z0...+.....7.....0...0........z.J.N.C.q.?H.'1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0R..+.....7...1D0B...F.i.l.e.......0r.i.d.g.e.-.d.o.c.k.-.r.e.l.e.a.s.e...s.p.k.g...0.... ..<"D9?..u.X7.$....Q3.).E..T.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........d.l.i.d.u.s.b...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..<"D9?..u.X7.$....Q3.).E..T.0....,@..9...v.(..l.wo.$1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0\..+.....7...1N0L...F.i.l.e.......:f.i.r.e.f.l.y.-.m.o.n.i.t.o.r.-.r.e.l.e.a.s.e...s.p.k.g...0....?fU&X.s...!..c.W..Ea1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........d.l.i.d.u.s.b.4...d.l.l...0..". D.1..^..".k....P..}QdBo(=^T...1..0...+.....7...1...04

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11293248
Entropy (8bit):	7.056360988132007
Encrypted:	false
SSDEEP:
MD5:	1E37272A12041A244692834B05108C23
SHA1:	F6EE946DEEE54BB2877DF7771222A0F52A05BFAE
SHA-256:	1E37E3952941BFBF3F371E967EB404880E8AF87332D695FAF3AB991261781F78
SHA-512:	1F5327CA41CA2FA30C700CD9C69EF2ACC2F4E32D9410F5CCE956B7D63F9711815C10BD8728F87EAA09C0EAC90287E65A099D48E89FE514AF7946AE43040C0238
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........;.?.Z.l.Z.l.Z.l.2.m.Z.l.2.mGZ.lY7.m.Z.lY7.m.Z.l.2.m.Z.lY7.m.Z.l.".l.Z.l.4.m.Z.l.2.m.Z.l.4.m4[.l.2.m.Z.l.2.m.Z.l.Z.l.[.l.4.m.[.l.4.m.Z.l.4wl.Z.l.4.m.Z.lRich.Z.l........PE..d......f.........." ......V...\.....`(7...................................................`A............................................P.......8...............L....,..@&......$......T...................h..(... qu...............V.x...8...@....................text.....V.......V................. ..`.rdata....?...V...?...V.............@..@.data...............................@....pdata..L............p..............@..@.didat..@....`......................@..._RDATA..0....p......................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	706354
Entropy (8bit):	5.144767284984318
Encrypted:	false
SSDEEP:
MD5:	425100C46CD3E050542F5359CD556C90
SHA1:	F15EB14BDC75AB09F7EA8182D93D7BC2139B06B2
SHA-256:	11FA3C2244393FB09E75B95837AE2A2494A2BAF95133CEB729E745E1A2CE547F
SHA-512:	B030BDD2039552D2FB148B0EDEB3521FB1B8FC33E60856EAE419270B58900A956DAEBE63C997114D87E3BF7C93A303E6B7E2986C1E87339CF7EC4E1A8F6873F2
Malicious:	false
Reputation:	unknown
Preview:	;.. ; Installation inf for DisplayLink USB Display Adapters... ; Copyright (c) 2016 - 2022 DisplayLink (UK) Ltd... ;....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=dlidusb.cat..DriverVer = 10/01/2024,11.5.5963.0..PnpLockdown=1....[Manufacturer]..%ManufacturerName%=Standard, NTamd64, NTamd64.10.0...16209, NTamd64.10.0...17134, NTamd64.10.0...22621....[Standard.NTamd64]..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0010..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0011..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0012..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0013..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0014..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0015..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0016..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0017..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0018..%DeviceName%=dlidusb_Install, USB\V

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11293248
Entropy (8bit):	7.056367691734371
Encrypted:	false
SSDEEP:
MD5:	9D3DD8042E5D948816E325C55F2811A8
SHA1:	8A3B515575E395749705F392F9E20BEC6CC7885D
SHA-256:	6C3901F3A3746030F5A8AF52608BEB4EC734FA826C029CB00141BB715F7F6EBE
SHA-512:	3C8F9177E2D99C7D5DB3C04B0AAC1447EF199151C3F972AA8C64EBE140ED747126549C89DED538A04B2E6A85DFD29AD6C1E0DA0C97A7448324C82D250D6E9851
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........;.?.Z.l.Z.l.Z.l.2.m.Z.l.2.mGZ.lY7.m.Z.lY7.m.Z.l.2.m.Z.lY7.m.Z.l.".l.Z.l.4.m.Z.l.2.m.Z.l.4.m4[.l.2.m.Z.l.2.m.Z.l.Z.l.[.l.4.m.[.l.4.m.Z.l.4wl.Z.l.4.m.Z.lRich.Z.l........PE..d......f.........." ......V...\.....`(7..............................................k....`A............................................P.......8...............L....,..@&......$......T...................h..(... qu...............V.x...8...@....................text.....V.......V................. ..`.rdata....?...V...?...V.............@..@.data...X...........................@....pdata..L............p..............@..@.didat..@....`......................@..._RDATA..0....p......................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11294784
Entropy (8bit):	7.057907279312858
Encrypted:	false
SSDEEP:
MD5:	78F3D0DC10F0C37AB079F1DC3464AAC7
SHA1:	F244968B0CD912AEBFC93FEEA8B0631C6C91EA51
SHA-256:	E3EE1FEF2A85382F456749867D2B18E4272575BE3B4A9AF7A5E4A58C44A0B70A
SHA-512:	0968E652647BF659316D985FC7BCBB24F25CACF24D7B2E72245F82EF4A9AA1887FAE753E18B42BEE0F07E91087893CAFBF8FB6C87DAD51F1A3F4C1B183918188
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........;.?.Z.l.Z.l.Z.l.2.m.Z.l.2.mGZ.lY7.m.Z.lY7.m.Z.l.2.m.Z.lY7.m.Z.l.".l.Z.l.4.m.Z.l.2.m.Z.l.4.m4[.l.2.m.Z.l.2.m.Z.l.Z.l.[.l.4.m.[.l.4.m.Z.l.4wl.Z.l.4.m.Z.lRich.Z.l........PE..d......f.........." ......V...\....../7..................................................`A............................................P...`...8...............L....2..@&......,......T......................(... qu...............V.x.......@....................text.....V.......V................. ..`.rdata....?...V...?...V.............@..@.data...(...........................@....pdata..L............v..............@..@.didat..@....`......................@..._RDATA..0....p......................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11322432
Entropy (8bit):	7.056082440767944
Encrypted:	false
SSDEEP:
MD5:	53125BF7EE5AD36A89B6A4455B7F513F
SHA1:	A93169260F58118066C510F5DB32D1736B776821
SHA-256:	717B10E725B1EF1F81F1BBEB0ACBA110CB796F4CEC8583A8A3672FE1BE67EF49
SHA-512:	6BB25DEAA0493E6BFA7F0CBC03175FB8A3E0B245EA4B8109D7B273420AADC8B531A546DFF6797959A394569796342CAA7C25B1DFB8075F24434C0FAFB3543E8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........9..uj..uj..uj..vk.uj..pk1.uj/.qk..uj/.vk.uj..qk.uj/.pkf.uj...j..uj..rk..ujf.qk.uj.:pk..ujf.pkB.uj..sk..uj..tk.uj..tj..ujf.\|k..ujf.uk..ujf.j..ujf.wk..ujRich..uj........................PE..d......f.........." .....W...\.....@z7.............................................2.....`A............................................P.......8....p.......0..........@&......<...P3..T....................3..(...p.u..............@W.x...h...@....................text....(W......W................. ..`.rdata....?..@W...?...W.............@..@.data........0......................@....pdata.......0.....................@..@.didat..@...........x..............@..._RDATA..0...........z..............@..@.rsrc........p......................@..@.reloc..<...........................@..B................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\firefly-monitor-release.spkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	359568
Entropy (8bit):	7.999350355876304
Encrypted:	true
SSDEEP:
MD5:	698B0A92231BF4574A921D7A84F0A999
SHA1:	2C40971439EDCD9F8076CD28141B6C81776F9724
SHA-256:	44D69B31E9D35E1ACAB322986B12EC0CFF50B2FB7D5164426F283D5E54CDFEAB
SHA-512:	AC21FE9C6DB2DA47C24BA92FBF3F4BEA26E5DC9024B21D211881A7BE4ACB6AEE9A3EC5384E8E3D9ACF9C4CA2ADB3735600E6CE876A5FE18747DF06EF65173B17
Malicious:	false
Reputation:	unknown
Preview:	ELLA.\|..0,.....,......x....T..U......x4..i&....>M..@..a.L.TWc..T.H.l.A....VJ........9...Gpu.ar.H.z.)35q.C.J+I.[......JI.....;...yJ..^..LG.....O.......+;!..,.o...o...^8..0 T..[.Of...p...B....A.{.d]..B....X.....5.....wm.T.J..x.08=....A1..S]..........%s[c.....z...5.v.j...).5.).T...}...}m...}.g.R..@..U.V...X.n....0O..C.M\.I.I.4.c..`.. ..X....i...WS..^2..P....;dP..f.....y1.....xp..g..Z...].$..Q{...N..!...=..{.U..m...2vU.3 v.C.b......w.M.X.......$B.@;.o."`.L.....2C.t@c........w..v.U..u1...C...~.-....y@..s.....s.L.v2l...'.p7.Ku..q....TC........w....X.RR..iH..L...U...r..c....g.`,;... l,.q.Y~K..Ke....d.c.f.xi7ZE..]g.X.S..^......a....4.X.]..Q.....S.A..z..X.W.......t?.`..]..v6.Q(_.gC`4.6'r.L.....$b,...k@./@....O...9........j..C..(1.#x .@.m.....M......W.=.hP......=....3...R..!.f..[3\.-_.J.}.(...cz..k.'....l4.z^.....MMq/....k.Q...(././..H...I..n......k.Kn....\|.]....2.3.....p,....I.q."..9uQ.u....m3..pe]./r.......H...(.y..Qu.D..Ga...'..V.NUz..r.q

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\navarro-dock-release.spkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	1615552
Entropy (8bit):	7.999873784276024
Encrypted:	true
SSDEEP:
MD5:	5B4934874D95854BD6EBE80A3ECBB3A2
SHA1:	EBCF4FE57325ACB48E64F853C38A9D71214EEB31
SHA-256:	DD416D32543261BC46D5D9615A9C99D812725E3836958FD3B1DEF120F161E6C6
SHA-512:	FEBF742AE834E9E2CC17F260BA42FB57FC1697C98586C9CA002513CD14C6F6B1CBF605C269591D44ABE68B5A7323F4A950DE5DE051161D38F616B2B354403DDE
Malicious:	false
Reputation:	unknown
Preview:	ELLA......x.BC&.....gvm.....:..qFWm\|.....S......h...RD..NavaDockOW..<unknown>.RE..e38c3013..RL....VE......DA..2024-09-30..TI..09:12:06..PT.....a .Fp/%EY..D/3[.\.8...5..pn...j....n.<..E".=..m>."......... u....F%P..C.)..Z...U..J.VvF.....O.5..#u....t.~.....r.+..5.S.h....1.x......R......@...g=:.M]...D..^..S.e..l....Pm'.)gp.cC}.Fy..}.,.)..+.:.H....=#.3.i~pw........C<.KKI)....7.w.kt.A...eQ.B.A.x\|.TZha.By:.5\|UwN>..G...pJ?..l...a\'.3...f.D3.....VZ.C...vb..i.LAJ.z.\|1.r\|.,...=.`..'.;....\|y3..T.b.1...]..R.>..;8..>...$.....((.li.LWn..[.}.l..xE...W.d.d.e.W.8q..&!. ..H.4'..$a....`....J#.e.. .n..Q?.v.G.O......2A....AP...)^.."./../f~)?...P...3B}......L....`.).v.W......s.3.... \|.I....:.s\x......qH.v4..*G.:...Az.>M....."....6et8~Q.o.4..U...YY...)].Z..%.L....^gR..".b.8j.5E.........q...a.....~1..`Y?.S.k0.^...=S.VSo.@Y~...'X..w....d.d..A.3...94.>...P..i.F.<5.W.f.1l.............P....g....P.`-..4.4..B}.drn.........G+IiPb..pR.C......q.@.K..e.m.-.....! J.2!.&.[.$V.

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\ridge-dock-release.spkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	870928
Entropy (8bit):	7.9998100033567
Encrypted:	true
SSDEEP:
MD5:	1DD6AE530082E26F36636EDF9DEE66DA
SHA1:	0A9A89107A174AE7814EE0BC43B371093F48D527
SHA-256:	7CB69EF54854EA14DBB981FB693BB3B681A110A4F157BC412A71862FCB87EB2C
SHA-512:	D0ED21AEA6EE81BBF7A567533E9B698A11C9D0E643A8FFB31AD3359A5ABFB380F66B5EC588986190647A7210AD89A6E6A2784124F509BFA92FC9DF920A3AE656
Malicious:	false
Reputation:	unknown
Preview:	ELLA.J...0<...x0.b..p.i...Vh.../..z2.bz...&..}.I..S+...R.-..0k...`...Tq.8..w...^.)..m~.(#.-..%..T.2..O.......&...m..o.S...u>...Z-...1.'M...-...^h..k.:..;M'.a.i.........2.O#^.SDS/;....z.b$...... d..DM~4.Y.&i.......z......c^.E_.s..j;5..v.s... ..79.^....MB.?..}iL....q.Mf.O...{:.(..m)...4..p...q..T....1.\|...M.m.........1..,..f..).8=`N.....I=......S.>[.....g.;..a..?....}I..VVa.}...>.EFbf.....znb..XSD<. 7...".C..Wq. ..}v`..^..0b..9DZ'U.........%.>..5.....wl'!.;..Do..]k....9C/.d8..v...^1fT..?..C..P,.d..x(,..F......f<w....0p....o0i;R.../.."M......n.0..^YOesc.o.a[\|.f......M.5..f.3...S.............$..Ro.5^m.......@K.S.H..<..:...De.J.t..S^/o.,&.C..ge.j.......'...S(r.Vq...?o,..T>N.q8:.=0.i.....{. ).:..A.N4....7.,.G.K........*k.:Zk.y..8$...S..OI..Y..qj...f.G..Lj+k."L....e'fF..!....R/^.<.@.......;)RBUc..5../......x....9.S...VJ..>Og..4U...... z...9-..h,...i..=nj.z.FD)0%O.j...5E~....+E...S1.......%..8=d.t.3..p."...S..b...n.<.....].".D..\|.B.ztyP.....)

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	67668
Entropy (8bit):	5.177822570177376
Encrypted:	false
SSDEEP:
MD5:	F6A586D8692B5EB95CCA07B035BD5EAF
SHA1:	972A6197CCAF1CFF8682624A708A6393B4BCED2E
SHA-256:	3E0CBD83A48B22B69A63D8E734DBB397052120F1892B83AF5F573F0A698E340C
SHA-512:	EF0AED001F93A17FCB764008B14778EEE6B205CE62A7CB379E4C685F7A65EAFDE56700AD70B5B4B6AC1F88307025471049E58A767E3DF971FA1D94A4EABD18A9
Malicious:	false
Reputation:	unknown
Preview:	0...O..*.H..........?0...:...1.0...`.H.e......0..v..+.....7.....g0..c0...+.....7.....}zv.4.4G..5.7.....240726131437Z0...+.....7.....0..K0.... ....2YX..L/..... .J........1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ....2YX..L/..... .J........0....$....k.(...3B.9...C.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...i.n.f...0.... .~.F.7]...M....ES$..<w.I......131...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...04..+.....7...1&0$...D.R.M.L.e.v.e.l........1.3.0.0...0H..+.....7...1:08...F.i.l.e.......&d.l.u.s.b.a.u.d.i.o._.x.6.4...s.y.s...0.....+.....7...1...0...0..v..+.....7...0..f.......^...Z.......$f.....`....D1..@0..<..+.....7...1..,...(....'....=.y.iG...o..U..Z..`.E..Z.q.....1w..r...Y...#U:..).f.).......Y....]I..;).[

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	5.374423102782987
Encrypted:	false
SSDEEP:
MD5:	C3A46F2BE73F385A2387DACDEFC6589D
SHA1:	24E514A8BC6B19281A0405334293391DAA9043E3
SHA-256:	01FB0BC6B0325958D68A984C2F81A0DD96BE2E20FF4AEBD4E8C9959CF593EFB6
SHA-512:	0C27DCDC3FBBFBEA0FDAE45B9B6BA269D0FEC2B9543824F52B40372B29D21AA55389F474F64548FB0AA47095B5744EE5ACFED1DE738A36AFCBEC6E8B40F95D47
Malicious:	false
Reputation:	unknown
Preview:	;..; DisplayLink USB Audio Adapter Driver..; Copyright (c) 2011 - 2024 DisplayLink (UK) Ltd...;....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..; 07/11/2019,1.55.0.0..DriverVer = 07/26/2024,11.5.5340.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat....Class=MEDIA..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}....[SignatureAttributes]..dlusbaudio.sys=SignatureAttributes.DRM..dlusbaudio_x64.sys=SignatureAttributes.DRM....[SignatureAttributes.DRM]..DRMLevel=1300......;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; Windows from build 16288 will use inbox audio driver..%S_Mfg%=_Models, ntx86.10.0...16288, ntamd64.10.0...16288, ntx86, ntamd64......;***************

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	modified
Size (bytes):	233360
Entropy (8bit):	6.452597466467627
Encrypted:	false
SSDEEP:
MD5:	D31D501CF9C52C12BFA7CCC3910E8307
SHA1:	DD02E7339840449C920E8DACC8A904F40EF08B6C
SHA-256:	6E7DCE2E99F69F90ADC646B49F4840E57541F311E547D776B879700598FEC5A3
SHA-512:	A440B0701ABAEFD2738AB6DA4740F8A25534D0AECF5D627EA95339955F8C107FF376B3CBCE0ED80F1955779D19A62FB54E747AB254A7A515375DE2D9333DCF7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.S.4.=Q4.=Q4.=Q=.Q5.=Q4.<Q_.=Q=.Q?.=Q=.Q7.=Q=.Q0.=Q=.Q].=Q=.Q5.=Q=.Q5.=QRich4.=Q........PE..d....+'].........."..........\|......d`.......................................................................................................`..x....p..`....0...&...@...O...... ...P...................................................H............................text............................... ..h.rdata...B.......D..................@..H.data...`.... ......................@....pdata...&...0...(..................@..HINIT....Z....`.......&.............. ..b.rsrc........p.......4..............@..B.reloc...............:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27858552
Entropy (8bit):	7.999705826203737
Encrypted:	true
SSDEEP:
MD5:	1CFBB324EEB5BB5635F593AABC2CBAB5
SHA1:	8AFB3C868E557D98ECF43D31E96B999BB563FFFF
SHA-256:	E7156BAD3411FE1F028A15B2E517F390CBC54B606AB101F716EC6C55A0D86A27
SHA-512:	0B8926FB2016266E5FCBB9419B242B29F94FC60EF17A3A371B0F5FA30C0CBD493B5A45C31A2CD763776CFEF41DC61682BC6855C12D0042B428F94C7E88D07B72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../.../.../...0.../..x3.../...0.../...0.../..u'../.../.../..x'../......./......./....../...0../..<).../..Rich./..................PE..L.....n\........../......b...........K............@..........................`..............................................l...d....P..................)...........................................................................................text...5`.......b.................. ..`.rdata...b.......d...f..............@..@.data...<F..........................@....sxdata......@......................@....rsrc........P......................@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLC6CDE.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1096), with CRLF line terminators
Category:	dropped
Size (bytes):	404684
Entropy (8bit):	3.887225134735438
Encrypted:	false
SSDEEP:
MD5:	DEF6BAA3AC2A39368EE43069ED65215D
SHA1:	FE55A086CE67BFB5AC4F16BD89F465CD36D20D3F
SHA-256:	8B80AB27A0F87A555E2EB29142300D50ACD98D127935B8FA6BC20422DC88FD66
SHA-512:	08B81871450E539226EBF81D87320BFB704859E49699FB07529AB61E189330939F51772D449F6F9CCFBC4A045D21B26050D408AC75287FFE30967E3598C0D2D1
Malicious:	false
Reputation:	unknown
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.1./.1.0./.2.0.2.4. . .0.2.:.5.2.:.2.7. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.D.L.2...t.m.p.\.D.L.6.C.3.C...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.9.8.:.A.0.). .[.0.2.:.5.2.:.2.7.:.2.3.6.].:. .S.O.F.T.W.A.R.E. .R.E.S.T.R.I.C.T.I.O.N. .P.O.L.I.C.Y.:. .V.e.r.i.f.y.i.n.g. .p.a.c.k.a.g.e. .-.-.>. .'.C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.3.4.C.D.3.9.A.3.-.D.0.9.4.-.4.7.B.4.-.8.6.F.9.-.5.B.C.6.4.6.1.C.C.0.A.D.}.\.6.1.C.C.0.A.D.\.D.i.s.p.l.a.y.L.i.n.k.I.D.D...m.s.i.'. .a.g.a.i.n.s.t. .s.o.f.t.w.a.r.e. .r.e.s.t.r.i.c.t.i.o.n. .p.o.l.i.c.y.....M.S.I. .(.c.). .(.9.8.:.A.0.). .[.0.2.:.5.2.:.2.7.:.2.3.6.].:. .S.O.F.T.W.A.R.E. .R.E.S.T.R.I.C.T.I.O.N. .P.O.L.I.C.Y.:. .C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.3.4.C.D.3.9.A.3.-.D.0.9.4.-.4.7.B.4.

C:\Users\user\AppData\Local\Temp\MSI9096.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\banner.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.795268611747226
Encrypted:	false
SSDEEP:
MD5:	6442B834BE3353ED06D861117F4A5C23
SHA1:	B7B9C1A131F267F0858B853A4BF9321028C559D2
SHA-256:	3834B5A4B896AECF24D2E73E1C7232C0E623E9B3A1F2A17CBCE34922FA541CA7
SHA-512:	7FC52A6737EC47AE8A5DD29B8FAA13CD01170EBD7BE8A0532EFB681C2ED9A4145DD979EE282FB8964AE731BE2C91575DBD98AA3EE6DE11249252AC9734F6777D
Malicious:	false
Reputation:	unknown
Preview:	<html>.. <style type="text/css">.. body {.. margin: 0px;.. border: 0px;.. }.. .. #banner {.. width: 100%;.. height: 100%;.. }.. </style>.. .. <body onLoad="initPage();">.. <img src="" id="banner">.. </body>.. .. <script TYPE="text/javascript">.. function initPage().. {.. replaceBanner();.. setTimeout(function(){ replaceBanner(); }, 1000);.. }.... function replaceBanner() {.. var brandingBanner = external.MsiGetProperty("DL_BRANDING_BANNER");.. if (brandingBanner != null && brandingBanner != "" && brandingBanner != "0") {.. document.getElementById("banner").src = brandingBanner;.. }.. }.. </script>..</html>

C:\Users\user\AppData\Local\Temp\cl_5963.exe

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1555896
Entropy (8bit):	6.462264918789697
Encrypted:	false
SSDEEP:
MD5:	C06AFAA19A76627FC9AA7271F9596693
SHA1:	D4925D99F2BE61F836FA395BB1AF2396A820A25E
SHA-256:	4B17C23D04DED264DF5C5B114581D9CBA6A56D965E631571F079B26DC0375C51
SHA-512:	BFE2249E29B5CC6B8212ABD374277326C52896B17C05F9DED114602F860FABCB73ED744FA704BB90E7DB1BBAEDC1706C6EB6B79D812A3824331852325A344BDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................Z...\..........\..................\.....\._.......7.....\......Rich....................PE..d...#..f..........".................Ph.........@.............................P............`..................................................b...............0...........)... ..P%..PN..T....................O..(....N............... ...............................text............................... ..`.rdata...[... ...\..................@..@.data............@...b..............@....pdata.......0......................@..@_RDATA...............f..............@..@.rsrc................h..............@..@.reloc..P%... ...&...n..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi8D41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\systemCheck.html

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2483
Entropy (8bit):	4.467732460136009
Encrypted:	false
SSDEEP:
MD5:	21778637A4157E9A24AA633A11FA0DD0
SHA1:	D981CDF8CCB6D56C448E3EAE264BFBC610D20D3F
SHA-256:	714FD6C38C9FD9C68BAE760906DCF7CF7FAD5408B0AFE83846E521B9FF64CCAB
SHA-512:	1EFA034EC9A3B5682EE2E3031DBFF082757A7223B9646E3B95B794DB3663FBC8C82A2066AA8DC9FEDB536E680D30C5D1C882B376770021F9C821C8D8A78C2A32
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd" >..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html;UTF-8"> .. <title>System Checks</title>.. <style type="text/css">.. body {.. margin: 0px;.. border: 0px;.. font-family: Corbel;.. font-size: 9pt;.. background-color: #FFFFFF;.. }.... p#title {.. font-weight: bold;.. }.... li.errorLi {.. list-style: circle;.. margin-bottom:10px;.. color: red;.. }.... li.warningLi {.. list-style: circle;.. margin-bottom:10px;.. color: orange;.. }.... li p.. {.. color: black;.. }.. </style>.. <script TYPE="text/javascript">.. function ini

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\3rd_party_licences.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44932
Entropy (8bit):	4.898472326828264
Encrypted:	false
SSDEEP:
MD5:	062C6C700D8CB902DC51DB3F5140F849
SHA1:	B53FC641199AA4C706A41A345232A4E2F2AE7646
SHA-256:	A6856BB6617E97C518A9994853C2735380DE964AC80214618D7A77BA73FA6EF8
SHA-512:	53D715A00214A32AAD351E6B4BBB29E39E6F501F450DF03920803DEE685B772C82E61D0C5AC3C1DCB9BF3E182E5591A5AB4964BD85605D56E4E17355F05A8A4D
Malicious:	false
Reputation:	unknown
Preview:	Some elements of the Software is derived from or makes use of materials..that are subjects of various open-source licences. Please see the details below.....Mbed TLS is a component of the Software released under Apache 2.0 Licence. ..Copyright The Mbed TLS Contributors....This Software component has been modified by Synaptics...The modifications made by Synaptics are minor, and no significant changes are made.....The licence text is reproduced below:....Mbed TLS files are provided under a dual [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)..OR [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) license...This means that users may choose which of these licenses they take the code..under.....The full text of each of these licenses is given below....... Apache License.. Version 2.0, January 2004.. http://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DI

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\CommonAppDataFolder\Microsoft\Windows\DeviceMetadataStore\EN-US\A67A987B-BB8C-4c62-919A-026F6208E6D6.devicemetadata-ms

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	Microsoft Cabinet archive data, many, 18530 bytes, 4 files, at 0x2c +A "PackageInfo.xml" +A "DeviceInformation\DeviceInfo.xml", ID 11927, number 1, 13 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	18530
Entropy (8bit):	7.955202969770489
Encrypted:	false
SSDEEP:
MD5:	5C015EB59C82686B6B2C156A1228E3C1
SHA1:	5345AA16812D650A323F8570A3CD1A1CEF507415
SHA-256:	084380C1E8D331347034F851072112E2F99A1424E03AEFCDBDE6EC803A2D7D17
SHA-512:	28E121C05025D04A82F5313D9496836BA7C35D3C608672AF4E236E390C4E337038E33F1197490C535F386328D205F6105371AF7AC0ED8AF50DB6E02D9F6FF43A
Malicious:	false
Reputation:	unknown
Preview:	MSCF....bH......,...........................k..........X.: .PackageInfo.xml.....k......X.: .DeviceInformation\DeviceInfo.xml..N..R......X.: .DeviceInformation\DisplayLinkLogo.ico.y...H@.....X.: .WindowsInformation\WindowsInfo.xml....#....CK..Ak.....} ..h.]..{...'....b.!..d....3#.I.%...g.0Y............{..............7.............oo.........~..7.^..q.......W..<>......no..~.>\._?..}\|z~...........O..o....w.o./.........6.0............_.....O......._.......W......._.>...o..?....?..8....W?...w......']..[]8.......<...\t.Y...0..hV.Y.f5..h.....qL.86z.o.$..I..]..nxW5.......q.....Q/.Q/.Q/.Q/.Q/.Q/.Q/.1x....`.........c4rz...Q}...Q<.....X=...U5r..U#W...r.S.z.UO...8i.'..}...q.>.....}.....q.>N..I.8i.'..}...Q?XF.`...e.h..Kg./.Q?X..c...h;6...c...j;...fu.Y.jV.zwl5.[.;....c...j;....c.v..Y.Y.Y.8k.g..}.....q.>...Y.8k.w..;....Nwu....]...3g..q..q..q..q..q..Qo...V.M.A.s...49.M.A.s...49.M.A.s...5.G..Q.p...5.G}.'}.'-.I_;O..y....v.....'m.I.q.v...'m.I....J..E..h....}<k.

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkDriverSwapService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1287608
Entropy (8bit):	6.478580946041573
Encrypted:	false
SSDEEP:
MD5:	300F438C695023EFB150CC0BC3953D57
SHA1:	018916A16D797E7FDE169967C675442A9883160E
SHA-256:	DE165AB2C380E2F06DF36CA03C9704B96B7DE7DC9362B2F1239CB5D28BB6DB1A
SHA-512:	9AE94F831C83168D2E89F0CFB2A39979B0C323FC7B79A2C54A40D138D47C4404AC99EC37C867E795454C4F2B57F52D0AE31EF7AD03F38CB9C297895F389AB4BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E.l.$.?.$.?.$.?.L\|>.$.?.Lz>P$.?MI{>.$.?MI\|>.$.?MIz>.$.?.L{>.$.?.J{>.$.?.Jz>.$.?.L~>.$.?.$~?.%.?.Jv>.$.?.J.?.$.?.J}>.$.?Rich.$.?........PE..d...&..f.........."..........R.......w.........@............................. .......6....`..................................................c..........P.... .......\|...)......\|"......p.......................(....................................................text............................... ..`.rdata..:...........................@..@.data...t........>...l..............@....pdata....... ......................@..@_RDATA...............R..............@..@.rsrc...P............T..............@..@.reloc..\|".......$...X..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkHotDeskService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2744248
Entropy (8bit):	6.52652235659696
Encrypted:	false
SSDEEP:
MD5:	FC3EAA8291DD917E29C9F5C04808C061
SHA1:	F5F3CF38234D6AC20F02AF25B8C25568DEF8AB35
SHA-256:	539885565754FCB43DE55F8A8AA084DDA8D0B35136B09D289655D919837889FA
SHA-512:	AB7BC51DD88BFE9A2178877A2731F9B613DD1894335FD2D990755805D0B9D0CC0C318973EE79A91A355F9E12C05577E5FC76159D686E62D880B574B0F41ABD9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1.a^1.a^1.a^j.b_=.a^j.d_..a^..e_ .a^..b_8.a^..d_..a^j.e_&.a^..e_..a^j.`_..a^1.`^..a^..d_.a^..h_..a^..^0.a^..c_0.a^Rich1.a^................PE..d......f.........."......Z.....................@.............................`.....Q....`..................................................'........P.....(.p^....)..)... ..<....#.p.....................#.(.....#..............p...............................text....X.......Z.................. ..`.rdata..LR...p...T...^..............@..@.data...\|.....'..`....'.............@....pdata..p^....(..`....(.............@..@_RDATA..............r).............@..@.rsrc...P...........t).............@..@.reloc...<... *..>...x).............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\61CC0AD\DisplayLinkIDD.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: DisplayLink Graphics, Author: DisplayLink Corp., Keywords: Installer, MSI, Database, Comments: Installs DisplayLink Graphics., Create Time/Date: Fri Dec 11 11:47:46 2009, Name of Creating Application: DisplayLink Graphics, Security: 0, Template: x64;2057, Last Saved By: x64;1036, Revision Number: {34CD39A3-D094-47B4-86F9-5BC6461CC0AD}11.5.5963.0;{C716870B-69B4-4343-B047-5B9CED97DC13}11.5.5963.0;{0AECE230-D5D2-4880-B3ED-F23905ED66A9}, Number of Pages: 500, Number of Characters: 63
Category:	dropped
Size (bytes):	10674688
Entropy (8bit):	6.292861483555093
Encrypted:	false
SSDEEP:
MD5:	908B75396D7120C79714F72B653EF042
SHA1:	C6C07D85AB6E6BD082828E132ADC5DD127B320C6
SHA-256:	9912C14289C4225022829ECC24B5A4E9A3E454031F3E041CE42585B85BF22199
SHA-512:	353822F046F6B52BB56B4133E4C58DFA4704205DE597147D47C3D7EDA1F374131511561BA8DBDDDAD53FE9E9B7AD660EB1F3D1F7842209BC9A1F13DC679578C6
Malicious:	false
Reputation:	unknown
Preview:	......................>.......................................................................}.......w...x...y...z...{...\|...}...~...................................................~...............................................................................................................................................D...E...F...G...H...I...J...K...L...M...N....$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$...$..............\|.......................>...0................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...?...@...2...3...4...5...6...7...8...9...:...;...<...=......._...B...A...G...C...D...E...F...J...H...I...[...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...`...\...]...^...}...s...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...a6..t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\decoder.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220616
Entropy (8bit):	6.541764938067898
Encrypted:	false
SSDEEP:
MD5:	C098B1C216866D9CA0EEAE0A46A46A0A
SHA1:	B68890EBC6AF792CAC62AB0E2ADE6A7B777C58AE
SHA-256:	0960F28F586617647F16CCB2AD9B38FBA521605015A4C51F661D4BCECA251DB0
SHA-512:	FAC75162310F554BACCB49B5B88EBCEAA8B288E7ACA010E0B364077DD2738CD0D484633BEF7270FAD064813A7B01B7D26E000C0561D20925FA5A6EA902D452E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..4!.dg!.dg!.dg..gf+.dg..af..dgA.af..dgA.`f1.dgA.gf7.dg..`f4.dg..ef&.dg!.eg..dgE.mf~.dgE.df .dgE.g .dg!..g .dgE.ff .dgRich!.dg........................PE..L...~..b.........."!... .d... ......O................................................C....@.........................@...........<....... ............:...#......t ......p...........................(...@...............\|............................text...lc.......d.................. ..`.rdata..B............h..............@..@.data...DV... ......................@....rsrc... ...........................@..@.reloc..t ......."..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\holder0.aiph

Download File

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DL6C3C.exe
File Type:	data
Category:	dropped
Size (bytes):	13252727
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C9A31A77EABABFDB4AB4CC45A4E96254
SHA1:	7BA79C603596A7F1C6CC7394B38ECA3D8E9422B8
SHA-256:	E1AC3F6909E74AA3B159D6981022A1593A57BECA460D68068CFA3E02C2027C42
SHA-512:	94162CB8EA957B58A68D1F95913053D2C4D4931DC2C98B369636DD95F1B0907A6993961AD6FD641C9061429E6D532DB90909FE094CDFF64CA824746E7481DF4C
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\oem0.PNF

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1158 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5884
Entropy (8bit):	3.245230667262667
Encrypted:	false
SSDEEP:
MD5:	00DE78F9E92352B46EB6BD74B54813CA
SHA1:	39B9E30517CADA2A6C99398D899007EFBBF19F32
SHA-256:	4625769F6AA42CA6CFCF9FAF89FA62F583BB921BA0625CE4F6E3CAEAACBF562B
SHA-512:	6A76FCB8BCC79CA1A3A0F68F09EDBCC34D3D83A48A9A2EAD1CAD7A710BF1A6EFBA53894D29C9C193F94C99A18EEFE21A9A2895D97216653ECA46DB197F950F53
Malicious:	false
Reputation:	unknown
Preview:	................H...X....d..................................h...,.......0.......h.......................C.:.\.W.i.n.d.o.w.s.........................................................................................................\...................................................................\|.......................\|...........................................................................................................................................................................`.......H.......................................................................L...................................................................................................................@...........................................................................................................................................................h.......................t...................................................................................................................................

C:\Windows\INF\oem1.PNF

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1100 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5740
Entropy (8bit):	3.1977940754895045
Encrypted:	false
SSDEEP:
MD5:	F6522A824FF0E6517592760FAD67B4A2
SHA1:	0BB8E72584D0E26990592F1FF005931F1C982E8B
SHA-256:	DCD864FDF73D20AD3A3259BBFB5B983DA0C27BBC8754BA91D5B03B1F23F2E83B
SHA-512:	E03D62574F82D5827122261B42192FF0BB125A93C0A8172ACEB9F9E6E0FDA03542496E0DBE32AE557B103E6D3043DF4AEDF011A8F125B02EB786C9E3E291D113
Malicious:	false
Reputation:	unknown
Preview:	................H..................................H...............(.......H...h...............h.......C.:.\.W.i.n.d.o.w.s.....x...................................................$...............................................................................................................d...(...........................................................................................................................................................................................................................................................x...................................................................$...............................................................................................4...........................0.......................................................................................................................................................................................................p...........................................................

C:\Windows\INF\oem3.PNF

Download File

Process:	C:\Users\user\Desktop\DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1210 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	3.236473923671418
Encrypted:	false
SSDEEP:
MD5:	5D8B20F91BD30065F588A243CA52DB6C
SHA1:	C70A43CA4A3D782DF13BF659012D03212B83AF0C
SHA-256:	60D35A7520140922C065051BA7E2BBB85DF1E1A9FA2AB76B7AEC3B9ACCCD277A
SHA-512:	AFEC2BDD5B5E794244FDA6D3006D51AED39181B5B84EF00E0A1372100AE67AFA261E118BAD8B65AB5890EA0FCF7246A6668AEA9A23959DB01041B9101A814EE9
Malicious:	false
Reputation:	unknown
Preview:	................X........K.}........................h.......p...D.......d... ...h.......................C.:.\.W.i.n.d.o.w.s.............................................................................................................................................................................................................H...........................................8.......................................H.......................................................................................................................................................................................................................................,.......................................................................................................................................................................................................................................................................................................h...............................................8...........

C:\Windows\INF\setupapi.app.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.304367827721603
Encrypted:	false
SSDEEP:
MD5:	5DF9EE9CDA2075D5062AEF6B196738AE
SHA1:	9B57BCD4EF53E2091768FC946DC9650A392D67F4
SHA-256:	BEF46C011A717CADC5E8984FD6BA2A09F57164FF96364A053C0E282D53C64CDD
SHA-512:	EB8A3493A13D4EE001BFF2F09C1F2E618EA2CBADEDD60E51FC0DC66AF8449C1273752C7EAE3DC35C36B894779C96FBAAE87AF048E46757E5EE50DD742136F0D8
Malicious:	false
Reputation:	unknown
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2024/10/21 01:37:36.598]....>>> [Build Driver List - PCI\VEN_8086&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78]..>>> Section start 2024/10/21 02:52:52.459.. cmd: C:\Windows\System32\MsiExec.exe -Embedding 74644EEC4A25804F6BC0B9ED2A06AE76..! dvi: Unable to build hardware and compat ID list..! dvi: Error 0xe000020b: The device instance does not exist in the hardware tree...<<< Section end 2024/10/21 02:52:52.459..<<< [Exit status: SUCCESS]....

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	2531986
Entropy (8bit):	5.222106879630372
Encrypted:	false
SSDEEP:
MD5:	253AEFD00FBD660856959B3CC0B9ADB0
SHA1:	05C4F0E3C354165AA8956D22CE0F9094ED7CDD06
SHA-256:	225E3CE2DB32078673CA0483DEA122DECD7229E9E8C84390947AE48016E10157
SHA-512:	5006925511E906A2D23429C99C027919E43DA8320690ABB05E776ADC8234D04D89AEFB542B59581C1A969619A6F05EF873971BB335365FA130AAF74442994F0A
Malicious:	false
Reputation:	unknown
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\MSIEF75.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	648136
Entropy (8bit):	6.449062813580053
Encrypted:	false
SSDEEP:
MD5:	9B4B4EA6509E4DB1E2A8F09A7C6F8F04
SHA1:	512880ABE3C9696EDB042599BD199F1D05210AA2
SHA-256:	3774C31039CB87ED0327F49A00ABD7B4211AC938A46378B8661CD5D8B3B34F94
SHA-512:	63B4788A3AD000C08582F55532DC06BF88BC4111837A63E8157E0F5F668225F46758F9481B6E526A5A813F4F0CC9BE65FB4107D2135C61083274592AF03BA608
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................-......-...W......................-...........-.......-.................................r............Rich....................PE..L......b.........."!... . ...................0............................................@.........................p=.......>..........h................#.......`...`..p....................a.......C..@............0......4;..@....................text............ .................. ..`.rdata..4!...0..."...$..............@..@.data...@"...`.......F..............@....rsrc...h............X..............@..@.reloc...`.......b...^..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFC4C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	31797015
Entropy (8bit):	6.3303805840325404
Encrypted:	false
SSDEEP:
MD5:	DC4BD48F04B2F935ECBEFC40AC1BD9DE
SHA1:	7328FD3BFAC2E99AA617F30BF4DE0B46785C60ED
SHA-256:	3B1C0403E732AB456FB979C3E541081A330D81F52B06C59446D025E80715AFAC
SHA-512:	0FD4A25C33C94C6D791E584C848B4A58778530270BFA5F584B63926105B8B4CE74365DDE10F9F569E232F9D7F7B86E723B619F25872F5DE644B011AA28230119
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@..UY.@.....@.....@.....@.....@.....@......&.{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}..DisplayLink Graphics..DisplayLinkIDD.msi.@.....@K....@.....@......controlPanelIcon.exe..&.{58E52469-F55E-445A-A4F9-A0EE0C20EE2E}.....@.....@.....@.....@.......@.....@.....@.......@......DisplayLink Graphics......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ClearStoredProperties....J...ClearStoredProperties.@.......7#.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w},.............~.~.....~.~.....{.~.....{.~.....{.~S....~.~....]x.~....]x.~.....~.~............]x.~....]x.~....]x..............]x.~....Rich............PE..d...@..f.........." .....l..........p.........................................#.....p.#...`.........................................p.......4...@.......`.............#..)....#..&..@D..p....................E..(....D.........................

C:\Windows\Installer\MSIFC9B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696776
Entropy (8bit):	6.494607602207661
Encrypted:	false
SSDEEP:
MD5:	B9361041D9A1A274127103AB5ED720FA
SHA1:	2BA4A0E099CDDEB735ECA71DCA0B0A181681E093
SHA-256:	771B051DF9DAC27142ED38E72B0EEC15749AF8E130972A2B0E827426145ADD4B
SHA-512:	BB698AF68EEED4F3A1881A57E3DD19CF18151443439C6A908215C7B4CE972F813DB73FF856A7533E80716F836747BF45160708FA9BB8DC66272557A1BC18E073
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1...P..P..P..t"..P..t"...P.....P.....P...(..P......P..t"..P..t"..P..P..Q......P.....P.....P..Pk.P...*..P..Rich.P..........................PE..L......b.........."!... ..................................................................@.............................l............@...............~...#...P...f......p...................@...........@...............(.......`....................text............................... ..`.rdata..N...........................@..@.data...L'..........................@....rsrc........@......................@..@.reloc...f...P...h..................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.9675563397023055
Encrypted:	false
SSDEEP:
MD5:	0FDE0D17A6636F0E657FEC2940C31A55
SHA1:	FF4A5FDDC96C9DDBDE5513C170E173D3AABDB01C
SHA-256:	7D6176241F453AB6F55AE25CB79C4AF003F73A41A442889AA63756526EA8243B
SHA-512:	B3D0CACA486DBF161FD07C77CE0816139B22811250A2DCC99340BF797309416A0C603AC43ED74F8AFAEEFAD2F00329EFE7DA0C455A02121BB124D855A228F930
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{34CD39A3-D094-47B4-86F9-5BC6461CC0AD}\controlPanelIcon.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 10 icons, 256x256, 24 bits/pixel, -128x-128, 24 bits/pixel
Category:	dropped
Size (bytes):	347894
Entropy (8bit):	2.674003249652084
Encrypted:	false
SSDEEP:
MD5:	4004085AFA548E505D2473A2AD03D717
SHA1:	4B304A299A97FC34F70A4281BC316CA3A182BBB9
SHA-256:	7016A3201DE31B82BCA428A9A7F6B6E48765C87013DF988100E60661BE52F7E1
SHA-512:	7FE1AAD1C369130C49730822E9C1CE5A46A013231273A8D2760A0DCBB67846CBCE6AD5E2EBA3E183070AA07DFAF97F6747374C1ABC2796AEDF63BD808F46CA6B
Malicious:	false
Reputation:	unknown
Preview:	..............( ..............(.... ..``.......p......PP.......N...Y..HH......H@......@@......(2......00.............. ...........7..........H...FD..........h....K..(.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	454234
Entropy (8bit):	5.356164247131763
Encrypted:	false
SSDEEP:
MD5:	7ECB10A29E9DD260A92013C80A7A0667
SHA1:	2239958F4FC022EB1331A6D73096DBBA6992AC6F
SHA-256:	2644DA8FEC7463A5AB2DEE87C3D1DDFC8A6696E064273A806CB0A489DFA12281
SHA-512:	5279F60D813A3CBCBB2AD6290265D03FB46BD374D521C1F5E18A93258B94A056C741254708E163788A264CFE840365F97A6094125FE1B4B6EE5A7C772FD5CC81
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	74042
Entropy (8bit):	5.39040855858072
Encrypted:	false
SSDEEP:
MD5:	4FE525F5DDEB513C498FBDEF066B275A
SHA1:	4CF05B518A43B39EF00BAF1EF55F7B797F509783
SHA-256:	F2ABE92D5A83C954E7AD2713BF87726F3A1253BACEB2B348D73AEAE7579F7783
SHA-512:	929DDAF8407100698396C76FD835F513B5F6C0533BFEE5C4657ECEC658C5D025AAEEC939C0FD0379C5E01EBCFEAE4ED5CDB491A73093D5A96C0D98E5DE2E6D3B
Malicious:	false
Reputation:	unknown
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\Temp\~DF3D715342309C81A1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.3635842184218495
Encrypted:	false
SSDEEP:
MD5:	FB4897F81478A21CD9F92134EA215D1D
SHA1:	7CA77D2302D1B448769E1AB7866653533C1D15AB
SHA-256:	ECB7DB4562DB81D3FC48D01764933106EB68B9304B3CF38050F51113F4F26BB4
SHA-512:	D0ECB987B996363F45A8D692C58D45511328A2D16F201AC1DE903C1F4F8BD4DB3E0745D1DEA4A04AC87FC3B087564E346C5025DFB4DFA910562FD51432AFD1A2
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF42073A95027C295A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.47156078618025765
Encrypted:	false
SSDEEP:
MD5:	0D063F73A5FFD0665608E991A8B263D7
SHA1:	4521F1192F5E98ABDA2EE88E08C1193A62C53E81
SHA-256:	FF0CE51907139DEC6BB8805B6C6014EF5391DF65A45BA211D938FC8553797E7B
SHA-512:	2F7C474E0EAA8BF8D73522782F322E5BC7291E1968838AB8E0C24AC24A12009AD84A5CD2E6FF72E2348D9D845DC2A35D9FBBF0E0D7C08F1D847B576001E64DD6
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF98DF86F2A3BBAFEB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.4861152400575188
Encrypted:	false
SSDEEP:
MD5:	0E183A13BD2848E2C5374B176005A41E
SHA1:	D0DACB7FB083A0062AF61494A0145E9F3889D18D
SHA-256:	97BF59FB496D77A75AF1604F582C66139E67B8998312D0C516A21D6F5ED0DA55
SHA-512:	8BC1431DAF9C379E8C0716062198D90DA3B2CF798ADC69071992DBF382AC9005B53D1109E85F39CE50452EFDCA1454D2B9C74B98E2D1B091D5FF08C6100A295F
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFED2169F68C79768.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.863694873050634
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe
File size:	66'460'600 bytes
MD5:	dacc5eb0638261f3c44a3f0bd1cc5ea1
SHA1:	bb57e14f1df59b3ad73f388c7a37bd008b57f22f
SHA256:	680614bf60ff1f1f408e8457ff288ca8a22e1939ba5415fe0c9df082b04dd594
SHA512:	6a3b3b1e4ef7c12d9965ca7cb57f70c4e8e6123cacd9208a3346959693b28d1e0a1e693b755d9de48e6659ea0f9f185f42019ccd73463fcbae140cb57df92b03
SSDEEP:	786432:E47S71wybIKR0bIItenUJ3krLeoeJxEiLerlnyuId2IW:j7S71wybIKSkeenwmKSiKrYuIdXW
TLSH:	10E7E014925E8A37E1A32D70D9EC86DA042A7E91CF6059CFB34DF91F07B05C2C57AB1A
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........T...5...5...5...]...5...]...5...X...5...X...5...X..X5...]...5.._[...5.._[...5...]...5...5..M4.._[...5.._[s..5...5...5.._[...5.

File Icon


Icon Hash:	8a7ce32929b8813e

Static PE Info

General

Entrypoint:	0x4e4ae6
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FBC81C [Tue Oct 1 09:59:56 2024 UTC]
TLS Callbacks:	0x4e5326, 0x4e523d
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	46278352cc455ded9a38a4a9c8364e52

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	09/09/2024 02:00:00 01/10/2025 01:59:59
Subject Chain	CN=DISPLAYLINK (UK) LIMITED, O=DISPLAYLINK (UK) LIMITED, L=Cambridge, C=GB, SERIALNUMBER=04811048, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=GB
Version:	3
Thumbprint MD5:	BABCCB0C2383D1B78CADAFE4A1FC7947
Thumbprint SHA-1:	14EDE26FC7CBDC2FBF6EAE710FC2C71044064D94
Thumbprint SHA-256:	219E11BD84617E4F230007438BC6FD1C870767DFB3BE57A1E0EBBCC241F1865A
Serial:	06DE742C7403D806990BAF658E1364BC

Entrypoint Preview

Instruction
call 00007F65314B5D82h
jmp 00007F65314B4AAFh
call 00007F65314B4C57h
push 00000000h
call 00007F65314B4727h
pop ecx
test al, al
je 00007F65314B4C40h
push 004E4B99h
call 00007F65314B48A5h
pop ecx
xor eax, eax
ret
push 00000007h
call 00007F65314B5AB0h
int3
push esi
push edi
push 00000FA0h
push 005B2BA0h
call dword ptr [00553354h]
push 005644D8h
call dword ptr [00553164h]
mov esi, eax
test esi, esi
jne 00007F65314B4C43h
push 0057193Ch
call dword ptr [00553164h]
mov esi, eax
test esi, esi
je 00007F65314B4C78h
push 005618C8h
push esi
call dword ptr [00553250h]
push 005618ACh
push esi
mov edi, eax
call dword ptr [00553250h]
test edi, edi
je 00007F65314B4C44h
test eax, eax
je 00007F65314B4C40h
mov dword ptr [005B2BB8h], edi
mov dword ptr [005B2BBCh], eax
pop edi
pop esi
ret
xor eax, eax
push eax
push eax
push 00000001h
push eax
call dword ptr [00553340h]
mov dword ptr [005B2B9Ch], eax
test eax, eax
jne 00007F65314B4C19h
push 00000007h
call 00007F65314B5A2Eh
int3
push 005B2BA0h
call dword ptr [0055319Ch]
mov eax, dword ptr [005B2B9Ch]
test eax, eax
je 00007F65314B4C39h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19f8e4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1b4000	0x3da9921	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3f5f200	0x29b8	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f5e000	0x11220	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x176f70	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x176fe0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1700a0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x153000	0x4d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x19f568	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15147a	0x151600	3ac5ae97dc10d1daf0e2a33b22015dd8	False	0.4584495993886625	data	6.473959204257922	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x153000	0x4e644	0x4e800	a9ef1f0445e53629e90c9b5d78b963dd	False	0.3912781150477707	data	5.058407048212059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a2000	0x1175c	0x4200	d8854f601fbf78299ec241a9d2dd1425	False	0.16927083333333334	data	4.222343272253959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1b4000	0x3da9921	0x3da9a00	eb9d149f3207736b3b0327096eb58fa4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3f5e000	0x11220	0x11400	fe615aaf7741378afbb233c2905a3123	False	0.5677932518115942	data	6.579172551273885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
EXE	0x1b4a14	0x24	ASCII text, with no line terminators			1.2222222222222223
EXE	0x1b4a38	0x1b8	data			0.2772727272727273
EXE	0x1b4bf0	0x1a91678	PE32 executable (console) Intel 80386, for MS Windows			0.9189538955688477
EXE	0x1c46268	0x1105be0	PE32 executable (GUI) Intel 80386, for MS Windows			0.4041585922241211
EXE	0x2d4be48	0x11461c8	PE32 executable (GUI) Intel 80386, for MS Windows			0.4041585922241211
EXE	0x3e92010	0x330f	Microsoft Cabinet archive data, many, 2407 bytes, 3 files, at 0x44 +A "AddProduct.reg" +A "ImportSettings.reg", flags 0x4, ID 4937, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression			0.7892280621222554
RT_BITMAP	0x3e95320	0x1714c	Device independent bitmap graphic, 500 x 63 x 24, image size 0, resolution 3780 x 3780 px/m			0.08170086735773217
RT_ICON	0x3eac46c	0x32028	Device independent bitmap graphic, 256 x 512 x 24, image size 196608			0.023965045889474713
RT_ICON	0x3ede494	0xc828	Device independent bitmap graphic, 128 x 256 x 24, image size 49152			0.04420374707259953
RT_ICON	0x3eeacbc	0x70a8	Device independent bitmap graphic, 96 x 192 x 24, image size 27648			0.05554785020804438
RT_ICON	0x3ef1d64	0x4ee8	Device independent bitmap graphic, 80 x 160 x 24, image size 19200			0.0654950495049505
RT_ICON	0x3ef6c4c	0x4048	Device independent bitmap graphic, 72 x 144 x 24, image size 15552			0.07571706368497812
RT_ICON	0x3efac94	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12288			0.12889408099688474
RT_ICON	0x3efdebc	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 6912			0.11941112322791712
RT_ICON	0x3effb64	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072			0.14598765432098765
RT_ICON	0x3f0080c	0x748	Device independent bitmap graphic, 24 x 48 x 24, image size 1728			0.2140557939914163
RT_ICON	0x3f00f54	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.24426605504587157
RT_ICON	0x3f012bc	0x32028	Device independent bitmap graphic, 256 x 512 x 24, image size 196608			0.023965045889474713
RT_ICON	0x3f332e4	0xc828	Device independent bitmap graphic, 128 x 256 x 24, image size 49152			0.04420374707259953
RT_ICON	0x3f3fb0c	0x70a8	Device independent bitmap graphic, 96 x 192 x 24, image size 27648			0.05554785020804438
RT_ICON	0x3f46bb4	0x4ee8	Device independent bitmap graphic, 80 x 160 x 24, image size 19200			0.0654950495049505
RT_ICON	0x3f4ba9c	0x4048	Device independent bitmap graphic, 72 x 144 x 24, image size 15552			0.07571706368497812
RT_ICON	0x3f4fae4	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12288			0.12889408099688474
RT_ICON	0x3f52d0c	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 6912			0.11941112322791712
RT_ICON	0x3f549b4	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072			0.14598765432098765
RT_ICON	0x3f5565c	0x748	Device independent bitmap graphic, 24 x 48 x 24, image size 1728			0.2140557939914163
RT_ICON	0x3f55da4	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.24426605504587157
RT_DIALOG	0x3f5610c	0xb8	data			0.7282608695652174
RT_STRING	0x3f561c4	0x112	data			0.6204379562043796
RT_STRING	0x3f562d8	0x41e	data			0.38330170777988615
RT_STRING	0x3f566f8	0x3bc	data			0.4205020920502092
RT_STRING	0x3f56ab4	0x43a	data			0.4075785582255083
RT_STRING	0x3f56ef0	0x44c	data			0.4163636363636364
RT_STRING	0x3f5733c	0x43c	data			0.3763837638376384
RT_STRING	0x3f57778	0x50c	data			0.3684210526315789
RT_STRING	0x3f57c84	0x4d0	data			0.42207792207792205
RT_STRING	0x3f58154	0x456	data			0.3792792792792793
RT_STRING	0x3f585ac	0x3a0	data			0.41810344827586204
RT_STRING	0x3f5894c	0x4ba	data			0.36198347107438017
RT_STRING	0x3f58e08	0x456	data			0.41621621621621624
RT_STRING	0x3f59260	0x47a	data			0.37085514834205935
RT_STRING	0x3f596dc	0x2ac	data			0.5818713450292398
RT_STRING	0x3f59988	0x2d0	data			0.5972222222222222
RT_STRING	0x3f59c58	0x468	data			0.3723404255319149
RT_STRING	0x3f5a0c0	0x4c2	data			0.39901477832512317
RT_STRING	0x3f5a584	0x46a	data			0.3805309734513274
RT_STRING	0x3f5a9f0	0x476	data			0.4246935201401051
RT_STRING	0x3f5ae68	0x49e	data			0.3824027072758037
RT_STRING	0x3f5b308	0x418	data			0.42366412213740456
RT_STRING	0x3f5b720	0x442	data			0.3587155963302752
RT_STRING	0x3f5bb64	0x424	data			0.41509433962264153
RT_STRING	0x3f5bf88	0x42c	data			0.36891385767790263
RT_STRING	0x3f5c3b4	0x436	data			0.4044526901669759
RT_STRING	0x3f5c7ec	0x442	data	Norwegian	Norway	0.38256880733944953
RT_STRING	0x3f5cc30	0x1d2	data	Chinese	China	0.6223175965665236
RT_STRING	0x3f5ce04	0x20c	data			0.6240458015267175
RT_RCDATA	0x3f5d010	0x128	data			0.6993243243243243
RT_GROUP_ICON	0x3f5d138	0x92	data			0.6986301369863014
RT_GROUP_ICON	0x3f5d1cc	0x92	data			0.6986301369863014
RT_VERSION	0x3f5d260	0x384	data			0.45
RT_MANIFEST	0x3f5d5e4	0x33d	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (769), with CRLF line terminators	English	United States	0.5331724969843185

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	ResetEvent, WaitForMultipleObjects, FormatMessageA, WideCharToMultiByte, GetEnvironmentVariableW, GetCurrentDirectoryW, CreateDirectoryW, DeleteFileW, FlushFileBuffers, GetFileAttributesW, GetFileInformationByHandle, GetFileTime, GetFullPathNameW, RemoveDirectoryW, SetEndOfFile, SetFileAttributesW, SetFilePointerEx, DeviceIoControl, CreateDirectoryExW, CopyFileExW, AreFileApisANSI, MultiByteToWideChar, FindResourceExW, IsValidLocale, GetUserDefaultUILanguage, Process32Next, Process32First, CreateToolhelp32Snapshot, GetSystemInfo, SetEvent, GetBinaryTypeW, GetModuleHandleW, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, SetCurrentDirectoryW, OutputDebugStringW, MoveFileExW, SizeofResource, CreateMutexW, GetLastError, LockResource, WriteConsoleW, HeapSize, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, ResumeThread, SetThreadPriority, GetCurrentThread, CreateThread, Sleep, FormatMessageW, GetLocalTime, GetCurrentThreadId, RaiseException, IsDebuggerPresent, OutputDebugStringA, FindNextFileA, FindFirstFileA, GetModuleHandleA, GetModuleFileNameA, GetTempPathA, CreateFileW, CreateFileA, GetTickCount, QueryPerformanceFrequency, QueryPerformanceCounter, VerifyVersionInfoW, IsWow64Process, GetProductInfo, GetVersionExA, VerSetConditionMask, LocalFree, LocalAlloc, LoadLibraryExA, GetModuleHandleExW, GetModuleFileNameW, FreeLibrary, GetSystemWow64DirectoryW, GetSystemWindowsDirectoryW, GetSystemDirectoryW, OpenProcess, GetCurrentProcessId, GetCurrentProcess, WaitForSingleObject, CloseHandle, FindNextFileW, FindFirstFileW, FindClose, SetLastError, GetProcAddress, FindResourceW, LoadResource, InitializeCriticalSection, SetStdHandle, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, HeapReAlloc, ReadConsoleW, EnumSystemLocalesW, GetUserDefaultLCID, GetTimeFormatW, GetDateFormatW, GetConsoleMode, GetConsoleCP, GetTimeZoneInformation, GetFileSizeEx, GetFileType, HeapAlloc, HeapFree, ExitProcess, ReadFile, VirtualQuery, RtlUnwind, LoadLibraryW, UnregisterWaitEx, QueryDepthSList, InterlockedFlushSList, TryEnterCriticalSection, InterlockedPushEntrySList, InterlockedPopEntrySList, ReleaseSemaphore, DuplicateHandle, VirtualFree, VirtualProtect, VirtualAlloc, FreeLibraryAndExitThread, GetThreadTimes, UnregisterWait, GetStdHandle, GetTempFileNameW, GetTempPathW, GetExitCodeProcess, CreateProcessW, CopyFileW, MoveFileW, FileTimeToSystemTime, GetVersionExW, LoadLibraryExW, IsBadReadPtr, IsBadWritePtr, IsBadStringPtrW, CreateEventW, WriteFile, GetStringTypeW, WaitForSingleObjectEx, SwitchToThread, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, EncodePointer, DecodePointer, GetCPInfo, CompareStringW, LCMapStringW, GetLocaleInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, InitializeSListHead, CreateTimerQueue, SignalObjectAndWait, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject
USER32.dll	SetCursor, MessageBoxW, GetMessageW, CreateDialogParamW, PostMessageW, GetWindowRect, DestroyWindow, SetWindowPos, SetWindowTextW, ShowWindow, GetDesktopWindow, SendMessageW, IsWindow, GetSystemMetrics, SendNotifyMessageW, LoadCursorW, GetDlgItem, TranslateMessage, CopyRect, OffsetRect, DispatchMessageW, IsDialogMessageW
ADVAPI32.dll	SetThreadToken, RegEnumValueW, RegEnumKeyA, InitiateSystemShutdownA, StartServiceA, QueryServiceConfigA, DeleteService, ControlService, ConvertStringSecurityDescriptorToSecurityDescriptorA, QueryServiceStatusEx, RegEnumKeyW, RegDeleteValueW, GetUserNameW, CreateProcessAsUserW, OpenThreadToken, RegEnumValueA, RegEnumKeyExA, RegDeleteKeyA, RegOpenCurrentUser, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegOpenKeyExW, RegOpenUserClassesRoot, ConvertSecurityDescriptorToStringSecurityDescriptorW, ConvertStringSidToSidA, ConvertSidToStringSidA, SetSecurityInfo, GetSecurityInfo, SetEntriesInAclA, OpenServiceA, OpenSCManagerA, CreateServiceW, CloseServiceHandle, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW, RegCloseKey, LookupPrivilegeValueA, LookupAccountSidA, RevertToSelf, ImpersonateLoggedOnUser, GetTokenInformation, GetLengthSid, DuplicateTokenEx, DuplicateToken, CopySid, AdjustTokenPrivileges, OpenProcessToken, AllocateAndInitializeSid, FreeSid, CheckTokenMembership
SETUPAPI.dll	SetupDiCallClassInstaller, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, CM_Get_Sibling, SetupDiGetDeviceInstallParamsA, SetupCopyOEMInfW, SetupDiGetINFClassW, SetupGetInfFileListW, SetupDiClassNameFromGuidW, CM_Locate_DevNodeA, CM_Get_DevNode_Registry_PropertyA, CM_Get_Child, SetupDiSetDeviceInstallParamsA, SetupDiOpenDevRegKey, SetupDiGetDeviceInterfaceDetailA, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInstanceIdA, SetupDiGetDeviceRegistryPropertyA, SetupDiDeleteDevRegKey, SetupDiRemoveDevice, SetupDiGetClassDevsW, SetupDiDestroyDriverInfoList, SetupDiEnumDriverInfoA, SetupDiBuildDriverInfoList, SetupDiGetDeviceInstanceIdW, SetupDiGetDeviceRegistryPropertyW, SetupDiDestroyDeviceInfoList, CM_Get_DevNode_Status, CM_Get_Device_IDA, SetupDiClassGuidsFromNameA, SetupDiSetClassInstallParamsA
SHLWAPI.dll	SHCopyKeyA, SHGetValueW, SHDeleteKeyA
SHELL32.dll	SHFileOperationW, ShellExecuteW
ole32.dll	CoCreateGuid, StringFromGUID2

Possible Origin

Language of compilation system	Country where language is spoken	Map
Norwegian	Norway
Chinese	China
English	United States

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Config.Msi\44e40d.rbs

C:\Program Files\DisplayLink Core Software\AddOnApi64.dll

C:\Program Files\DisplayLink Core Software\DisplayLinkTrayApp.exe

C:\Program Files\DisplayLink Core Software\End User Licence Agreement_EN.rtf

C:\Program Files\DisplayLink Core Software\RunAfterMsiexec.exe

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\FileOperations.dll

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\New

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\Up

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\banner.jpg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\cmdlinkarrow

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\completi

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\custicon

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialog.jpg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackground.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dialogBackgroundGray.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlImageButton.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\dlProgress.png

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\exclamic

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\info

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\insticon

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\lzmaextractor.dll

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\publicSoftwareBanner.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDoing.svg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioDone.svg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioError.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioError.svg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.bmp

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioPending.svg

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\radioWaiting.gif

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\removico

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\repairic

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tabback

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6296\tempFiles.dll

Windows Analysis Report
DisplayLink USB Graphics Software for Windows11.5 M1-EXE.exe