Windows Analysis Report
Setup.exe

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_004172D2	4_2_004172D2
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_0041738A	4_2_0041738A
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_004155D7	4_2_004155D7
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_004187A0	4_2_004187A0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_00411957	4_2_00411957
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_00417D65	4_2_00417D65
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003FD3A0	16_2_003FD3A0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003EBC50	16_2_003EBC50
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003FC120	16_2_003FC120
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003DE270	16_2_003DE270
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003FC240	16_2_003FC240
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_004043D0	16_2_004043D0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00462659	16_2_00462659
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0047869C	16_2_0047869C
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_004687A0	16_2_004687A0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00462888	16_2_00462888
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003FE9A0	16_2_003FE9A0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00404C40	16_2_00404C40
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00470D4D	16_2_00470D4D
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0045CD7D	16_2_0045CD7D
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003EADC0	16_2_003EADC0
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00402EB0	16_2_00402EB0

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: String function: 00405205 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: String function: 004182C0 appears 230 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 00395BC3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 0045B7F5 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 0045B7BE appears 52 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 0045B753 appears 198 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 0045B787 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 00384285 appears 88 times
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: String function: 00460C46 appears 31 times

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003AC0B9 __EH_prolog3_GS,ShowWindow,ShowWindow,NtdllDefWindowProc_W,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	16_2_003AC0B9
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00390558 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	16_2_00390558
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003ACC2E __EH_prolog3,GetWindowDC,NtdllDefWindowProc_W,SetWindowLongW,DeleteDC,	16_2_003ACC2E
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00394E43 NtdllDefWindowProc_W,	16_2_00394E43

Source: Setup.exe	Static PE information: Resource name: EXE type: PE32 executable (console) Intel 80386, for MS Windows
Source: Setup.exe	Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Setup.exe	Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Setup.exe	Static PE information: Resource name: EXE type: Microsoft Cabinet archive data, 2366 bytes, 3 files
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS

Source: 1033.dll.16.dr

Static PE information: No import functions for PE file found

Source: Setup.exe, 00000000.00000000.397564451.0000000003D85000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA990.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.394875681.0000000003619000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA8EE.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395942226.0000000003893000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA929.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397257181.0000000003BC0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA96C.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397311625.0000000003C1B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA970.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.403320737.0000000004EF8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1FB4.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395354503.00000000036CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA8F6.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397603782.0000000003DE0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA9A3.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.403212112.0000000004E9E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1FB0.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397041045.0000000003AAF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA950.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402762623.0000000004C23000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F75.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397161617.0000000003B65000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA968.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395416571.000000000372A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA909.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.396848996.0000000003A55000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA94C.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401795284.0000000004842000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F1A.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.396602963.00000000039FC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA948.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402448700.0000000004A5F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F51.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402404220.0000000004A05000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F4D.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395876045.0000000003838000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA915.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402222245.0000000004951000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F36.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402573549.0000000004B13000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F69.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402168220.00000000048F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F32.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.396140123.00000000038EE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA92D.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397101404.0000000003B0A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA964.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.396545760.00000000039A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA935.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401504419.000000000478D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F12.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.394723346.00000000035BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA8EA.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397369950.0000000003C76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA984.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401097433.00000000046D7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1EFA.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402884981.0000000004CD9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F8C.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401725846.00000000047E7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F16.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402719446.0000000004BC8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F71.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.403149031.0000000004E43000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1FAC.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.394642517.000000000354D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameDisplayLinkIDD.exeJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.400269093.0000000004621000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1EF2.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397740984.0000000003E95000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA9AB.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397513008.0000000003D2B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA98C.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402673872.0000000004B6E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F6D.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.399807278.00000000045B1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameDisplayLinkIDD.exeJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397785196.0000000003EF0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA9AF.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397785196.0000000003EF0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDecoder.dllF vs Setup.exe
Source: Setup.exe, 00000000.00000000.402805488.0000000004C7E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F88.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395137577.0000000003674000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA8F2.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402490235.0000000004AB8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F55.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.403040455.0000000004DE8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1FA8.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402993984.0000000004D8E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F94.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401963591.000000000489B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F2E.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.400582528.000000000467C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1EF6.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395476245.0000000003784000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA90D.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.401299181.0000000004732000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F0E.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.395670432.00000000037DF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA911.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397695554.0000000003E3B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA9A7.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.396343095.0000000003949000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA931.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.397428372.0000000003CD0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameresA988.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402935636.0000000004D33000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F90.tmpJ vs Setup.exe
Source: Setup.exe, 00000000.00000000.402305408.00000000049AC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameres1F3A.tmpJ vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilename7z.sfx.exe, vs Setup.exe

Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: additional.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DLC3A4.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DLC3A4.tmp.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DpInst.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DisplayLinkCore64.dat.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DisplayLinkCore.dat.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1033.dll.16.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Section loaded: davhlpr.dllole32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.sys

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe DLC3A4.exe /exelang 1033 ALLOW64BIT=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{08DDE00A-EEEA-416E-9E61-B9085D542140}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC335A.LOG"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A63054042D1C239EA3B02585E95E450D C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding A71763BA0B19F12D058A5205CCDD4884 C
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe DLC3A4.exe /exelang 1033 ALLOW64BIT=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{08DDE00A-EEEA-416E-9E61-B9085D542140}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC335A.LOG"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A63054042D1C239EA3B02585E95E450D C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding A71763BA0B19F12D058A5205CCDD4884 C	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\DLS07D4.log

Source: classification engine

Classification label: clean6.winEXE@11/123@0/0

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

File read: C:\Windows\win.ini

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_0041B2EA GetDiskFreeSpaceExW,

16_2_0041B2EA

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_003F67C0 FormatMessageW,GetLastError,

16_2_003F67C0

Source: C:\Users\user\Desktop\Setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DisplayLinkSetupPrevInstanceDetector
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3572:120:WilError_01

Source: Setup.exe

String found in binary or memory: @@AAAAAAAAAAAAAAAAAAAAAL28CPxQI0YkGYZlxQ6iJWrOffRuz1SwtZ0fHJLxsH/u@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSBos7TAxWxwixehqRJv8mo05B9etbfGjii4Z49KfHI+Q==@@DLUSBAUDIODLCDCNCMDL-USBNET-NCMadditional.exe -y -o@@AAAAAAAAAAAAAAAAAAAAAB22Hr0gH0JIrzLXlfKGd51DOroTEZAmxe2eNdSAtBxz@@x64DLIDUSBx86Windows7Windows8.1W2K8R2W2K12W2K12R2-productionNIVOWindows10DisplayLinkCore.datDisplayLinkCore64.datUSB\VID_17E9&PID_%x,&pid=DisplayLinkDriverSwapServiceSetDefaultDllDirectorieskernel32.dllDLSInstall DisplayLink GraphicsSetupnorebootnoAutomaticUpdateCheckssuppressUpToDateInfosilentstageDriversignoreCompatibilitydisableInstallCompleteNotificationuninstalloverrideOsLimitmupLogFileextractAsDriverArguments: KB2533623 not detected and installer defaulted to using insecure library loading during its execution. See Microsoft security advisory 2269637 and Microsoft update: https://support.microsoft.com/en-us/help/2533623/DisplayLink Setup is already runningPrevious version: Not installedPrevious versionUpdate versionUninstalling software...Uninstallation finished with success: YesExtracting drivers failed.USB driver does not embed Core installer. Unable to stage drivers.Extracting drivers.&productId=http://www.displaylink.com/support/installcomplete.php?version=Restart required for installation to finish.Installation completed successfully.Installation failed. != @@AAAAAAAAAAAAAAAAAAAAALzZGcUlxt9Bl4iepFdB+YI=@@@@AAAAAAAAAAAAAAAAAAAAAIy8+Cf55znbXGQu4x8bbJhVZe7LPH4vx38WbwA23g2FXJICmP3Efz1PfijxQ35+BQ==@@@@AAAAAAAAAAAAAAAAAAAAAJdG3vWoMW+81Sxh8ZeZXcXYjemjSU2rciryzWrGCSXRWGx6nUiF2UNbCZmmD7+wdg==@@@@AAAAAAAAAAAAAAAAAAAAAOCLjRcTGrvpkAzT95lGwXU=@@@@AAAAAAAAAAAAAAAAAAAAAENH67wl126q0VxC5VcII5S8/p/ML5YMI3hpkjIJZiQ8+3jxefYkciusBVXSXag92g==@@\VarFileInfo\Translation@@AAAAAAAAAAAAAAAAAAAAALMm1tB7/fbSJngrdNPZTy0=@@@@AAAAAAAAAAAAAAAAAAAAAENH67wl126q0VxC5VcII5SIrfn0agufqQYuDFDHTxjDIVdFsruxWsnhaWwRjfxcR71t8DTnFwoDqN22EDBhyko=@@\StringFileInfo\%04hX%04hX\%s@@AAAAAAAAAAAAAAAAAAAAACCR+vH+fde75ruK7q3jSLo=@@@@AAAAAAAAAAAAAAAAAAAAAENH67wl126q0VxC5VcII5SIrfn0agufqQYuDFDHTxjDpkydJ304yOkE1nBaziHXbw==@@DriverStoreFileRepository\@@AAAAAAAAAAAAAAAAAAAAAHzIysQ+4PNkUCXjt7Aa09I4kdL/wTxvuJYRS26pFoefyFAuDG6m92tueNBo90TcMg==@@@@AAAAAAAAAAAAAAAAAAAAABK8T69D96w72B4KKbdWCMsuC5WKWvvm0pQD1n7J37FT@@ProductVersion@@AAAAAAAAAAAAAAAAAAAAAGHfjp2rlzz0oKWiYOfFpeM=@@@@AAAAAAAAAAAAAAAAAAAAADNbZws8ULb6hXNHTxxpjklEWwYIjC7NiggOGhkd146mKtCp+OvMcEGEJWFks2o9/mgOoqDbXUPQfNwQf7UxLwk=@@@@AAAAAAAAAAAAAAAAAAAAACYuIg2ANPkdDeJ5WTruE2Q=@@@@AAAAAAAAAAAAAAAAAAAAACYuIg2ANPkdDeJ5WTruE2Q=@@@@AAAAAAAAAAAAAAAAAAAAAJEl96fKbWReI3tHq9spsLoAj5nd/mssM5h6uJ73yATK/dWK+1c8SpLDWWS4o8X5zg==@@@@AAAAAAAAAAAAAAAAAAAAAF6pfBaJaLAwHGF246qQi0U=@@@@AAAAAAAAAAAAAAAAAAAAANz/lQEEGf8cHjbO+Zpkt9v5/VAGSuOUpaq++fTXhvWwxvVjD//SQScX1OfzQx0NcY/MZvuvRCDI0l+XttrRy31N2kvC7aQ/hotOziyAJSsfPe/wP0/JGQZ5vtg3D7BEXQ==@@\sysWOW64nivoco.dllCompanyNameProductNameProvider@@AAAAAAAAAAAAAAAAAAAAAKhMw0A02VE4olEewoR6ze/cdHzgyaxgTzEZ1sBxbd1S@@DriverVer@@AAAAAAAAAAAAAAAAAAAAAFgHRJCSSmm

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Setup.exe

Static file information: File size 79416048 > 1048576

Source: Setup.exe

Static PE information: certificate valid

Source: Setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x165600
Source: Setup.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x49eec00

Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Setup.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\x64\CoreInstallerHelper.pdb7 source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ResourceCleaner.pdb source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: C:\wrk\tlprj\_ToriLogic\Products\TL-USBNET\_main\bin\Release_660\Win32\tl-usbnet.pdb source: dl-usbnet-ncm.sys.4.dr
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\Win32\dlidusb3\dlidusb3.pdbGCTL source: additional.exe, 00000004.00000003.505808440.0000000002440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\tempFiles.pdb source: DLC3A4.exe, 00000010.00000003.647681466.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.648295325.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.680780745.00000000052D0000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000003.672305509.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.678066911.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdb source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\Win32\Setup.pdb source: Setup.exe
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\x64\DisplayLinkUsbCo2.pdb source: additional.exe, 00000004.00000003.488606399.0000000000710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: VDESTnivoco.dllnivoco.pdbnivolib.dlllibusb0.dlldrivers\libusb0.sysnivousb.dlldrivers\nivousbport.sysngadisp.dlldrivers\ngaport.sysnewnhamgadisp.dlldrivers\newnhamgaport.sysnmirror.dlldrivers\nmirror.sysdrivers\nmirrorport.sysnewnhammirrordisp.dlldrivers\newnhammirrorport.sysnmdrv.dlldrivers\nmport.sysibdisp.dlldrivers\ibport.sysnewnhamusb.dllnewnhamusbco.dlldrivers\newnhamusbport.sysDisplayLinkGAdisp.dlldrivers\DisplayLinkGAport.sysDisplayLinkmirrordisp.dlldrivers\DisplayLinkmirrorport.sysdrivers\DisplayLinkUsbPort.sysdrivers\DisplayLinkUsbIo.sysdrivers\DisplayLinkFilter.sysdrivers\UMDF\dlidusb.dlldrivers\UMDF\dlidusb2.dlldrivers\UMDF\dlidusb3.dlldlidcore.dlldrivers\dlkmd.sysdrivers\dlkmdldr.sysDisplayLinkusb.dllDisplayLinkUsbCo.dlldrivers\ebusbus.sysdrivers\ebuswh95.sysdrivers\ebuswhnt.sysdrivers\ebuswh.sysdrivers\dlcdbus.sysdrivers\dlcdwhnt.sysdrivers\dlcdwh.sysdrivers\dlcdcecm.sysdrivers\dlcdcncm.sysdrivers\dl-usbnet-ncm.sysdrivers\dlusbaudio.sysdrivers\dlusbaudio_x64.sysDLTmmB.dlldlumd9.dlldlumd10.dlldlumd11.dlldrivers\UMDF\ella-dock-release.spkgdrivers\UMDF\ridge-dock-release.spkgdrivers\UMDF\firefly-monitor-release.spkgdrivers\dlxrusbaudio_x64.sysdrivers\DisplayLinkXRUsbIo_x64*.sysDisplayLinkHotDeskServiceDisplayLinkDriverSwapService source: additional.exe, 00000004.00000003.488606399.0000000000710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\x64\CoreInstallerHelper.pdb source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: DpInst.pdbH source: additional.exe, 00000004.00000003.486713848.0000000002440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: DLC3A4.exe, 00000010.00000003.669738195.0000000003C42000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp, MSI2AF1.tmp.16.dr
Source:	Binary string: nivoco.dllnivoco.pdbnivolib.dlllibusb0.dlldrivers\libusb0.sysnivousb.dlldrivers\nivousbport.sysngadisp.dlldrivers\ngaport.sysnewnhamgadisp.dlldrivers\newnhamgaport.sysnmirror.dlldrivers\nmirror.sysdrivers\nmirrorport.sysnewnhammirrordisp.dlldrivers\newnhammirrorport.sysnmdrv.dlldrivers\nmport.sysibdisp.dlldrivers\ibport.sysnewnhamusb.dllnewnhamusbco.dlldrivers\newnhamusbport.sysDisplayLinkGAdisp.dlldrivers\DisplayLinkGAport.sysDisplayLinkmirrordisp.dlldrivers\DisplayLinkmirrorport.sysdrivers\DisplayLinkUsbPort.sysdrivers\DisplayLinkUsbIo.sysdrivers\DisplayLinkFilter.sysdlumd32.dlldlumd64.dlldrivers\UMDF\dlidusb.dlldrivers\UMDF\dlidusb2.dlldrivers\UMDF\dlidusb3.dlldlidcore.dlldrivers\dlkmd.sysdrivers\dlkmdldr.sysDisplayLinkusb.dllDisplayLinkUsbCo.dlldrivers\ebusbus.sysdrivers\ebuswh95.sysdrivers\ebuswhnt.sysdrivers\ebuswh.sysdrivers\dlcdbus.sysdrivers\dlcdwhnt.sysdrivers\dlcdwh.sysdrivers\dlcdcecm.sysdrivers\dlcdcncm.sysdrivers\dl-usbnet-ncm.sysdrivers\dlusbaudio.sysdrivers\dlusbaudio_x64.sysDLTmmB.dlldlumd9.dlldlumd10.dlldlumd11.dlldrivers\UMDF\ella-dock-release.spkgdrivers\UMDF\ridge-dock-release.spkgdrivers\UMDF\firefly-monitor-release.spkgdrivers\dlxrusbaudio_x64.sysdrivers\DisplayLinkXRUsbIo_x64*.sys@@AAAAAAAAAAAAAAAAAAAAAHY+Kvs1uxFtdTKe2lhUNyFtdbrGegS7rfhDfPuGrggE@@@@AAAAAAAAAAAAAAAAAAAAAMZzznyrmIJFsrO9g5Y1Msu9KKJoYFaArulb25hktfpmWSPp1quvgQeTXwZPHDwCRA==@@ != [options]Utility to clean DisplayLink (DL) files, devices & registryCleaner@/ source: DLC3A4.exe, 00000010.00000002.682694119.0000000005BB9000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\x64\Cleaner.pdb source: DLC3A4.exe, 00000010.00000002.682694119.0000000005BB9000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb+ source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\FileOperations.pdbV source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: D:\jenkins\workspace\SW_PROD_release_10.2_01-devel\nivo\bin\Win32\dlidusb3\dlidusb3.pdb source: additional.exe, 00000004.00000003.505808440.0000000002440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nivoco.pdbnivolib.dlllibusb0.dlldrivers\libusb0.sysnivousb.dlldrivers\nivousbport.sysngadisp.dlldrivers\ngaport.sysnewnhamgadisp.dlldrivers\newnhamgaport.sysnmirror.dlldrivers\nmirror.sysdrivers\nmirrorport.sysnewnhammirrordisp.dlldrivers\newnhammirrorport.sysnmdrv.dlldrivers\nmport.sysibdisp.dlldrivers\ibport.sysnewnhamusb.dllnewnhamusbco.dlldrivers\newnhamusbport.sysDisplayLinkGAdisp.dlldrivers\DisplayLinkGAport.sysDisplayLinkmirrordisp.dlldrivers\DisplayLinkmirrorport.sysdrivers\DisplayLinkUsbPort.sysdrivers\DisplayLinkUsbIo.sysdrivers\DisplayLinkFilter.sysdlumd32.dlldlumd64.dlldrivers\UMDF\dlidusb.dlldrivers\UMDF\dlidusb2.dlldrivers\UMDF\dlidusb3.dlldlidcore.dlldrivers\dlkmd.sysdrivers\dlkmdldr.sysDisplayLinkusb.dllDisplayLinkUsbCo.dlldrivers\ebusbus.sysdrivers\ebuswh95.sysdrivers\ebuswhnt.sysdrivers\ebuswh.sysdrivers\dlcdbus.sysdrivers\dlcdwhnt.sysdrivers\dlcdwh.sysdrivers\dlcdcecm.sysdrivers\dlcdcncm.sysdrivers\dl-usbnet-ncm.sysdrivers\dlusbaudio.sysdrivers\dlusbaudio_x64.sysDLTmmB.dlldlumd9.dlldlumd10.dlldlumd11.dlldrivers\UMDF\ella-dock-release.spkgdrivers\UMDF\ridge-dock-release.spkgdrivers\UMDF\firefly-monitor-release.spkgdrivers\dlxrusbaudio_x64.sysdrivers\DisplayLinkXRUsbIo_x64.sysDisplayLinkServiceDisplayLinkHotDeskServicedlcdbusdlcdbus.inf@@AAAAAAAAAAAAAAAAAAAAAPpGvikHf5mNZlsQaCNCPkIGU5u8BVHntQojx3P+hXHW@@@@AAAAAAAAAAAAAAAAAAAAAJdG3vWoMW+81Sxh8ZeZXcXYjemjSU2rciryzWrGCSXRPLzwnsCb08l4uQSL+jhwWw==@@@@AAAAAAAAAAAAAAAAAAAAAPweJT05ojnr/jXzcoTSx0Seq2EjqCx90in8dAyCTacHOosE/PFC5CiL8/J7/ugYF5fCedArAWMh0ls8BM/pDfkv8W+WVCzLUHJIBL/N2izk@@@@AAAAAAAAAAAAAAAAAAAAAJuhqpMNkiPwegXT8cRng3S8rMdNkdRBGxlMEDDT6T0c@@@@AAAAAAAAAAAAAAAAAAAAAPzVBxtd9Ubh5XdDbs2L40E=@@@@AAAAAAAAAAAAAAAAAAAAAHXzPCwOmlVZ7xNZBYd5JNQ=@@@@AAAAAAAAAAAAAAAAAAAAAF8VehuQapGK/SBl6B1S5rygXSueRgumXc30JBiQkGfO77nTs/6OuWbxkpAL5b0gntpQVvq8VueiHbd2NS/GKR4=@@@@AAAAAAAAAAAAAAAAAAAAAHt0rh4ewNlME0SQsuNX7+f8Z0+w1TKvcqJtPL51DIcISNsIgP5ozcRsI2U04v+YvuuyxcJXpFfUA/6IoLxdXwE=@@@@AAAAAAAAAAAAAAAAAAAAAPYO/HFN3kObzM8ljOjb1bhnLhcNT10dioatkJc4i2+hRK5GEw7Nad/YNjJzo+lEsA==@@@@AAAAAAAAAAAAAAAAAAAAAF8VehuQapGK/SBl6B1S5rygXSueRgumXc30JBiQkGfO77nTs/6OuWbxkpAL5b0gnqtEl9CpCJbX1lQJcsR9tXI=@@@@AAAAAAAAAAAAAAAAAAAAANyplArlD6cVpvmahwIbxVdIyFt2vkAZTJk3rVOtGYwp7+FuziTtX5gj3G/ejlPfaw==@@\ProgramData\DisplayLink\Windows\Temp\DisplayLinkDisplayLink Graphics@@AAAAAAAAAAAAAAAAAAAAAD/ih0bdnTHqBR3dzE3FlrF28VyBMOdCPu3iObG1aE3i@@@@AAAAAAAAAAAAAAAAAAAAAHUgYq0gM3I1R5VIEiA+CdW7hwXBfGK7hQttUVT39Pa1@@CLSID\{9F550240-0FCA-443D-B5E9-23ACB47F62E2}SOFTWARE\Classes\CLSID\{9F550240-0FCA-443D-B5E9-23ACB47F62E2}Software\DisplayLink\FirmwareBranding@@AAAAAAAAAAAAAAAAAAAAALX7VMnI07lgL2xQfpbf75SVnULMcDb09JnpvOQIxnXDNAL8j5xkO0FWaHEAl7D+ZsfzMFs/fdnUkP4kSHoMbmM=@@Software\DisplayLink Persistent Settings@@AAAAAAAAAAAAAAAAAAAAAPN0S0vDqM+gWKsezx58hETKyHhPeWMyb0eKB5rOi8x+@@@@AAAAAAAAAAAAAAAAAAAAAEioYsD9hiuyFvfn0It6lh6pBv8Gcl5uKeGfzRR1Rth/@@@@AAAAAAAAAAAAAAAAAAAAAGDnLFQ/VgZ3sE8TJZIMA0mFHorhnMf37dbY8gA3NHdy@@@@AAAAAAAAAAAAAAAAAAAAAFHCS3rVEmhYkcuzB1dW
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: Setup.exe, 00000000.00000000.394336162.0000000003398000.00000002.00000001.01000000.00000003.sdmp, Setup.exe, 00000000.00000000.397785196.0000000003EF0000.00000002.00000001.01000000.00000003.sdmp, DLC3A4.exe, DLC3A4.exe, 00000010.00000002.676601313.00000000004A7000.00000002.00000001.01000000.00000007.sdmp, DLC3A4.exe, 00000010.00000000.575990996.00000000004A7000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: DpInst.pdb source: additional.exe, 00000004.00000003.486713848.0000000002440000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Dnivoco.pdbnivolib.dlllibusb0.dlldrivers\libusb0.sysnivousb.dlldrivers\nivousbport.sysngadisp.dlldrivers\ngaport.sysnewnhamgadisp.dlldrivers\newnhamgaport.sysnmirror.dlldrivers\nmirror.sysdrivers\nmirrorport.sysnewnhammirrordisp.dlldrivers\newnhammirrorport.sysnmdrv.dlldrivers\nmport.sysibdisp.dlldrivers\ibport.sysnewnhamusb.dllnewnhamusbco.dlldrivers\newnhamusbport.sysDisplayLinkGAdisp.dlldrivers\DisplayLinkGAport.sysDisplayLinkmirrordisp.dlldrivers\DisplayLinkmirrorport.sysdrivers\DisplayLinkUsbPort.sysdrivers\DisplayLinkUsbIo.sysdrivers\DisplayLinkFilter.sysdlumd32.dlldlumd64.dlldrivers\UMDF\dlidusb.dlldrivers\UMDF\dlidusb2.dlldrivers\UMDF\dlidusb3.dlldlidcore.dlldrivers\dlkmd.sysdrivers\dlkmdldr.sysDisplayLinkusb.dllDisplayLinkUsbCo.dlldrivers\ebusbus.sysdrivers\ebuswh95.sysdrivers\ebuswhnt.sysdrivers\ebuswh.sysdrivers\dlcdbus.sysdrivers\dlcdwhnt.sysdrivers\dlcdwh.sysdrivers\dlcdcecm.sysdrivers\dlcdcncm.sysdrivers\dl-usbnet-ncm.sysdrivers\dlusbaudio.sysdrivers\dlusbaudio_x64.sysDLTmmB.dlldlumd9.dlldlumd10.dlldlumd11.dlldrivers\UMDF\ella-dock-release.spkgdrivers\UMDF\ridge-dock-release.spkgdrivers\UMDF\firefly-monitor-release.spkgdrivers\dlxrusbaudio_x64.sysdrivers\DisplayLinkXRUsbIo_x64.sysDisplayLinkServiceDisplayLinkHotDeskServicedlcdbusdlcdbus.inf@@AAAAAAAAAAAAAAAAAAAAAPpGvikHf5mNZlsQaCNCPkIGU5u8BVHntQojx3P+hXHW@@@@AAAAAAAAAAAAAAAAAAAAAJdG3vWoMW+81Sxh8ZeZXcXYjemjSU2rciryzWrGCSXRPLzwnsCb08l4uQSL+jhwWw==@@@@AAAAAAAAAAAAAAAAAAAAAPweJT05ojnr/jXzcoTSx0Seq2EjqCx90in8dAyCTacHOosE/PFC5CiL8/J7/ugYF5fCedArAWMh0ls8BM/pDfkv8W+WVCzLUHJIBL/N2izk@@@@AAAAAAAAAAAAAAAAAAAAAJuhqpMNkiPwegXT8cRng3S8rMdNkdRBGxlMEDDT6T0c@@@@AAAAAAAAAAAAAAAAAAAAAPzVBxtd9Ubh5XdDbs2L40E=@@@@AAAAAAAAAAAAAAAAAAAAAHXzPCwOmlVZ7xNZBYd5JNQ=@@@@AAAAAAAAAAAAAAAAAAAAAF8VehuQapGK/SBl6B1S5rygXSueRgumXc30JBiQkGfO77nTs/6OuWbxkpAL5b0gntpQVvq8VueiHbd2NS/GKR4=@@@@AAAAAAAAAAAAAAAAAAAAAHt0rh4ewNlME0SQsuNX7+f8Z0+w1TKvcqJtPL51DIcISNsIgP5ozcRsI2U04v+YvuuyxcJXpFfUA/6IoLxdXwE=@@@@AAAAAAAAAAAAAAAAAAAAAPYO/HFN3kObzM8ljOjb1bhnLhcNT10dioatkJc4i2+hRK5GEw7Nad/YNjJzo+lEsA==@@@@AAAAAAAAAAAAAAAAAAAAAF8VehuQapGK/SBl6B1S5rygXSueRgumXc30JBiQkGfO77nTs/6OuWbxkpAL5b0gnqtEl9CpCJbX1lQJcsR9tXI=@@@@AAAAAAAAAAAAAAAAAAAAANyplArlD6cVpvmahwIbxVdIyFt2vkAZTJk3rVOtGYwp7+FuziTtX5gj3G/ejlPfaw==@@\ProgramData\DisplayLink\Windows\Temp\DisplayLinkDisplayLink Graphics@@AAAAAAAAAAAAAAAAAAAAAD/ih0bdnTHqBR3dzE3FlrF28VyBMOdCPu3iObG1aE3i@@@@AAAAAAAAAAAAAAAAAAAAAHUgYq0gM3I1R5VIEiA+CdW7hwXBfGK7hQttUVT39Pa1@@CLSID\{9F550240-0FCA-443D-B5E9-23ACB47F62E2}SOFTWARE\Classes\CLSID\{9F550240-0FCA-443D-B5E9-23ACB47F62E2}Software\DisplayLink\FirmwareBranding@@AAAAAAAAAAAAAAAAAAAAALX7VMnI07lgL2xQfpbf75SVnULMcDb09JnpvOQIxnXDNAL8j5xkO0FWaHEAl7D+ZsfzMFs/fdnUkP4kSHoMbmM=@@Software\DisplayLink Persistent Settings@@AAAAAAAAAAAAAAAAAAAAAPN0S0vDqM+gWKsezx58hETKyHhPeWMyb0eKB5rOi8x+@@@@AAAAAAAAAAAAAAAAAAAAAEioYsD9hiuyFvfn0It6lh6pBv8Gcl5uKeGfzRR1Rth/@@@@AAAAAAAAAAAAAAAAAAAAAGDnLFQ/VgZ3sE8TJZIMA0mFHorhnMf37dbY8gA3NHdy@@@@AAAAAAAAAAAAAAAAAAAAAFHCS3rVEmhYkcuzB1d

Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_004182C0 push eax; ret	4_2_004182DE
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003D0713 push ecx; mov dword ptr [esp], 3F800000h	16_2_003D077B
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00388AD8 push ecx; mov dword ptr [esp], ecx	16_2_00388ADA
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00388AD8 push ecx; mov dword ptr [esp], ecx	16_2_00388B52

Source: DisplayLinkUsbCo64.dll.4.dr	Static PE information: section name: _RDATA
Source: dlidusb.dll.4.dr	Static PE information: section name: .didat
Source: dlidusb.dll.4.dr	Static PE information: section name: _RDATA
Source: dlidusb2.dll.4.dr	Static PE information: section name: .didat
Source: dlidusb2.dll.4.dr	Static PE information: section name: _RDATA
Source: dlidusb3.dll.4.dr	Static PE information: section name: .didat
Source: dlidusb3.dll.4.dr	Static PE information: section name: _RDATA
Source: dlidusb.dll0.4.dr	Static PE information: section name: .didat
Source: dlidusb2.dll0.4.dr	Static PE information: section name: .didat
Source: dlidusb3.dll0.4.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_003F68D0 LoadLibraryW,GetProcAddress,FreeLibrary,

16_2_003F68D0

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\tempFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2DB2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2C59.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore.dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4D75.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\FileOperations.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI28CD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\PowerShellScriptLauncher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST32\DpInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI345A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2707.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI23B9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2AF1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore64.dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\1033.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI257F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4A86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI206C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI414C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI38DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST64\DpInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\decoder.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\cl_6709.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\shi1E77.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4852.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	File created: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File created: C:\Users\user\AppData\Local\Temp\MSI98D7.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI345A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\tempFiles.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2AF1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore64.dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI257F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\1033.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4A86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI2C59.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore.dat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI38DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST64\DpInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\FileOperations.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4D75.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cl_6709.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dl-usbnet-ncm.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\PowerShellScriptLauncher.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi1E77.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST32\DpInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4852.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo2.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Memory allocated: 71A0000 memory reserve | memory write watch

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_003DAE83 __EH_prolog3_GS,GetProcAddress,GetCurrentProcess,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

16_2_003DAE83

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe	Code function: 4_2_00406FF9 __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	4_2_00406FF9
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00414085 FindFirstFileW,FindClose,CloseHandle,CloseHandle,	16_2_00414085
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003FA310 FindFirstFileW,GetLastError,FindClose,	16_2_003FA310
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00414B3A FindFirstFileW,FindClose,	16_2_00414B3A
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_004083C7 __EH_prolog3_GS,FindFirstFileW,FindClose,	16_2_004083C7
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0041C5A8 FindFirstFileW,FindClose,	16_2_0041C5A8
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0041A78C __EH_prolog3_GS,_wcslen,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	16_2_0041A78C
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0042697F FindFirstFileW,FindNextFileW,_wcsrchr,_wcsrchr,_wcsrchr,FindNextFileW,FindClose,FindClose,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,	16_2_0042697F
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_0041AA08 __EH_prolog3_GS,FindFirstFileW,FindClose,	16_2_0041AA08

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215} FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215} FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\4D81215 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: Setup.exe	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7xl7cbFWwatvt6+z1M3EsccPxgQVpMx6NsmMF7wBrOhU=@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7NPOPrgKLC8b7UjWzM80E98VTy+htvcxDuEsjTG71bqo=@@
Source: DLC3A4.exe, 00000010.00000003.672155660.0000000003BA7000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.678169218.0000000003BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.Q
Source: DLC3A4.exe, 00000010.00000003.669738195.0000000003C42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ERSAuthenticated UsersAUGRP_EVERYONEEveryoneWDUSR_ANONYMOUSAnonymousANUSR_NETWORK_SERVICENetwork ServiceNSGRP_ACCOUNT_OPSAccount OperatorsAOGRP_SERVER_OPSServer OperatorsSOGRP_PRINT_OPSPrint OperatorsPOGRP_BACKUP_OPSBackup OperatorsBOGRP_CRYPTO_OPSCryptographic OperatorsCYGRP_IIS_USERSIIS_IUSRSISGRP_ADMINISTRATORSAdministratorsGRP_USERSUsersGRP_GUESTSGuestsGRP_POWER_USERSPower UsersGRP_REPLICATORReplicatorGRP_RAS_SERVERSRAS and IAS ServersGRP_PREW2KCOMPACCESSPre-Windows 2000 Compatible AccessGRP_REMOTE_DESKTOP_USERSRemote Desktop UsersGRP_NETWORK_CONFIGURATION_OPSNetwork Configuration OperatorsGRP_RID_INCOMING_FOREST_TRUST_BUILDERSIncoming Forest Trust BuildersGRP_MONITORING_USERSPerformance Monitor UsersGRP_LOGGING_USERSPerformance Log UsersGRP_DCOM_USERSDistributed COM UsersGRP_EVENT_LOG_READERSEvent Log ReadersGRP_TS_LICENSE_SERVERSTerminal Server License ServersGRP_AUTHORIZATION_ACCESSWindows Authorization Access GroupGRP_CERTSVC_DCOM_ACCESSCertificate Service DCOM AccessGRP_HYPER_V_ADMINISTRATORSHyper-V AdministratorsS-1-5-32-578GRP_ACCESS_CONTROL_ASSISTANCE_OPSAccess Control Assistance OperatorsS-1-5-32-579GRP_REMOTE_MANAGEMENT_USERSRemote Management UsersS-1-5-32-580GRP_SYSTEM_MANAGED_ACCOUNTSSystem Managed Accounts GroupS-1-5-32-581Getting localized credentials and storing them in properties...LookupUserGroupFromRid failedLookupUserGroupFromRidSDDL failedLookupAliasFromRid failedLookupUserGroupFromSid failedLookupAliasFromRid:Target empty, so account name translation begins on the local system.LookupAccountSidW returned AllocateAndInitializeSid failed and returned LookupUserGroupFromRidSDDL:ConvertStringSidToSid successful!ConvertStringSidToSid failed!Freeing sid..Freeing sid done.LookupUserGroupFromRid:NetUserModalsGet will use empty target computer name.NetUserModalsGet failed with:subAuthorityCount:Initialized Sid successfullyCopying subauthorities...Copying subauthorities done.Appending Rid to new Sid...Appending Rid to new Sid done.resolving for SID: Failed to allocate memory for pSid.Freeing buffers..Buffers freed.LookupUserGroupFromSid:ConvertStringSidToSid succeeded!Freeing sid...Closing window AI_CLOSEAPP_WINDOW_FLAGSProcess32FirstWProcess32NextWCreateToolhelp32SnapshotStoppedAI_PROCESS_STATERunningkernel32.dllAI_SERVICE_STATEStartedNot FoundAI_SERVICES_LISTServicesActiveAI_LOGON_AS_SERVICE_ACCOUNTSResolveServicePropertiesResolveServiceProperties start.ResolveServiceProperties end.AI_SetLogOnAsServiceaction starting ...Get the user accounts list ...CustomActionData: LSA open policy return code: SeServiceLogonRightSetting <Log on as a service> policy ...Getting user account SID ...User: lookup account name error: user NOT found!SID value: SID type: Setting security policy for this account ...LSA add account rights return code: LSA close policy ...action completed.AiStyleConditionsOriginalDatabaseAI_DISABLED_FEATURESSELECT `Cabinet` FROM `Media` WHERE `Media`.`Cabinet`='SELECT * FROM `Condition` WHERE `Condition`.`Feature_`='' .cab
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: DL.Compatibility.InstallationInsideVirtualMachine
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7i8Txv+xGyie0tfG4u8vyGFPy11ZhlnBDwDKYyzA7OFAfr5NC9DoUDk2I4kcHTxOc@@
Source: additional.exe, 00000004.00000003.505808440.0000000002440000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAO62tnNDQPMGj8Ubyc7NJXI4U9fxLVrIngnhBYSmwdtZSQemuRwTngPG80H9sRm83Q==@@
Source: Setup.exe	Binary or memory string: VmCI"
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7xl7cbFWwatvt6+z1M3EscX5//CpWHMWqdB8JAvfv8lo=@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAKvyBEkNGVvl8QFKut8DVWU=@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol79zud105n+f8rkaSGH0kWBPTufQU28sW1ZeJsOriuyXF/VBn+qwvwRn9kUKWCQ2by@@errorLiwarningLi</a>" target="_new"><a href=""><li class="<p></p></li><ul></ul>
Source: Setup.exe	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7xl7cbFWwatvt6+z1M3EsccPxgQVpMx6NsmMF7wBrOhU=@@@@AAAAAAAAAAAAAAAAAAAAAHq67FWq3Z1COkL1ffhDgq8kDF6sJoubZeH49A9CJ4iJ@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fAM3YlHEPIe2/X+itnTmj4SIl+y3k0LsExtUth5TN+4w=@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fTu8EvJB3z5K0y1QVpJ4/DF/40wns2SIdsTdKKJ9UO0E=@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fTu8EvJB3z5K0y1QVpJ4/DPmXvGvb6eYaBhEwizVpEZcDWIlYVKV0rTFzosamobQ5@@@@AAAAAAAAAAAAAAAAAAAAAHfAwsCX7mA7i8LsWwqjnE8=@@@@AAAAAAAAAAAAAAAAAAAAADJ+JbJ5tLfaXKpTglbEDRA=@@@@AAAAAAAAAAAAAAAAAAAAAKz5YMst2ZgAmLDuTk68a0bRaJM+5tSYZkU36/1NXh0m@@dl::tk::gui::resource::OpenURL@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUTMmaTa+Yapk3JRzEzwW1fb+2EBmu9psugsgpyDoZrpBDUvmDSL45TvGABG4KD/z08=@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAADNv+tueGQXc7/c9BOtz8iM=@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6Bu0/XiTvxej2F3BzkBp2PRC@@@@AAAAAAAAAAAAAAAAAAAAAAcSShTcJyt/gC0myC2tMaOqXStVUNU58LMy8jWf/0qM@@@@AAAAAAAAAAAAAAAAAAAAAE9VxOlA7W+OcOLL+aOb0kg=@@@@AAAAAAAAAAAAAAAAAAAAAFwqzilxVnj9bfiLbh4t4oOXM1tBAGG3I17otC7nwXZbFmFdFZJZ61K973gBWT86aA==@@@@AAAAAAAAAAAAAAAAAAAAAClhEC5wPNAk4ukprbs9b3DlhbnNR8p72R1A6zFdQ0H/SUGOAi54Xzbr8BX2GgN7vw==@@@@AAAAAAAAAAAAAAAAAAAAAC2cZcmcRbKAWIRaE5JsdYo34XEDm+URbP8Km+RHKrLd@@@@AAAAAAAAAAAAAAAAAAAAAAlgsxaaS1IFrm/eREw+6a7zASEUJWdPQBdcPeD4b4Sx@@@@AAAAAAAAAAAAAAAAAAAAAFRoquLXVjiE5A7LBu4L2BVYywKHEMYrEyuczFF47WXJSWDe0PhmxwM4yRueexm8zri9rj9KK73mqzEXElh0CqE=@@@@AAAAAAAAAAAAAAAAAAAAAAC7yiCVnFN2sv9m0OJxAkstGRrYdghSJdoD7R0Bi3ct@@@@AAAAAAAAAAAAAAAAAAAAAOredRPZS1x6+SY3v07ylmE=@@@@AAAAAAAAAAAAAAAAAAAAAC6uOeRSPjkZ2UkmRWXj+FMei8/sHI6ozx6ZFCckX1foZOjve6bwprJ5xOhbZsWLMw==@@@@AAAAAAAAAAAAAAAAAAAAAKpEFWlWA4ZK87Ue+qnHF32FEMAYrdmijM1t4WmiUGSz@@Option to disable compatibility checks@@AAAAAAAAAAAAAAAAAAAAAPj1mtTACg5QrDlRsKUNU52WbkYMSg0HMUg7owoPXsS6@@@@AAAAAAAAAAAAAAAAAAAAAAEMb80KNARQxCpsJY0NVAICcryamELO/7pu7XZKe3LC85TeiGPtWbh2demkAAA4bQ==@@E
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6BstbzBICdJp0GCDsFZMbDAS@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7i8Txv+xGyie0tfG4u8vyGFPy11ZhlnBDwDKYyzA7OFAfr5NC9DoUDk2I4kcHTxOc@@@@AAAAAAAAAAAAAAAAAAAAAHYJ48K1mt8xeeLKJM5UyX2n7yiqUO0V6cm/pvqda6AD96ry97X29Z+toj/fufLc9Q==@@@@AAAAAAAAAAAAAAAAAAAAAJ5Jp1LRcLNfCQy5rrcw6ruL9jRsZqfTWlfaZNUpoPAK4PK1OhJmPYVlIdR6T5085FIzVf0o6QAVvByOuM6hB0gyi+ENzroW+9X0/dCna9ld@@\[\[([^\|]+)\\|([^\|]+)\]\]link][%Y.%m.%d-%H:%M:%S# DisplayLink Compatibility Check ver. started on Attempt to access an uninitialzed boost::match_results<> class.
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6BuQ5scgoS9XwI9B3rplRRhR@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAAxaNO3uCRyPawQECZInOUA=@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6BuQ5scgoS9XwI9B3rplRRhR@@@@AAAAAAAAAAAAAAAAAAAAAMTFkf7JPXggPhHVn0bwtIhEqtPMrZ3nBsS6na5kFjON@@@@AAAAAAAAAAAAAAAAAAAAAEkTAdBMkJ9r81Qs6Gcx3FE=@@@@AAAAAAAAAAAAAAAAAAAAAKQ/6SNjkniSO5sgJxtW9AK8HMlgOkwMKOsUhBUK2CAR@@@@AAAAAAAAAAAAAAAAAAAAAOlAjDXGjz0XOkYzR6jkX6W9PYgsHXnq03GI4eFaYVHy9731XvR4kfSKDWaEuGB3YgdnqeVWPv/0mDCcikBLvhE=@@@@AAAAAAAAAAAAAAAAAAAAANo1NIW5BeyN8GEP4y6qzsKTP8AKl4XVhcgLdhZvmi/Rk/Paqx57oU1mGsrbGS4p3yRwPUuWUcuNLC+owvmluwU=@@@@AAAAAAAAAAAAAAAAAAAAAPhtBg7+TjSITf20hS7KFLI=@@waitForCommandAttempt to read empty fifo in Fifo::getFirst()@@AAAAAAAAAAAAAAAAAAAAAOOWIWlICSEKB2HV8lFtDmY=@@@@AAAAAAAAAAAAAAAAAAAAABLGEK2IdFvaVmUc77m+okc=@@@@AAAAAAAAAAAAAAAAAAAAAHY+Kvs1uxFtdTKe2lhUNyGOHxA/cbagkx8/2+FNYTCVrCXPTzVVIl4TOxq8OIfUyA==@@@@AAAAAAAAAAAAAAAAAAAAAHY+Kvs1uxFtdTKe2lhUNyHel5blfNaFe44JJByT4CtpUQ/M8687vfyM8eUt6sRstQ==@@@@AAAAAAAAAAAAAAAAAAAAANBxX1CpvEyGoNV3AFmL5UiTD5Cx/tDE8GyOOq5zb+Pp@@`W
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6Bu0/XiTvxej2F3BzkBp2PRC@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: SoftwareIsNotRunningInsideParallelsVirtualMachine
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol79zud105n+f8rkaSGH0kWBPTufQU28sW1ZeJsOriuyXF/VBn+qwvwRn9kUKWCQ2by@@
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAADuDzpQ2+m4dL31nnBtrgbg=@@@@AAAAAAAAAAAAAAAAAAAAAJy+h1G0kZ86uexbRZBlpLc=@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7NPOPrgKLC8b7UjWzM80E98VTy+htvcxDuEsjTG71bqo=@@@@AAAAAAAAAAAAAAAAAAAAAPEZ6Fc9P+8syiAkIYAmECJQIHpmoF3G6CbuovvpGg6c@@@@AAAAAAAAAAAAAAAAAAAAALcbaKk+5qcXEzfIBYfy3PX5NUkLAEDQkDJf/A1nNtO70OdhjpvJTUQ1jG3YrpDj6w==@@
Source: additional.exe, 00000004.00000003.505808440.0000000002440000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QualitySettingsDL3EncoderDisplayLinkHotDeskService@@AAAAAAAAAAAAAAAAAAAAAN55xUfYkK6pI3Rl8beTqBU=@@@@AAAAAAAAAAAAAAAAAAAAAHQc1zFeyuQ9QLqz5OsFglc=@@@@AAAAAAAAAAAAAAAAAAAAAGK+B+OF3/sUFx+KIFT5j9Y=@@@@AAAAAAAAAAAAAAAAAAAAABi97xOWShrPX0ZbYE0Ggd4=@@@@AAAAAAAAAAAAAAAAAAAAAKbniD7+hHIMXDW9+eD1TsE=@@@@AAAAAAAAAAAAAAAAAAAAADH4HhP0DqLD0yv9nusTIww=@@@@AAAAAAAAAAAAAAAAAAAAAM+MWSAUvw40JvrtyIAGTCg=@@@@AAAAAAAAAAAAAAAAAAAAAEDxi3NiAUx3AcpeCA/fWTgBOBZg2DOKSBUyP2lEaeBH@@@@AAAAAAAAAAAAAAAAAAAAAA6rLwRMbmCzN5c12ITMmpplnjKf/ByMyrPWTQGuxw2OxnO/PqDQ0UKpI5NHlG7YLw==@@@@AAAAAAAAAAAAAAAAAAAAAIJd6s+IeK9efEyCi1KYIeViexWcfE+ARFscvWCYvf9Z@@@@AAAAAAAAAAAAAAAAAAAAAIJd6s+IeK9efEyCi1KYIeVJRu00+V7YH6HF37724rR/qb9nLnaCMeUikIncgjXfhgHrDtyoOXByev0K/adZMV0=@@@@AAAAAAAAAAAAAAAAAAAAAIJd6s+IeK9efEyCi1KYIeVfRNo27APPXwtyWwYISi/0@@@@AAAAAAAAAAAAAAAAAAAAAO62tnNDQPMGj8Ubyc7NJXI4U9fxLVrIngnhBYSmwdtZSQemuRwTngPG80H9sRm83Q==@@@@AAAAAAAAAAAAAAAAAAAAAO62tnNDQPMGj8Ubyc7NJXK3Ed/JSoZ9jAtyEV2WTArl5IWT0g+3kcTAQWCk6If91Jsm3udWuhgNMdTFBwnq1uo=@@@@AAAAAAAAAAAAAAAAAAAAAK57lqFR2QzEdIPUrMOq2mnyPBTaC7c+w8VRSz7nPm3rkrvlWXTySxMDqEJkyvVjQA==@@EnableGammaRampPnpSettingsPersistentDisplaysSettingsNivoSettings
Source: DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	Binary or memory string: @@AAAAAAAAAAAAAAAAAAAAAKPqQPtb+aMxIp2gSNNCBOFl0SdUARAGfihEY6f2Qdmuqwf/Cgbf7YvwRDiSZ/4HCA==@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7xl7cbFWwatvt6+z1M3EsccPxgQVpMx6NsmMF7wBrOhU=@@@@AAAAAAAAAAAAAAAAAAAAAJFKBZ25a8SA3u8S3DMgxdH3KVHiTUuz+tKvF71HVRSKCKPot5XGNZNYOzN/c6wq+g==@@@@AAAAAAAAAAAAAAAAAAAAAI8RTe+drdTc5Ub5XQsDQIJ6GmowHd5xLig/54aFrHQzweN6oekMsi8xATaBPPISEw==@@@@AAAAAAAAAAAAAAAAAAAAABGDrVapLCWg9ldAtH1lq2fa6rnwfZEVBWJTjCOTAn7e53q5VIsEul7UkfcJF1mbMQ==@@@@AAAAAAAAAAAAAAAAAAAAANCmbM+PlSTAN8d9pWwnCNfgFYcKWBi5JCpFYaHVmwSIsKogoSKp8LgnLcJ8vE5CaQ==@@@@AAAAAAAAAAAAAAAAAAAAAIZOigoYZChaXBECyLGNWBcrDsnf1lr7D3NdkaIJDFIHa5BhapHlEL/+ZUMGmJNz/g==@@@@AAAAAAAAAAAAAAAAAAAAALZy2/xdzSM8kYf5lu0Zh+Un1D7sKs+QG0MgbgY0V7sg@@@@AAAAAAAAAAAAAAAAAAAAAF1E3dbyAcyjyY9C73HCgUz8pBXsLPEIF81RxfRRsQqV@@@@AAAAAAAAAAAAAAAAAAAAABCNRPSS67p9ExzzotQQDG9JKkc69PMdoj4QyS+zpAhE@@@@AAAAAAAAAAAAAAAAAAAAAD0j0bDu/lS33rTTb2OtBRemBc3zmjreZipsDbHkgYa2INJPu1oorUVeMGjelfSqMw==@@@@AAAAAAAAAAAAAAAAAAAAAHWSxUQDy+4KmZaI5sPEuDkcyWirJRHM/b/E+Mr/RgTnqyn3FVzDgwZZtQiY2yEGBg==@@dxgkrnl@@AAAAAAAAAAAAAAAAAAAAAHyZlQ63AlCZwkmQXFehpc4=@@@@AAAAAAAAAAAAAAAAAAAAAPmY6+i6nm8Ou1zsdpXf0FA=@@@@AAAAAAAAAAAAAAAAAAAAAPOX0xGsPzfflTkLxbWWglg=@@@@AAAAAAAAAAAAAAAAAAAAAEUFTjPsnaGYIYX3F96P7fE=@@@@AAAAAAAAAAAAAAAAAAAAAAaYsfJ7G6MjhlOICtIqYi8K9aOt/BJ+rN6rTxEg65AJ@@@@AAAAAAAAAAAAAAAAAAAAAHq67FWq3Z1COkL1ffhDgq8kDF6sJoubZeH49A9CJ4iJ@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fAM3YlHEPIe2/X+itnTmj4SIl+y3k0LsExtUth5TN+4w=@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fTu8EvJB3z5K0y1QVpJ4/DF/40wns2SIdsTdKKJ9UO0E=@@@@AAAAAAAAAAAAAAAAAAAAACEZ/54HYFLU3Q8iO3x9LETntCnXMIkW69biLd/ViE0fTu8EvJB3z5K0y1QVpJ4/DPmXvGvb6eYaBhEwizVpEZcDWIlYVKV0rTFzosamobQ5@@unknown@@AAAAAAAAAAAAAAAAAAAAAAr2NAS6qBB9NrT8MZ0MRr9cLQyl/QFbjimar8XC0ALD@@@@AAAAAAAAAAAAAAAAAAAAAJzWK3OJnIJNSD18PyGQmUSSiBUnhGFSP+bgEssXYol7RLS+TyQ62KVEn7VccLsXfNexYPY83KxXYjCJ4jVa6BstbzBICdJp0GCDsFZMbDAS@@@@AAAAAAAAAAAAAAAAAAAAAAS/crofChVJwquEFhlQt1ZOvcxpyEBHESXynDFPmQcU@@@@AAAAAAAAAAAAAAAAAAAAADateW5vUVLORn4r/BAtHl6xSSnGcb5Ftg1GFzp6Ah7H@@@@AAAAAAAAAAAAAAAAAAAAAFzlTx0tAmt+RxBPC5HdN7U=@@@@AAAAAAAAAAAAAAAAAAAAAFbfcJYCpgC8OYD2ei5ebhQ=@@abcabcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq#}"4

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_00460A1C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_00460A1C

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_003F68D0 LoadLibraryW,GetProcAddress,FreeLibrary,

16_2_003F68D0

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_00457EAE GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

16_2_00457EAE

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_003A0287 __set_se_translator,SetUnhandledExceptionFilter,		16_2_003A0287
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: 16_2_00460A1C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		16_2_00460A1C

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe DLC3A4.exe /exelang 1033 ALLOW64BIT=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{08DDE00A-EEEA-416E-9E61-B9085D542140}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC335A.LOG"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe DLC3A4.exe /exelang 1033 ALLOW64BIT=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{08DDE00A-EEEA-416E-9E61-B9085D542140}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC335A.LOG"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackgroundGray.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackground.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dlImageButton.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\publicSoftwareBanner.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioPending.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDoing.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDone.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioPending.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDoing.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDone.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioPending.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDoing.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDone.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioPending.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDoing.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDone.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackgroundGray.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackground.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dlImageButton.bmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\publicSoftwareBanner.bmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,	16_2_004740B6
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: EnumSystemLocalesW,	16_2_0047415F
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: EnumSystemLocalesW,	16_2_004741AA
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: EnumSystemLocalesW,	16_2_00474245
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_004742D2
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,	16_2_004702A4
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,	16_2_00474522
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_0047464B
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetLocaleInfoW,	16_2_00474752
Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_0047481F

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_0045AB63 cpuid

16_2_0045AB63

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_00423C28 __EH_prolog3,CreateNamedPipeW,CreateFileW,

16_2_00423C28

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Code function: 16_2_0047030E GetSystemTimeAsFileTime,

16_2_0047030E

Source: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe

Code function: 4_2_00403F64 __EH_prolog,GetVersionExA,

4_2_00403F64

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	37 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
Setup.exe	0%	Virustotal	Browse
Setup.exe	0%	Metadefender	Browse
Setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\FileOperations.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\FileOperations.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\PowerShellScriptLauncher.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\PowerShellScriptLauncher.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\lzmaextractor.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\tempFiles.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62_x64.sys	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.sys	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.typography.netD	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.typography.netD	DLC3A4.exe, 00000010.00000002.686271597.000000000B742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.displaylink.com/support/compcheckredirect.php	DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	false		high
https://www.thawte.com/cps	DLC3A4.exe, 00000010.00000002.678461490.0000000003C48000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.displaylink.com/	DLC3A4.exe, 00000010.00000003.648494104.0000000004E39000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.597504194.0000000004E29000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.625008226.0000000004E37000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.682694119.0000000005BB9000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000002.682306648.00000000059CD000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000003.647813814.0000000004E39000.00000004.00000800.00020000.00000000.sdmp, dl-usbnet-ncm.sys.4.dr	false		high
https://www.thawte.com/cps0/	DLC3A4.exe, 00000010.00000003.647681466.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.669738195.0000000003C42000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.648295325.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.680780745.00000000052D0000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp, Prereq.dll.16.dr, MSI2AF1.tmp.16.dr	false		high
https://www.displaylink.com/downloads/windows.	Setup.exe, 00000000.00000000.406886096.0000000005536000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.thawte.com/repository0W	DLC3A4.exe, 00000010.00000003.647681466.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.669738195.0000000003C42000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.648295325.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.680780745.00000000052D0000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp, Prereq.dll.16.dr, MSI2AF1.tmp.16.dr	false		high
https://www.displaylink.com/downloads/windows	Setup.exe, 00000000.00000000.406886096.0000000005536000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.displaylink.com/m	DLC3A4.exe, 00000010.00000002.677175504.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.displaylink.com/downloads/windows.x	Setup.exe, 00000000.00000000.406886096.0000000005536000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.advancedinstaller.com	DLC3A4.exe, 00000010.00000003.647681466.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.669738195.0000000003C42000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000003.648295325.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, DLC3A4.exe, 00000010.00000002.680780745.00000000052D0000.00000002.00000001.00040000.00000014.sdmp, DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp, Prereq.dll.16.dr, MSI2AF1.tmp.16.dr	false		high
http://www.google.com	DLC3A4.exe	false		high
http://www.winimage.com/zLibDll	DLC3A4.exe, 00000010.00000002.681168882.0000000005441000.00000002.00000001.00040000.00000014.sdmp	false		high
http://www.yahoo.com	DLC3A4.exe	false		high
http://www.displaylink.com/DlPublicSoftwareBannerpublicSoftwareBanner.bmpAI_REQUIRED_WINDOWS_INSTALL	DLC3A4.exe, 00000010.00000002.680780745.00000000052D0000.00000002.00000001.00040000.00000014.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	612091
Start date and time: 20/04/202215:02:27	2022-04-20 15:02:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Setup.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean6.winEXE@11/123@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 86.3%) Quality average: 74.1% Quality standard deviation: 36.2%
HCA Information:	Successful, ratio: 68% Number of executed functions: 186 Number of non-executed functions: 185
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll	SpeedVPN.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\AIE570.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1251, Title: Installation Database, Subject: DisplayLink Graphics, Author: DisplayLink Corp., Keywords: Installer, MSI, Database, Comments: Installs DisplayLink Graphics., Create Time/Date: Fri Dec 11 11:47:46 2009, Name of Creating Application: Advanced Installer 15.1 build 1ac8a36b05, Security: 0, Template: x64;2057, Last Saved By: x64;1049, Revision Number: {312AEE13-2735-4088-B726-C3CA64D81215}10.2.6709.0;{3B719D3D-BF94-4CEF-80B9-2C1E4AEDE0AC}10.2.6709.0;{0AECE230-D5D2-4880-B3ED-F23905ED66A9}, Number of Pages: 200, Number of Characters: 63
Category:	dropped
Size (bytes):	11059712
Entropy (8bit):	6.312531141034297
Encrypted:	false
SSDEEP:	98304:jBYdAUiyotueafWwy+aC27fafuzfPu8Jsd1wfgvzZQVDLDTqg2qPl:QiyQbKuLCMamfPuSIWzDTq0N
MD5:	1F943593CE82AE5015B1AA7254202DA8
SHA1:	C59C4C2781DD11CE69459703FDBE794F3E3B3C82
SHA-256:	5F8F40150ED161AEDE0C05591816661F5A569E69D74DBB089D8991A43161C929
SHA-512:	243A941D03DA2ABAEF36B935D5A409A9741733988A2FAC39E5AF5C26F0C9ED5F50096D2BC554A638CFF9D74E4D7D8B04925969FC77DC30922BEB47847F06B9E5
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................{...............E.......:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...............9...:...;...<...E...F...G...H...I...J...G...H...I...J...K...L...........................c...d...e...f...g...h...i...j...k...l...m...................................................................................................................................................................................................................................>...............?............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...@...2...3...4...5...6...7...8...9...:...;...<...=.......K...A...C...B...H...D...E...F...G...J...I...]...L...s...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...a...^..._...`.......b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...L9..t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\FileOperations.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371360
Entropy (8bit):	6.68622089601704
Encrypted:	false
SSDEEP:	6144:HSa5HhE9T0zNENm2eK7mnoUSgpAY8ODcDcm7cIsAjcPze3+kLTl505xxgAO3WTBV:HSwHhEGzic7e3D/7QxgRWTUuRIlnOJz
MD5:	D577449D0123146B10AC47ED30292683
SHA1:	5F0C786773156044029FA13CF1E8ED7D5036B7DB
SHA-256:	B7448C7A742619555FFACB998C36F9CEAE17E7A6BB3348A02F6C433B901365E6
SHA-512:	AFA99C4F43BC7FE8BBE1FBD02016D275E8AEAF905E2779DCB0AA0033FDF280BBB426F08946A60A8DA5BD79A35E221E638499F0355308D95EC036B43CD3EA1B67
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\m.F..............9.......;.......:......j.......j..9....j..&...Yk.......t[.............Yk......Yk......Yk7......._.....Yk......Rich....................PE..L.....U[...........!......................................................................@.........................pH..D....I...................................2......p...........................`...@............................................text............................... ..`.rdata...x.......z..................@..@.data...H....`.......F..............@....rsrc................V..............@..@.reloc...2.......4...\..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\New

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.034441580055181
Encrypted:	false
SSDEEP:	3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nZllBe+llBe+llBe+llBe+llBe+lll:k9ij1BjjjjjTtXGuwtOZBl
MD5:	C23CBF002D82192481B61ED7EC0890F4
SHA1:	DD373901C73760CA36907FF04691F5504FF00ABE
SHA-256:	4F92E804A11453382EBFF7FB0958879BAE88FE3366306911DEC9D811CD306EED
SHA-512:	5CC5AD0AE9F8808DEA013881E1661824BE94FB89736C3CB31221E85BE1F3A408D6E5951ACCD40EE34B3BAF76D8E9DD8820D61A26345C00CDDC0A884375EE1185
Malicious:	false
Preview:	..............(.......(....... ...........................................................................................................................................................................................................................................................................}..................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\PowerShellScriptLauncher.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418976
Entropy (8bit):	6.664247191007649
Encrypted:	false
SSDEEP:	6144:wNbyiRFi7BpCGB8gdENm2eK7mnoUSgpAY8ODcDcm7cIs34Cx0Wlx/33F85vWBk/i:qbx+WHGptlx/Wkq4mo4XVO5
MD5:	E619F450ADAEE3D6638A8632C0A97C2D
SHA1:	20CEB30A8B29F39A075806CA545083B86F097E9E
SHA-256:	C4C766DB32D317C8B748F798D2B62CAE9E85788EDCBF7915D55CDD31F61C3F64
SHA-512:	2B30CB2783598E1DB6A493E48256FBD2D7F01ED616DE456BF86C8D1DB140C11EA1580789AC3CD71839E7F6A531B991FA33302A1967275C61EC60AC6FF05C8517
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tn...=...=...=Fo.=...=Fo.=...=Fo.=...=..<...=..<...=..<...=...=...=...=]..=...<...=...<...=...=...=..=...=...<...=Rich...=................PE..L....U[...........!......................................................................@.................................8...x....@...............J.......P..<=..p...p..............................@............................................text...H........................... ..`.rdata..JX.......Z..................@..@.data....%..........................@....rsrc........@......................@..@.reloc..<=...P...>..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Prereq.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	390816
Entropy (8bit):	6.56762007556992
Encrypted:	false
SSDEEP:	6144:uvoAMQlYVsYxMrPFzq7k7/Si13YiucVvAO+u6DRU9A1Fk:uvjlYaVrWK3Yxc8FRkAI
MD5:	23879268CA004A18964791AAD5441038
SHA1:	779672ADC8B28B58F761E18B91A209104342A24A
SHA-256:	A2EC308DA594B832262AC45DECD462842FC4929D20FC2C158405605AD53B9A1A
SHA-512:	80B6FE319C955544944DD4BC4D64417C5A3E0A7EE6F37FD168E41EE350F29192FAADED5452B77273A89B75F4D14BCD7D75ACA542B0EFD40F59201192837D8338
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........).*.H.y.H.y.H.yz..y.H.yz..y[H.yz..y.H.y...x.H.y...x.H.y...x.H.y.0oy.H.y.0hy.H.y.0.y.H.y.H.y.I.y./.x.H.y./.x.H.y./.y.H.y.H{y.H.y./.x.H.yRich.H.y........PE..L....U[...........!................Qz....................................... .......X....@.............................<...............h........................>..."..8...............................@...............\...\|...@....................text............................... ..`.rdata..............................@..@.data...\$..........................@....rsrc...h...........................@..@.reloc...>.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\Up

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.0369361465218003
Encrypted:	false
SSDEEP:	3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nreBB+eKemhlRhmeemfB+ll5evZ/Xy:k9ij1KBBhK9jwmfBuiKaq5n
MD5:	83730AC00391FB0F02F56FE2E4207A10
SHA1:	139FED8F0216132450E66BDA0FBBDC2A5BD333AF
SHA-256:	573E3260EED63604F24F6F10CE5294E25E22FDA9E5BFD9010134DE6E684BAB98
SHA-512:	E3DBE1956BB743FD68319517D1D993DDA316C12BBBBBBD6F582ECDD60C4FDE24CC4814C7AB36ED571F720349931EAC10B03E9C911BA0F4309B10604B2C56C6A9
Malicious:	false
Preview:	..............(.......(....... ...............................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\aicustact.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: SpeedVPN.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\banner

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 59 x 8
Category:	dropped
Size (bytes):	2372
Entropy (8bit):	2.6114732592489567
Encrypted:	false
SSDEEP:	24:Rgf4BBBBP////F7I8+iN1svE0bRw1FBdJ2DMaij/T///HkBBB+:RgQBBBBb18VeyDUcBBB+
MD5:	DAF14D3480C7AA73A53415FF483B10A1
SHA1:	DB240A22410AC7536F5C833CA98322CCA4180C3D
SHA-256:	0D2715E6689EA0CCCC6CDFAD328DAB66F61DF466FBBAF043CEF2D05F9AD420C4
SHA-512:	7741A04025317179EAF14F7843F313F0E8922FD219C1D45DB91E65E58229A1C948FB12120806507162D064B03DD4A45A8380210545A8A61910E622F0B3C736C7
Malicious:	false
Preview:	BMD.......J...(.......;............................................................................................1...........................................................1...........................................................1..............................................................-..............1..............................................................-..............1..............................................................-..............1..............................................................-..............1..............................................................-................................................................................................................................................................................................................1...................................................................................................1................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\cmdlinkarrow

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:	48:QFFZ+f+zd+kHeNTM9/+Xz++++++++YWWS0i6I:QFFEw4Xc+D++++++++ypi9
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\completi

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.359062242965858
Encrypted:	false
SSDEEP:	48:fHJQSoGaffiary58nP0pB/ewjcYzrd67jQHazxAySvbyQfil:PJFL4dOQGJ6nQ6dSvGQo
MD5:	45B0E074F96A859ADAE198187AB9FA11
SHA1:	AB89AD71FC239D10C71476E42CDB66B080D75BED
SHA-256:	050282E679AC80F6A357FFF92F1E7A95D30A06B35247E25CBFD2DD8CEEE1A412
SHA-512:	5B0A2ABAED2E285E8F0D25148C03A05F090FF8FB69D9A178DA21B779427ED138AB16876163500D266123B036C23F3AC56DCDE8D4D103B37102B4FC46A2B04520
Malicious:	false
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................................w................{..................p..........x.{.wp............{.w..........xxx...................w.........w~...xx.........~......www......z..xx...w..............w..........p...........................w......p.........wwwwwx...............x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x.......................................................?.........................................................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\custicon

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.298568796986908
Encrypted:	false
SSDEEP:	48:fH9LkioGaffiary58nP0pB/ewjcYzrd67jQHazAQnny1ykbjy0fiV:P9LFL4NOQGJ6nQ6sP1ykbu0I
MD5:	3EAEBDADE778394F06B29659C9C01ED7
SHA1:	3E2A80761C8A44E509C4E06D275BFB25E704DDB0
SHA-256:	719E644C31D0CC6B891F6A1253655DFBA39A3B78E06D24817BE1D8492B172B48
SHA-512:	14628B5C737045B9916AF5F3ECC9343EF6349C9988F45D1E93846CD79FD38A20F9E7922EC2E6A846CCF14F02AAC84E518279548E8BC9B29AAA3EE553D7A74F59
Malicious:	false
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................................w................{..................p..........x.{.wp............{.w..........xxx...................w.........w~...xx.........~......www......z..xx...w..............w..........p...........................w......p.........wwwwwx...............x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x.......................................................?.........................................................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialog

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 316 x 8
Category:	dropped
Size (bytes):	36904
Entropy (8bit):	1.6592122603583341
Encrypted:	false
SSDEEP:	96:ZFgstvLTJ/lJzh7nVnnWpinnJ7FNng6H6ityl6Tk:3gstjTJddWpi7vndHDLTk
MD5:	ABF1076064505DEE794FA7AED67252B8
SHA1:	358D4E501BB3007FEECE82A4039CC1050F23FAB4
SHA-256:	FB0D133F05DE6AA6A7A3491AE532191A60C438B35D9FF7BFEC9E63131F6F0C73
SHA-512:	9A4680A8D186C1D7550B5E03CBDD095B0C88B2E0249A3AF75FA0253D2C9A6F0AA1DD570ECF1A273683A14E6C7B5FB11678BE3DA439A3BF23EAB790372E96E321
Malicious:	false
Preview:	BM(.......J...(.......<..................................................N..U........................................................................................R...S..P..................................................................................R...V..M................................................................................R...[..H..........................................................................R...^..E........................................................................R...a..B....................................................................R...f..=................................................................R...i..:............................................................R...l..7..........................................................R...o..4......................................................R...r..1....................................................R...u...................................................R.......................g..+......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackground.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 10 x 24
Category:	dropped
Size (bytes):	374
Entropy (8bit):	1.0090244268172435
Encrypted:	false
SSDEEP:	6:2lfkLLARaLARaLARaLARaLARaLARaLARaLARaLARaLl:qAVVVVVVVVR
MD5:	3200BCB62A21A451EF63623CCE0C2B29
SHA1:	02AC159F40618D9FE96FB5B1F8E7675805F1CCD8
SHA-256:	0E63FCA0804774EA90B96C096EA9678DEB3DD0B864EFD3B57659B447FE890C05
SHA-512:	68589D3672412C99C54984A25A7B4DC16789361ECD03F9644C2E1C00BA5F2B68A73B67A002EF3A5AC71BCC00945DFBB1F56C319B98CACCF10EF0E8B8F1F163F0
Malicious:	false
Preview:	BMv.......6...(...................@...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dialogBackgroundGray.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 10 x 24
Category:	dropped
Size (bytes):	374
Entropy (8bit):	1.7456253632245882
Encrypted:	false
SSDEEP:	6:2lfkOp2222222dIp2222222dIp2222222dIp2222222dIp2222222dIp2222222f:qEFFFFFFFFFl
MD5:	2068072848BB0F9AEE0C0C53755A86E0
SHA1:	0741B94EFD729AB0E71C4B5613D9856D9425B93F
SHA-256:	0DD79BDE0B2D581E1BCC10F40A5D09BF2A833FFF25A05CC92150AEB4B11F42B7
SHA-512:	A210BF3DDCD3A795091EA1AE01C461F249AB1642E46F16D7BA094F5F106B900BA2037CECE6CF4E8159F34A8F6B6CE1094FDFF781AEC1C05ADE8E89420DC7957C
Malicious:	false
Preview:	BMv.......6...(...................@...................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dlImageButton.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 1176 x 46 x 24
Category:	dropped
Size (bytes):	162342
Entropy (8bit):	1.9726207922214154
Encrypted:	false
SSDEEP:	3:AlllLhDlsl9/lGjlv1111111111111111111111111111111111111111111111N:SylfGjH
MD5:	7D2A780A05F478EF4044C7AAB4EEBD42
SHA1:	BAB3342FD98115ABDD035E63982DC4DFD98DFD82
SHA-256:	DED57492AB39F46D51C9009BC65B8B4E3554DC27285BAAB60E0B9FC079505FE1
SHA-512:	9D548B3307F3D6439B178F9CA81014FF2044611AB67AAE189AA6E01229914D949A427BEE7EB4A778DE6217955E8566EB38D54EAF298A2851E22A1BFFB603F92A
Malicious:	false
Preview:	BM&z......6...(....................y...................z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\dlProgress.png

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PNG image data, 121 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	243
Entropy (8bit):	6.214905302136987
Encrypted:	false
SSDEEP:	6:6v/lhPK4nMRFjhm+jnDsplRFC5ez7tExuDiHRj8IuhDp:6v/7i4nMIlzaxjRQNht
MD5:	76027E9C26C1097039E21726D822A12F
SHA1:	D5B4135A211E02BD52EC7F640CD796F97F62F077
SHA-256:	7DA30EFB432B8D156BC06E0834F0E4A9FFA90A858A91F6D62E4AED6E497ACDD6
SHA-512:	FDACF15B470406C177BD234F70EA7EFCB8CD61A230F6D40766E6E4BDD11D8F6A66A797560CDE6CD2745F0C3C4D20E6AC93356F2FC744620C309EFA5C03C34383
Malicious:	false
Preview:	.PNG........IHDR...y.........2.......gAMA......a.....sRGB.........pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<...cIDATXG..... .@..^N.........I....I...6.....w.z...\|./r_.j.\#..W......F.02.....`d.#.......(.<5..q..4#.c.$....IEND.B`.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\exclamic

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Category:	dropped
Size (bytes):	766
Entropy (8bit):	3.3484862648999827
Encrypted:	false
SSDEEP:	12:IX9VJL3hr4hZ7BUfBnsRhR0lsihSitWNmwAn8S:ItnVrsjUJsRhGlYitWNmqS
MD5:	3DBA38E7A6085876E79F162F9985618C
SHA1:	F89B4B20EB5379BA139BBED4FCB4246C7707A8A8
SHA-256:	593F94EF1405422B3E453F4422B22C990D84303668D60344C6FD257318E92428
SHA-512:	E8F1EAC1A9009C06DDD1CF99F876819B57B4D2798D02F93465487DD2FFFE3A4239F171FFB02D98DCA358BC47420205A2CC0877ABC02C6B21269C3D07EC78A836
Malicious:	false
Preview:	...... ..............(... ...@...............................................................................................331............332333333333333.33$DDDDDDDDDDD@1.2DDDDDDDDDDDDD..2DDDDDD@DDDDDDC.2DDDDDD34DDDDDC.2DDDDD@30DDDDD..3$DDDDD34DDDDD1.3$DDDDD@DDDDD@1332DDDDDDDDDDDC.332DDDDDCDDDDD..333$DDDD..DDDD1.333$DDDD#$DDD@133332DDDD34DDDC.33332DDD@30DDD..33333$DDB32DDD1.33333$DDC33DD@13333332DDC33DDC.3333332DDC33DD..3333333$DC33DD1.3333333$DC33D@1333333332D@30DC.333333332DDDDD..333333333$DDDD1.333333333$DDD@133333333332DDDC.33333333332DDD..33333333333$DD1.33333333333$D@13333333333332D..3333333333333"#33333333333333333333333...................................................................?...?........................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\info

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	2.8642269548572474
Encrypted:	false
SSDEEP:	12:hEipI3VFpSyZ9I7imddddGDxxOxzma3ZmRgRtqVtipMLXwHqfM:hEigFpTz1xA6aJmRgwi6LgHcM
MD5:	554FF4C199562515D758C9ABFF5C2943
SHA1:	9E3BAB3A975E638EAD9E03731AE82FA1DBCD178C
SHA-256:	9AE4A96BF2A349667E844ACC1E2AC4F89361A6182268438F4D063DF3A6FC47BC
SHA-512:	E302EDF3DAB3A0E9EEB5AFA34E4910EE177099C017B42F86847CF972143C87E8C40BC47689A3C8845051EAB98258A392CCAF331F414C271A1B6B751F503CE221
Malicious:	false
Preview:	...... ..........&...........(.......(... ...@.........................................................................................................p..............wp...............p...............p...............p...............p..........ww...ww........wp....www..............wwp..............ww...............wp..............ww...............wp..............wp...............w...............wx..............w...............w...............w...............w...............w...............px..............p............................................................................................p......w.......w........wx....w...........wwwp.....................................?...............................................................................?................(....... .............................................................................................................................p.......w..x.....p.......p.......w.................................................w

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\insticon

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.4065352120502395
Encrypted:	false
SSDEEP:	48:xS9gal8+Lry58nP0pB/ewjcYzrd67YQvaH8UyuZVyX:E9Zl8UOQGJ60Qyc7uZMX
MD5:	66C842AF0B4FC1C918F531D2E1087B82
SHA1:	CEB74A196559DB607824FDDC51D1243E1DEE491C
SHA-256:	48278165490487EE414BE65E20501B19A65EDAF1B6F473EB7D8C55023175EC88
SHA-512:	F7DE9BA9107DBB6C71B4F585EA54B571F469CF2815A3AB0DB2A408BA3ED794A5F0C21A987CBF5AE93197B7E5B6BFE3E78A75C2B56B5BA836C236B31563A7C560
Malicious:	false
Preview:	...... ..........&... ..............(... ...@.......................................................................................................................{...............w..........p..x....w........x...w..w.......p..xx..w~........x.....~........p..xx....p.......x.w............p...z..xxp.......x................z....x........xx......ww.....ww..w....w.....ww...wp...w.....ww..............ww..............ww.........p.....w.wwwwwwwx......w........x.........DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx............vfOx.........~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx...............x..........................p... .........?...?...?...?...?...?....................................................................................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\lzmaextractor.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12960
Entropy (8bit):	6.4556873449184895
Encrypted:	false
SSDEEP:	192:rTZlFHe2aR7qFnVIa3qMwH0JOqNG8Fp28Wh8nhV:rdferRet3T5JNNzFwhhin
MD5:	88CCDD0A39258E3301B6F67B9F450487
SHA1:	6CF049B7731AF3B204FFA6B84CF2C35AC631F8E5
SHA-256:	F5971E11699024E5BBCF05FEE4C32ECFED394A34010E49A1737ACEE05A6611D5
SHA-512:	A5A1AA8BB28B34ED0B1CA558625ED0925006EB171B39C82B4A0D648DFEB428D45C2B3320EE476BF4C0FE1B1B94BB17E9A9C784EE80ACCBE9CA95D0302A3B26CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tm.?...l...l...l.t l...l...l*..lQk.m...lQk.m...lQkLl...l..$l...lQk.m...lRich...l................PE..L....U[...........!................T........ ...............................`.......p....@.........................0".......#.......@..h....................P..T....!..8............................................ ..`............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..T....P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\publicSoftwareBanner.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 2000 x 180 x 24
Category:	dropped
Size (bytes):	1080054
Entropy (8bit):	0.8657325879428006
Encrypted:	false
SSDEEP:	1536:T0f5LKeE7qGlxEjdGyBc43KpMvAZFrk6yHPrt0IKE/RWpBMIt:CsyfKySLL
MD5:	FCC599B9CC44A38DBC6F1635461AB647
SHA1:	D488EF3795A29B3F0998B06C949276DB92D5BF3B
SHA-256:	83C9326DE5A0B3F34524D57985C9624741B387B6417FCCFC1EC8FA51645004B4
SHA-512:	B6D643B6469C130722CE2FF37002F6F02B51B61FEB08FD057579FBAFB951DC2EE2EE69C2D6854029E51A41715CD08967B5D9D018067EAB3657221C5A14BAC15E
Malicious:	false
Preview:	BM.z......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDoing.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 115 x 115 x 24
Category:	dropped
Size (bytes):	40074
Entropy (8bit):	1.434815195894921
Encrypted:	false
SSDEEP:	48:Tlib4A4t8lJAD9QDcVjC/JN3wvY9nF+F+gc6ZNTnewiIpA8AhM8RrHUfOuTQe8Hz:NN5hPjCn0akQgccNTnewUXyXzTGOE
MD5:	673F64A2575B5CD12A940117B1840EFA
SHA1:	8E4AC98E120CD96C675FA6E14D1CE47E7FE93CD8
SHA-256:	3596760E94D6A751DC03BF528DFF5E2852E17B38BBC95CFBA6699BC8D2F557CA
SHA-512:	F6EC6F075FEC9E6B4E93B42301E8DB075685E97B8514E2664BA5FE862CFFC77B70FC5A2C69E2DF3341496F0E975E8B5509A0F5AA5B4A7766AD01A18864117AC9
Malicious:	false
Preview:	BM........6...(...s...s...........T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioDone.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PNG image data, 115 x 115, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2521
Entropy (8bit):	7.864107382063005
Encrypted:	false
SSDEEP:	48:nfpydxbYFcZcgsL1uDJYWRx7ODYC5cJCTTgS3TjCUcSgoOSwIi78+El8+Es:fIdR0gsL8KWR5ITTg8T2UcS5z48+Et
MD5:	DE200D796FDBF0B5B731C7600BFAEC45
SHA1:	0108D89035F5D31D00920FBC19D5E6CE719927B4
SHA-256:	E57FFE806D2B90411309128AAED5FE991ABAFA01225FA20BF43F04CC05D9579E
SHA-512:	D6454615DF6D53B9ACA025B7AD127797F6E1D4458EAC3EFC8D039BB3E106DD173123980548F87D318B0E9E9B1499E00A30E95E8316992BB6E25DDC82C63BA764
Malicious:	false
Preview:	.PNG........IHDR...s...s......C=.....sBIT....\|.d.....sRGB.........gAMA......a.....pHYs...t...t..f.x....tEXtSoftware.www.inkscape.org..<....9IDATx^.yL....?s,,..........U..c...)JI\|4..r.(J..Q.Tn..j+.j........q.JNd...J..)ubS7.....9b.c`Yl`Yn..M.I.vg.......V;.-..~..k..?. ,A..',...$.B.L.......Yh.N@.g.n...!?..f`jn.&f.a\|z.f...b.W@.-..Q.....I.P.J`/;...P..q...;a!.ot.......Qh`._...acN"l.w.......l.....4...x.........&&..,.....jo..5?..9.....C...].<7..,p..&..k...h3c..m...'.p....9.k.2.b`.:......v.k.B......$~.~...I.=..(N._.^...y.9....98z..N\..Y..^.YM}zK6..'....2....b...q.t..3.)M...._ u.V.Pa.L.^.z.....<.ZT....U.!+...Cd.i..g...i.cMV9mp....T...c.U...<..I\|..~...<.-.^\|.P.q2..dz.g.`].\|.~..D.......e.J0nl..L.7>z.....yNd.!+..k......Y....6[......88}....&.....B.....=..J......m..<G....W.(....n.fx.....X8sp..5THw...8.8.L"..ol..Z....^h..}w.......!E......h...}...dN.q...j.f.~.6.......V..;!D.I./...>.i.u.p......._.8T......x.P.K....x..........)B-8....w.R,.[z..KcI.`.>...J.X..+.p.u...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioError.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PNG image data, 115 x 115, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3233
Entropy (8bit):	7.878303376957383
Encrypted:	false
SSDEEP:	96:pN5ALE04ITU2NsDVxkk51sUe26Gt2rQH2G+5PJ:j5AlhsLl262rM9u
MD5:	0EF26DD960994F218886FCFB97433CD9
SHA1:	B4A5B7A5CBA921C350CD0F3377CA05244C2A3578
SHA-256:	4EA2725625BCEEB0C716F7A3B1E38974D93830C762268A66CF032981ED3F43EF
SHA-512:	DD891A904449A08240DBB68B13E03E8CEFC899EBD325ABB111AA280157A16E4BAE298574158D53FA3688E141209FD93B8B1132BACF769D3105DA721B0D7A434E
Malicious:	false
Preview:	.PNG........IHDR...s...s......C=.....sBIT....\|.d.....sRGB.........gAMA......a.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....IDATx^..pT.....M6fs..........tF....8... b..P..T........E9.....D.H.:.W.......p%!.d.6...........w....d...d......{......A..^-..Kf.a..",.A.).@-...).oa!x.WOa.4WTB...-...r.&@cS./...-2.l........I...d~zBx...-&..wM.)d6]...'.}.$......../.................saX..s..W^...8..R.j..G.D...1S'3..~...C.l....D..QT_.....'...I. .S.E..!dz.~...o@.....b.E.EHX.#t<$,...^=)j,t.y..g..ko@../.+..l6..9.:....../....2[..j.*........"$4....9.....V&s....A.W......&4).....b.Lf.f.E.A3.x{Q...p.o_R$...9...}...M...h".n.'P....z.fl....!z.X.h..2[o.....[.{...OA.....6.&....\.>..N...E....e.V.wL....".../M..../Q..$,.+.....T.^...NC...y.Hc.E(.9..N}M.uQ.d.C..S....z.X .0J..."....:(&..Spq..l...n...u_.D..G..QD&>./{l<..\.....!..>..8..E.e.-..{a44..S....W.v...uM..r.j.......D....U.......H..%.bq.x.~C9......2g).C.LW.n..p;.,.R...\.{)....3....=.6p.B2.u.~.b...L.}..-....bQ...

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioPending.bmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 115 x 115 x 24
Category:	dropped
Size (bytes):	40074
Entropy (8bit):	1.2683920260243833
Encrypted:	false
SSDEEP:	48:uhi3lCjH137NsBxDEL7pvCcNLT2CRKKBm4AErWDSfM712JeEMQjiYtS2VVf8Z+n0:uSO1hsfYxqSPxfAXFI0l/Vr
MD5:	43824AB2C94B0A12EF747DA1DB2B0489
SHA1:	231E497C235DCD86E04AB586A88627A05A37920F
SHA-256:	5E73558FBA12F062107E9AB9CB70D2C138FC4635738C13978DAAA73D2424BF1B
SHA-512:	0BEC55B7264939E37BCC4B36E718A4296A44B290ED2D3A934EDDE4AC503DCAF0F327ED9F77C2C1413504CA4455FE2B7CA04252644F06D4CD1335234926A6F934
Malicious:	false
Preview:	BM........6...(...s...s...........T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\radioWaiting.gif

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	GIF image data, version 89a, 115 x 115
Category:	dropped
Size (bytes):	76317
Entropy (8bit):	7.625936445519031
Encrypted:	false
SSDEEP:	1536:lBtNPdtzsecZThJlVXg9Ok6DG48e19hVJSemIk81/RRGB82jOmi:lBVtziZvwQBhOema1vGy2jOt
MD5:	DA786DA31E7231C7DDABABF3F87B0E2E
SHA1:	A013F2BFF699F3D4CC263F5611DB36115B664ABC
SHA-256:	1029BEFF65A5EC7B3CFB11882ED6F5E9C9DE585EC04F9329039AEA6E56F3C9FD
SHA-512:	830E7FAF8A5B09FCA2794306706CBEBA98B77236DA3FE468DF48D3CCFA38448D73C68DCB636E93964B4D0DCD00256AEFF7605A0B72089A8F8566B80B5775AA5A
Malicious:	false
Preview:	GIF89as.s....R..k...........q.3..q..b...\|...C...y.#..).........x........{......y...t....K........9....I........B...v..i....Z...\|.3...m.=........y.....r..}.}...l.......".......Y......................~.....~.-...b....]...\|.....t.....e.......;..h...x.....v........v..q......a.........t..............y.......................m."...\.u.....y........x.!.........u.......p....(.. }.....n.....j.P..+...r............B...........m.(...}....Z..U...g...........{...`...i.........q..z..............p.....n....g..p........._.....y..z....i.U........I...w.5..............n.~...........O.......W.........{..e......................................................................................................................................t..t..c........i."\|....g........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\removico

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.922835628524122
Encrypted:	false
SSDEEP:	48:lx5VMqHDL/nm+ry58nP0pB/ewjcYzrd673bOyGZPmLRPRKnIn8m1:/5VM6DLvm+OQGJ63HYwRem1
MD5:	20D25E871A244B94574C47726DE745D6
SHA1:	1FB26622978ECD2D00B107D83C1AD61366452214
SHA-256:	88DD7EE9FA22ECDBDC6B3D47DB83BC3D72360AEB43588E6A9A008B224389CB1C
SHA-512:	AEE04C9BE3C65676ABF2C8E20E9F6A954539C23E9BD4971539D3A86B45C7C85A5E62BAEF0C465345909C602C5B70CD86B7112B3F24ED9DA69EC27D81D59A7F71
Malicious:	false
Preview:	...... ..........&... ..............(... ...@.......................................................................................................................p.........................w......ww............w.f.w......w.....vvf.w...........nffl.w....w......w\|.w...........g.w.w....w.......g.\|w...........g.w\|w....w.....g...\|w............wwww....w....g..tDDw.........~..w..w....w....~w.w\|.w...........ww..w....w.......ll.w..........~ff.tw....w......vlgtw.....wwwwwwwwwtw....w.....wwwwww.....xD\....wwww.....Gwww....w.w.....e..p;....w......v_....{{..p.....we....g..........v\!0~v{.7.p.........o.g.p8p........{4o.?..............o.8..........0.3F........................?...........................................................................................................?(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\repairic

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 32x32
Category:	dropped
Size (bytes):	2998
Entropy (8bit):	4.667661526304198
Encrypted:	false
SSDEEP:	48:P81Vf/JWPhry58nP0pB/ewjcYzrd67jQPawP4y9ttO46uylABWPE:wxWPhOQGJ6nQSujtx6plyWPE
MD5:	D234CA0358B21BDCFC5E3F9B2E7C7A22
SHA1:	95356780EA21C43A129FA560365FE5B7A216CC8E
SHA-256:	99D490C2BDEF5115F306A595964663540370141F65A25C5052352155F2603F68
SHA-512:	AE47D796C758E53FC7AA183CD8754EE382ED19A6B2F1834167E896F3A31260260F9B02E20D5403557B78A1C36FFF1423B8A742B20970C20F169F9D3AEA48C4EE
Malicious:	false
Preview:	...... ..........&... ..............(... ...@.....................................................................................................................w................{..................p..........x.{.wp........(...{.w.........(xxx............(......w........(w~...xx........(~......www....(.z..xx...w.... .........w.... .....p........ ............. ....w......p... .....wwwwwx....p..........x...".....DDDDDOx..........vfl.Ox..........wff.Ox...........vflOx...........wffOx...wx.......vfOx....w....~..wfOx.........w...vOx.........w~..wOx.........DDDDDOx.....w.........x.....w.............................................................?.................................................................................................0...........................(... ...@..................................................................................k...H...%............z...b...Js..2P.............k...Hs..%W...U...I...=...1...%s...P.............kk..HH..%%....................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\tabback

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 200 x 24
Category:	dropped
Size (bytes):	854
Entropy (8bit):	3.802531598764924
Encrypted:	false
SSDEEP:	24:kUGGGGGGGGjg/QUVdLbCKKKKKKWqqqqqqr:kGUVdnCKKKKKKWqqqqqqr
MD5:	4C3DDA35E23D44E273D82F7F4C38470A
SHA1:	B62BC59F3EED29D3509C7908DA72041BD9495178
SHA-256:	E728F79439E07DF1AFBCF03E8788FA0B8B08CF459DB31FC8568BC511BF799537
SHA-512:	AB27A59ECCDCAAB420B6E498F43FDFE857645E5DA8E88D3CFD0E12FE96B3BB8A5285515688C7EEC838BBE6C2A40EA7742A9763CF5438D740756905515D9B0CC5
Malicious:	false
Preview:	BMV.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6084\tempFiles.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179360
Entropy (8bit):	6.66273052333922
Encrypted:	false
SSDEEP:	3072:C6g9WJSimJWLHKfo9m/sxfA+mPWAg0Fub/8drAAAAAAArK/9R:B2imTfootuAODUAAAAAAArUT
MD5:	47F84947E6374F8707129C36833212D5
SHA1:	A317BCC7368756101519E28F8036104A6022766F
SHA-256:	B79DD5190E2C885F12CF54DCF0BB0AFC72CEA4FFCB21376685F028D235F9771E
SHA-512:	48788FE16986E30C03D465BD5C088B02CFBCD0851DA7AE7BB27F08BFA6E1C2FA6FA7FA1F946B803E36D12F9BD568E146E7911F185CA187B816F39C38D4230888
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................fJI....fJK.^..fJJ..........................+.......P...............G....../..........Rich...........PE..L....U[...........!......................................................................@.....................................<...................................0e..p............................e..@............................................text...?........................... ..`.rdata..............................@..@.data................t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	54324
Entropy (8bit):	5.060081960611842
Encrypted:	false
SSDEEP:	192:S0m9zyTuJC8MEiLCHRoURbi79B0019m+/fbEa5Aq3j2812sFDEoLRy+mEfw0HMO6:0iw0eoPjrnsFRH04RGVhl/d2m7a
MD5:	A303F468BCCCB3027002972A9360BAE1
SHA1:	A248F96991FD851A2D2B77BAC8183621F609D046
SHA-256:	067147B39764139697994A653654409DFC0FEFEEC1FDED7B78B634122AB48A96
SHA-512:	AFF7F0F332DE56A0DDA3B08D94F1FB46F69BBFA7D135A3B653FC3EFCCBF668041092FFB281756338220759452A629EF5C8B16C724832F1D50EE067D63F4C10B1
Malicious:	false
Preview:	0..0..*.H.........!0......1.0...`.H.e......0.....+.....7......0...0...+.....7......$U2W.B.?9S.k..211220144326Z0...+.....7.....0...0....X.....Di.T9nm..z....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0....eD.j..&.48TI./ZS.V..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0.... \|.ZM.vj.......c.@.h...su.m`..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... \|.ZM.vj.......c.@.h...su.m`..0.... ...(!.9=....(._..A.y..U..}.8.].x1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49264
Entropy (8bit):	5.63834744380481
Encrypted:	false
SSDEEP:	384:qiWBdTktSfb1E+HDXSby46qXlCmzQi95ZGULNKkE9xkn2n8ndn1n9eEE6haemssA:gbNbSAqJBBR
MD5:	8FBE14953AAA9D99F4CCE7CF8240EF3D
SHA1:	6544FF6AA79C261F34385449902F5A53CD56DBFE
SHA-256:	7C965A4DE6766AE31395F906AA1863EB9C40C4A16888A3C5807375166D601915
SHA-512:	4D200D8D581DC63C395E206963853ED771A0472EDC77D05CAE169D228D9E79CF0CE0D3E38C72A762D09A4BEC4487D752EE3EBC1B1385401AF723C88C1CF7478B
Malicious:	false
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2021 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 10 x64 Windows 11 x64....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..PnpLockdown = 1..; 11/24/2021,12/07/2021,3.64.0.20958 For Windows 10 RS1 and later..DriverVer = 12/20/2021,10.2.6683.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}........;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 10.0 - Windows 10 and later..%S_Mfg%=_Models, ntamd64....;****************************************************************************..; Models Section..;-------------------

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x64\dl-usbnet-ncm.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142512
Entropy (8bit):	6.529689914382159
Encrypted:	false
SSDEEP:	3072:Ap88ONMs5ZB+OV+SzAN7/RoF/RstnSiS2112:Q8DMMB+OURNNogSfa2
MD5:	9E58B65E1B63FF136FCA209AED36B729
SHA1:	3794975870B6DD81A8112BCD17452AF7DE6A4E15
SHA-256:	602D1B0D45831F803D5E045B0C4D38E6264C6F4817BA536CA6BE4A97B8A2A9B9
SHA-512:	85A90C998563BC0090A91CB69EC0D14BD62146E2906AA83AF704393678FCD24252AA9232D96524B3906B9CC7CFFEF4510361E057888E74B45752369F83BE49B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........)X.....)X......]o....)X..........)X.....)X.....#^.....#^)....#^.....Rich...........PE..d...Z9.a.........."..........X......Pm.........@.............................`....... ....`A................................................00..P....@...................@...P......0...T...............................8............................................text............................... ..h.rdata..H(.........................@..H.data...............................@....pdata..............................@..HPAGE....u.... ...................... ..`INIT....\....0...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	55971
Entropy (8bit):	5.214854959109016
Encrypted:	false
SSDEEP:	192:4R4J24JCHMEiLCHRoURbi79B0019m+/fbEa5Aq3j2812sFDEoLRy+mEfw0HMOVd0:40Hw0eoPl/k6h3Tp4ATKAR9zLflI
MD5:	A17A1D49D0CCB1C31FCEAD1AB5C29E4C
SHA1:	80B006F52518B81CA34779ED1630B5859B7CD28F
SHA-256:	0A6A6B8360688D2B2ACCCEF396B7DFCE5DD4892F09039FD973B40489F2475EE6
SHA-512:	494FB18A9E6D34C404B68FEFB21C69D69D889B1BA59185EBDA7DC17B3B1F382F132A1D46268FA21BB9D4913BA39AF39C4B01116F058DC8324F39AB26F2CEE399
Malicious:	false
Preview:	0.....H.........0.....1.0...`.H.e......0.....+.....7......0...0...+.....7.....Y....NI......Jc..211220152529Z0...+.....7.....0...0.... ..b!...+...L..c.w".....Au..v1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..b!...+...*L..c.w".....Au..v0.........u.L.UJj.Q.+Z.01..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0........y......Huri.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0.... .......i.xo......B3........y.UH1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48291
Entropy (8bit):	5.662944047616262
Encrypted:	false
SSDEEP:	384:q5f1tY7js1E+HDXSby46qXlCmzQi95ZGULNKkE9xkn2n8ndn1n9eEE6haemsstFV:szksSAqJBBI
MD5:	C9226A47200F6427774BE186F9722656
SHA1:	B8E9C18F79041200FE978948757269838396F494
SHA-256:	DDDFDC8AD7FAF4EF6906786F8C808012F314423387F8881DC62E14AA79D75548
SHA-512:	8CE61EEAE8C8C0AA29EA6CD3823FA2A36B11D14341706083C94A1F14D157BAC79B360F7071B5A5E6A36DB57B214E4336C729A97BB6B2C886845D9F851F397A6C
Malicious:	false
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2021 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 10......;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..PnpLockdown = 1..; 11/24/2021,12/07/2021,3.64.0.20958 For Windows 10 RS1 and later..DriverVer = 12/20/2021,10.2.6683.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}........;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 10.0 - Windows 10 and later..%S_Mfg%=_Models, ntx86....;****************************************************************************..; Models Section..;------------------------------------------

C:\Users\user\AppData\Local\Temp\DL2.tmp\DL-USBNET-NCM\x86\dl-usbnet-ncm.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118096
Entropy (8bit):	6.773752255554001
Encrypted:	false
SSDEEP:	3072:KlYWMTLzWIzSchTEzIV1I0a9jWonrxcz2xf5cVZrOUh:KhMTLCe5Q8Hza9jWcrxUVT
MD5:	23FF5CDEC7E56D72355679ED39AC760D
SHA1:	386AD969F2FF63DDF3F77F8FEA23FB9CCE76E9A1
SHA-256:	CDF766E4416823CB6C99B7F1FB8B9138AA7D430A9A73D6D73CB8D2E357559211
SHA-512:	42651B8E6E4C2C053D442A9389BA7173199747818ABB79FDE90A2D5C9FCB7D3E57EBB8BCC4F0E459E0B361E9B02332731657174409AEC4888B5F798C5A440B20
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j............J.......J.......e.......J.......J...............J.......@.......@.......@.......Rich....................PE..L...O9.a.................V...4......P-.......`....@.................................><....@A................................ ...d.......................PG...........q..T...........................`q...............`..\............................text....H.......J.................. ..h.rdata..p....`.......N..............@..H.data................d..............@...PAGE.................f.............. ..`INIT....v............h.............. ..b.rsrc................r..............@..B.reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17413496
Entropy (8bit):	5.528506150344374
Encrypted:	false
SSDEEP:	98304:TZoGd3lN1+eTQPf1himxPPrHWPgZXk60wwgtX73Z8y2THJF4Xz0ojM8Pt3rm2eSs:pdLbTQ3d37WIe6tXl8yQLBojM8PxkW5s
MD5:	F501A103478D855B0088A41117A4D4EC
SHA1:	AB6747BDDDA6E6F67DC13307D5DF88D6C28B8C14
SHA-256:	363BA5694D1E3DB4F27D8E4D0A53BB7095C93C22C9F6C8F6BEE637AC236F4BBA
SHA-512:	BB0578955AF5FABFC6CB47A1E31EBF50C90628B8856BBD27BB61F718E17A2332F5B07B61863A5590B7B3D1DAE735E0C381172D3AE281417A7E559198D04662AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........{..........D4.....D4..T...D4................................................S..........................Rich...........................PE..L...b.U[.................V..................p....@.................................C.....@.....................................(....@..H....................`..lQ......p................... ...........@............p..........`....................text....T.......V.................. ..`.rdata...M...p...N...Z..............@..@.data....p.......$..................@....rsrc...H....@......................@..@.reloc..lQ...`...R..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.tmp

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17413496
Entropy (8bit):	5.528506150344374
Encrypted:	false
SSDEEP:	98304:TZoGd3lN1+eTQPf1himxPPrHWPgZXk60wwgtX73Z8y2THJF4Xz0ojM8Pt3rm2eSs:pdLbTQ3d37WIe6tXl8yQLBojM8PxkW5s
MD5:	F501A103478D855B0088A41117A4D4EC
SHA1:	AB6747BDDDA6E6F67DC13307D5DF88D6C28B8C14
SHA-256:	363BA5694D1E3DB4F27D8E4D0A53BB7095C93C22C9F6C8F6BEE637AC236F4BBA
SHA-512:	BB0578955AF5FABFC6CB47A1E31EBF50C90628B8856BBD27BB61F718E17A2332F5B07B61863A5590B7B3D1DAE735E0C381172D3AE281417A7E559198D04662AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........{..........D4.....D4..T...D4................................................S..........................Rich...........................PE..L...b.U[.................V..................p....@.................................C.....@.....................................(....@..H....................`..lQ......p................... ...........@............p..........`....................text....T.......V.................. ..`.rdata...M...p...N...Z..............@..@.data....p.......$..................@....rsrc...H....@......................@..@.reloc..lQ...`...R..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Microsoft Cabinet archive data, 2366 bytes, 3 files
Category:	dropped
Size (bytes):	10342
Entropy (8bit):	7.597236471941108
Encrypted:	false
SSDEEP:	192:/T9IF5jRfoDPKNO2pAVmcb8J6PS7HvDWpHdZHRe7x0ZRsaxS:CF5Rfo+ikcgcPOvDGdhOyY
MD5:	DCCDF3EFEBB7228209305F79F0845471
SHA1:	226418FA4E0DCAF9CD5E9B2692BF9ADDE558B345
SHA-256:	6698C83BCD7A449DCB31C6A0AC9DE8F5E49BD66351AC48AFFB158E59FD0B3C81
SHA-512:	5160924F7E3AAF02BE8500A43D3FC44E3D86F67FBFB2AE7B6C7B1E682EF86B29371F733064E0352C78DE58A04A1D23267DE6C70F26EC9F143C151EB066A5E400
Malicious:	false
Preview:	MSCF....>.......D...............I...........>...(.............................6Tzq .AddProduct.reg..J........6Tzq .ImportSettings.reg......P....6Tzq .RemoveProduct.reg...3/.. ^CK.mo...........]i..=d......6.VM..j..Qp...`.4[]...6....klo.NQe..s.`....0..]&].....Ir...T..i..H2....w...._?./'...=9.}p........%..4...U.....f.t.z.........&q.z?..'[....w].....G....#.2.CW.]...........5.8}Kv..>...c}..-..N'...FJ.W...(.@..CC...:]N.......~.g.....z..).PU.z..(C^.._V.R..:................,.84.......~}..ZH...Y....oU.....(gTH.%..F.J.R..~-Y.`...y.H7..Cr-..d..P.}0...F.'z.C..U..2u...Q.=>U...s+.J.A.C.N7..bU..qG.........f.~V..SJz.]P.Z^..t.h.).Z..]..j-S....Xz...O...\|e..].V..mv.o...g.....I....U.`.+."...+!.o".{.G.......A..b...o.BU..oK..!....>.;.aB.p......w..n.wY.$q.... ..&..a.v..0..+G&q...[].g.}l..9:j..^%...Qy._....-f.`."l%..i.^...\|... ...7;`.aGuW*..../<.X......)x~.mc...w`'.........C....=M6..T..[x..k.{Q.........a.G...>.$s.GA.n..)L....ze..5s.kY..?M..X.5...^..g ..G../..q..@[{^

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	56089
Entropy (8bit):	5.144135786553492
Encrypted:	false
SSDEEP:	192:vN5uXj72tJCjxMEiLCHRoURbi79B0019m+/fbEa5Aq3j2812sFDEoLRy+mEfw0HU:vteAw0eoPjrnsFRyMTN4tgR9zahVM5
MD5:	5CA13A2659A7C744C67EE74B65668440
SHA1:	51C4AD245BC0DA86CB5A19B9E836FCF41DB425C9
SHA-256:	065613F46C7A7C32DD78ACD7B9533C6294AE274B0056E060DA7A546915E269B3
SHA-512:	A0D634EA8F7B843150B3D436AD772373245BD936F8C9B6BC5F0D5DCB93CD83BDFE7BCB119C9B00ACBCB795D236FE42F3E72BC427ECA25A3BA46A058EBC38913D
Malicious:	false
Preview:	0.....*.H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7.......FnRm.A..>/W.....211220205436Z0...+.....7.....0...0....R5.C.6.E.A.F.9.E.0.F.4.4.1.9.5.5.0.3.D.F.7.F.7.A.7.3.C.6.4.9.8.3.C.9.3.F.E.D.1.5...1..70<..+.....7...1.0,...F.i.l.e........d.l.c.d.c.n.c.m...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........\n...D.U...zs.I..?..0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R9.F.5.A.B.E.A.4.E.3.D.0.A.9.B.D.6.B.1.7.3.3.0.C.F.B.2.3.3.5.C.0.F.2.0.6.5.B.9.E...1..C0@..+.....7...1200...F.i.l.e........d.l.c.d.c.n.c.m.6.2...s.y.s...0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........Z.....k.3..#5...[.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RC.D.7.4.E.E.8.A.1.6.2.6.B.B.F.9.D.5.3.E.2.5

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84949
Entropy (8bit):	5.573924006527727
Encrypted:	false
SSDEEP:	384:qcDsVGkJCJYQkyAJ4rXmJYone7g7Kpp0mudYqfEIN9pKXUJE6UO+lJa+kukukonR:NDD6DUAJemJY17JH
MD5:	C6F7180011DB92BF9BA4AD7556302043
SHA1:	5C6EAF9E0F44195503DF7F7A73C64983C93FED15
SHA-256:	7291CC13E73CE5D6FDD6EC8F679227BBBE84E343C3BD25C845655E2BF5B86571
SHA-512:	F02AD2DFF429DCCD0584BBE2F3565C5E4AF614C181C9E751984EC3C4E9D906D2EE5C28E68748B8303C2D102F9EAC5438015FFE2AF61EC1CF1073DA1693A38863
Malicious:	false
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2021 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 7 Windows 7 x64..; Windows 8 Windows 8 x64..; Windows 8.1 Windows 8.1 x64..;....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..; 24/01/2019,2.34.27.0..DriverVer = 12/20/2021,10.2.6683.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}........;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 6.1 - Windows 7 and later..%S_Mfg%=_Models, ntx86.6.1, ntamd64.6.1....;****************************************************************************..;

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67896
Entropy (8bit):	6.7598844516825825
Encrypted:	false
SSDEEP:	1536:UrP0EHgsIYwCcSAMoTmQuh/s+1ZNYLltcrAvQgVg90s2n:UrsQgsIYwCcSAMoKQKsgjYZ4C7g9G
MD5:	AC5C50E5C5D2E09D863B07D35EAF1B38
SHA1:	5DDD46D8D2BBDE974AD26AE5E75F91E013FD6ADF
SHA-256:	99B1FAE6FB34845C2602B1F523DB7F79A20E010753C8E84191721A38122407D5
SHA-512:	0D33AFB32445BCB680F5B41031482E3AE19BAD372BB0CEF5C1921743399E7FC66567CDBA412FD79ECBD812C55EDEADB31E7CE5324B860E72623AB7C0CE0A16CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v@.N...N...N...+q(.O...Go..M...Go..L...N./.7...+q/.G...+q-.J...+q*.H....~'.\|....~.O....~,.O...RichN...........PE..L....^I\.....................$......@.............@.................................".....@A................................<...x.......................8?.......... ...8...........................X...@...............\|............................text...X........................... ..h.rdata..`...........................@..H.data...............................@...PAGE................................ ..`INIT....8........................... ..b.rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCDCNCM\dlcdcncm62_x64.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82800
Entropy (8bit):	6.527921530734939
Encrypted:	false
SSDEEP:	1536:C999X4dLmMTjlbuKvPrBJQ3yNLY8hIpONqV7IBSymHnbjQdg95s2MFz:Cl4xmMTjBuKHrCu5hI+nm7jAg9m
MD5:	4111392FF099D798B233D35494EF197C
SHA1:	B94A5C281EBBFE500A3C6424ECA8A99EE8B62D31
SHA-256:	F3B7758D35D49DB5CD9B6E951D2BBB8D648B419E506ECA3C2CA76EF597620506
SHA-512:	C166B0C1CEEC4A985599C0F388D525B61089D78DB3E9060F4C21715EA022D39C75C36774203A161D4679B1D74618535633409537DB07A15BA288882E9AE5AAF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t .O.N.O.N.O.N.sH.N.N.Fm.L.N.Fm.M.N.O.O.?.N.sO.F.N.sJ.I.N.sM.K.N..\|G.}.N..\|..N.N..\|L.N.N.RichO.N.........PE..d....^I\.........."..........<.................@.............................P.......C....`A................................................d ..x....0.. ...............pC...@..P...p...8............................................................................text...X........................... ..h.rdata..............................@..H.data...P...........................@....pdata..............................@..HPAGE....h........................... ..`INIT......... ...................... ..b.rsrc........0......................@..B.reloc..P....@......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.cat

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	54324
Entropy (8bit):	5.060081960611842
Encrypted:	false
SSDEEP:	192:S0m9zyTuJC8MEiLCHRoURbi79B0019m+/fbEa5Aq3j2812sFDEoLRy+mEfw0HMO6:0iw0eoPjrnsFRH04RGVhl/d2m7a
MD5:	A303F468BCCCB3027002972A9360BAE1
SHA1:	A248F96991FD851A2D2B77BAC8183621F609D046
SHA-256:	067147B39764139697994A653654409DFC0FEFEEC1FDED7B78B634122AB48A96
SHA-512:	AFF7F0F332DE56A0DDA3B08D94F1FB46F69BBFA7D135A3B653FC3EFCCBF668041092FFB281756338220759452A629EF5C8B16C724832F1D50EE067D63F4C10B1
Malicious:	false
Preview:	0..0..*.H.........!0......1.0...`.H.e......0.....+.....7......0...0...+.....7......$U2W.B.?9S.k..211220144326Z0...+.....7.....0...0....X.....Di.T9nm..z....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0....eD.j..&.48TI./ZS.V..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0.... \|.ZM.vj.......c.@.h...su.m`..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... \|.ZM.vj.......c.@.h...su.m`..0.... ...(!.9=....(._..A.y..U..}.8.].x1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.inf

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49264
Entropy (8bit):	5.63834744380481
Encrypted:	false
SSDEEP:	384:qiWBdTktSfb1E+HDXSby46qXlCmzQi95ZGULNKkE9xkn2n8ndn1n9eEE6haemssA:gbNbSAqJBBR
MD5:	8FBE14953AAA9D99F4CCE7CF8240EF3D
SHA1:	6544FF6AA79C261F34385449902F5A53CD56DBFE
SHA-256:	7C965A4DE6766AE31395F906AA1863EB9C40C4A16888A3C5807375166D601915
SHA-512:	4D200D8D581DC63C395E206963853ED771A0472EDC77D05CAE169D228D9E79CF0CE0D3E38C72A762D09A4BEC4487D752EE3EBC1B1385401AF723C88C1CF7478B
Malicious:	false
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2021 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 10 x64 Windows 11 x64....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..PnpLockdown = 1..; 11/24/2021,12/07/2021,3.64.0.20958 For Windows 10 RS1 and later..DriverVer = 12/20/2021,10.2.6683.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}........;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 10.0 - Windows 10 and later..%S_Mfg%=_Models, ntamd64....;****************************************************************************..; Models Section..;-------------------

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dl-usbnet-ncm.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142512
Entropy (8bit):	6.529689914382159
Encrypted:	false
SSDEEP:	3072:Ap88ONMs5ZB+OV+SzAN7/RoF/RstnSiS2112:Q8DMMB+OURNNogSfa2
MD5:	9E58B65E1B63FF136FCA209AED36B729
SHA1:	3794975870B6DD81A8112BCD17452AF7DE6A4E15
SHA-256:	602D1B0D45831F803D5E045B0C4D38E6264C6F4817BA536CA6BE4A97B8A2A9B9
SHA-512:	85A90C998563BC0090A91CB69EC0D14BD62146E2906AA83AF704393678FCD24252AA9232D96524B3906B9CC7CFFEF4510361E057888E74B45752369F83BE49B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........)X.....)X......]o....)X..........)X.....)X.....#^.....#^)....#^.....Rich...........PE..d...Z9.a.........."..........X......Pm.........@.............................`....... ....`A................................................00..P....@...................@...P......0...T...............................8............................................text............................... ..h.rdata..H(.........................@..H.data...............................@....pdata..............................@..HPAGE....u.... ...................... ..`INIT....\....0...................... ..b.rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	281790
Entropy (8bit):	4.405563846529568
Encrypted:	false
SSDEEP:	1536:/JVR/lqHZioRO7MK6gOuGG+OmGQOpHFaG6+iGyJNRv1XpX1qHf3n/X//H/eA6IOv:an
MD5:	6CA78854CF5DD459078BA113A5C19889
SHA1:	8F6BE222E7AAB3D3AFD30F79EE3130268AF12CFC
SHA-256:	1910D1359EE6A232B9A20FABB0767FA22A6ED2AE0C68A71855092CFF93DC9575
SHA-512:	17B25E2F9E861CA93699CFED95D020112027CC0ACCF7E52F473BBFDC4A91E2772B8BB9706F8A2C0F9FE3973AD30041AEECD8500559DD354215A3D52B90AB08CF
Malicious:	false
Preview:	0..L....H.........L.0..L....1.0...`.H.e......0..+z..+.....7.....+j0..+e0...+.....7.....E.....C.N...5...220113023555Z0...+.....7.....0..<0.... .RN...U ..&.....&3.2.m..>..&.W71..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........d.l.i.d.u.s.b...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .RN...U ..&.....&3.2.m..>..&.W70..". ..@'....t...j9?.o.~v>.j.%H.3.I.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..@'....t...j9?.o.~v>.j.%H.3.I.0\..+.....7...1N0L...F.i.l.e.......:f.i.r.e.f.l.y.-.m.o.n.i.t.o.r.-.r.e.l.e.a.s.e...s.p.k.g...0.... 3..9.s...s..!....R.,J.......#..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........e.l.l.a.-.d.o.c.k.-.r.e.l.e.a.s.e...s.p.k.g...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... 3..9.s...s..!....R.,J.......#..0.... 6.+.Q...`$%2V.O..,

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9039784
Entropy (8bit):	6.790261982437218
Encrypted:	false
SSDEEP:	98304:okFDXuDj0Rdd3ZnwpkxXo1W9yYU+65kh120K5KwAqyxfEsyiurG3QKs7asMBMao:okFDq0RT3ZwqxY49yYU+65kh12F
MD5:	0F9558E52592336CC55F57A19A699288
SHA1:	4948D64CD2B36B087343B6F2ACD0BB010D925803
SHA-256:	9CAFB4DE282C2690612139B47CBC0EE85878CE129C26986D7FE05C870138C224
SHA-512:	E4E07296961643062192E438DCEF2FB8D73A974E1093D41D226AAAF41C989642585EAB2286D5B11A8CB267D8BC464B45D9D96582EAAEF8538D66565FDDA94BDB
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......@aus... ... ... _h.!... _h.!... .m.!... .m.!... _h.!... .n.!... .n.!... .m.!... _h.!... _h.!... .x. ... ... l.. _h.!... .n.!6.. .n.!... .n. ... .n.!... Rich... ................PE..d...n..a.........." ......O...A......09..............................................U....`A.........................................4u.P...@5u.................lW......!..........P.i.T.....................i.(....g...............O......3u.@....................text...\|.O.......O................. ..`.rdata....%...O...%...O.............@..@.data........`u......Hu.............@....pdata..lW.......X.................@..@.didat..@............F..............@..._RDATA..............H..............@..@.rsrc................J..............@..@.reloc...............N..............@..B................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	494965
Entropy (8bit):	5.1490366489007116
Encrypted:	false
SSDEEP:	768:cJ4TtB/87BW/yKVEik+Vy4upYRobXlDWvbcTaQX8Uii3IoKzcunaTYD9rv0Ino7b:Fb6BxKy26HpUbLQMEiJJtvjogQjjPD
MD5:	E6A47A25C29BDE9B35F10FD7A69C2436
SHA1:	A0F76547D89084F4C9631D9B185A25ABC31D6D23
SHA-256:	14524ED082B9155520B9D726CA1EE3EF0A26330232E66D86D03E9C0C26AE5737
SHA-512:	A4156190320A81FDD8A69C3250C2BD6616FA77926AF9D9D01D720070237EEB65D15B10E2B6B6F5E4060FBA6AEC2D1AAD232F757171EA9A3F4D57FFEFEAA14D69
Malicious:	false
Preview:	;.. ; Installation inf for DisplayLink USB Display Adapters... ; Copyright (c) 2016 - 2022 DisplayLink (UK) Ltd... ;....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=dlidusb.cat..DriverVer = 01/10/2022,10.2.6709.0......[Manufacturer]..%ManufacturerName%=Standard, NTamd64, NTamd64.10.0...16209, NTamd64.10.0...17134....[Standard.NTamd64]..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0010..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0011..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0012..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0013..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0014..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0015..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0016..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0017..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0018..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0019..%DeviceName%=dlid

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb2.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9039784
Entropy (8bit):	6.7895293125406315
Encrypted:	false
SSDEEP:	98304:BkY22UQ/B5YM8kq4iPZXE1A9yYU+65kh12UDTuwgGtoR7hsZUHQSJmUYuJ2MBM/:BkY2UB5T8kZwZ0e9yYU+65kh12vK
MD5:	94383CBA2D0106698AD7F9DE33D5481F
SHA1:	6BB573F181227D7D1118E8AC80AC1F7F8013C981
SHA-256:	C8B5C23AAC78EFAC9563BB6772BA7465D377183ED67F413E085261356CA92B53
SHA-512:	762D4C7422A0C41C703055238D1B1EDABF612C1A622EF52D4B09105EE5F67AC418D408FB9F846C7D4E622DCAEC6364F764316D2FBDF71602DF0AC742D73F6B96
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......@aus... ... ... _h.!... _h.!... .m.!... .m.!... _h.!... .n.!... .n.!... .m.!... _h.!... _h.!... .x. ... ... l.. _h.!... .n.!6.. .n.!... .n. ... .n.!... Rich... ................PE..d.....a.........." ......O...A......09..................................................`A.........................................4u.P....5u.................lW......!............i.T...................h.i.(....g...............O.....X3u.@....................text...\|.O.......O................. ..`.rdata..V.%...O...%...O.............@..@.data........`u......Hu.............@....pdata..lW.......X.................@..@.didat..@............F..............@..._RDATA..............H..............@..@.rsrc................J..............@..@.reloc...............N..............@..B................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlidusb3.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9041320
Entropy (8bit):	6.790593565673882
Encrypted:	false
SSDEEP:	98304:P+T2M/bhEUxNK/J29QIXMx0IIdqoM9yYU+65kh12MR2cbkfhmWBoKG14t0yE5hVp:mK5MNKo9QYk089yYU+65kh12MF
MD5:	AFFB47E02D4EA5C3A9C4260822BAB14A
SHA1:	20C78369D70BD41994C61E2D6CE0E1B2837D5F8F
SHA-256:	AAC436DF591D7F813FCB7C49AB4649529C5268F38BE44F7FEF85DC3BF7377680
SHA-512:	2BCC533FBD52D41BD07AFE0EBFE97E1A7FD8BB1E2A5C33F52224FEA27BA3DFBBDCA73784026699976E48CA851B06184AE71EA806803B2EAE4B1F4A0B52507094
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......@aus... ... ... _h.!... _h.!... .m.!... .m.!... _h.!... .n.!... .n.!... .m.!... _h.!... _h.!... .x. ... ... l.. _h.!... .n.!6.. .n.!... .n. ... .n.!... Rich... ................PE..d......a.........." ......O...A......79.............................................Z.....`A.........................................Du.P...@Eu.................lW......!... ......P.j.T.....................j.(.....g...............O......Cu.@....................text...L.O.......O................. ..`.rdata....%...O...%...O.............@..@.data...x....pu......Nu.............@....pdata..lW.......X.................@..@.didat..@...........L..............@..._RDATA...............N..............@..@.rsrc................P..............@..@.reloc....... .......T..............@..B................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.cat

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	56778
Entropy (8bit):	5.223715380209655
Encrypted:	false
SSDEEP:	192:/a7wxRg2/taontFwL8qXcZbv2NpJCzg/4bEl5nqQjZ8q2rFEEPLOyBmE4wzHLOKk:BJtFCRXZp+lrK9M3rPFRHR1ltxzu
MD5:	DE78B1D44CE14FA1C5D45225323B56FD
SHA1:	BDA52AB7F8525007544D25B15574063A91BD68FF
SHA-256:	186C32442A423474D45AD050BCAE56F38D514BC3B0C36A1AD47895B2D8F9B378
SHA-512:	3CB6F37C3F9D957ACF01E0164B8ED87B5D6C129EB9DFFC83F9BA87844F61D01FA1BA91BDC23DDE8B50DE5EC1A589A972259DE27B271059C655AA4AF896E28E89
Malicious:	false
Preview:	0.....*.H.........0.....1.0...`.H.e......0.....+.....7......0...0...+.....7.....F...8UG...>.J"..211007225007Z0...+.....7.....0..I0....R3.A.C.4.7.A.7.A.1.3.6.6.F.5.C.0.C.D.B.8.C.4.8.3.1.7.2.6.4.9.E.0.B.F.9.5.3.C.0.3...1..G0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........:.zz.f.....&I.<.0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R4.E.9.A.6.6.3.6.6.F.B.E.9.2.1.B.8.9.D.A.D.D.3.5.4.2.4.5.8.E.A.9.1.C.2.6.0.C.0.8...1...04..+.....7...1&0$...D.R.M.L.e.v.e.l........1.3.0.0...0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...s.y.s...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..y..+.....7...1..i0..e0..>..+.....7...0.....

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.inf

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	126813
Entropy (8bit):	5.287768025455325
Encrypted:	false
SSDEEP:	384:MBVJQ7BVJQnrx5A3drx5AfATM/NSeKzWqqp79y8Ao1yzU8OxipYde:MJwJ8/2/cATeSeKzWqq99y818Oxiade
MD5:	4E408C8AAD29D03EA6CF3451C563472B
SHA1:	3AC47A7A1366F5C0CDB8C483172649E0BF953C03
SHA-256:	37F8141F17A88184F5DF26A68BA569E0DD3B008525512AC53458F81EFCB87139
SHA-512:	AB8F7CE350104D88924B0BDEE54FE0B4A04879C195FCACFFA908B2EC87E72A215214061C1DF0D895CB7C0BE9286AB376ADE1512237D3CABE39688574E1F30CA8
Malicious:	false
Preview:	;..; DisplayLink USB Audio Adapter Driver..; Copyright (c) 2011 - 2021 DisplayLink (UK) Ltd...;....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..; 07/11/2019,1.55.0.0..DriverVer = 10/07/2021,10.2.6554.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat....Class=MEDIA..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}....[SignatureAttributes]..dlusbaudio.sys=SignatureAttributes.DRM..dlusbaudio_x64.sys=SignatureAttributes.DRM....[SignatureAttributes.DRM]..DRMLevel=1300......;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; Windows from build 16288 will use inbox audio driver..%S_Mfg%=_Models, ntx86.10.0...16288, ntamd64.10.0...16288, ntx86, ntamd64......;***************

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176368
Entropy (8bit):	6.633174130570561
Encrypted:	false
SSDEEP:	3072:2MRFxRfYLrOJfp9jfpR80ieWh19JBWdGFAgo5Vg9/rY:vTwLrMb5WP93q/g+mY
MD5:	F5D75845F9719B78DC808473D5C27102
SHA1:	5CA17DF42D2C6B075E7C391E96AFD221DC3534E0
SHA-256:	AB4FD1C41A408DE8615B3B0D198410980573E3C97DD912079376E3CA969EB7C8
SHA-512:	A687C3C01E0D3D9D656A0FD9CAEE0BAE830E0B630C08037387EEE1520E64FB288D55315FE4E4E050B294BA91DE8F2BE4D605A0942A3F70C3622EB5D7CEB2CBDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7..7..7..7..7..7..7..7..7..7..7Rich..7........PE..L....+'].....................6......>P....... ..............................................................................PP..x....`...............P...`...p.......!............................................... ...............................text...\........................... ..h.rdata..H.... ......................@..H.data...@....@.......&..............@...INIT.........P.......(.............. ..b.rsrc........`.......4..............@..B.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\dlusbaudio_x64.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	237808
Entropy (8bit):	6.4733574762486885
Encrypted:	false
SSDEEP:	3072:equVkUSvUtN9pY5JmUI4+hbtYekXFoX/W/IV29B1ZKaDx7VUx3zRT9QZog9NSF:e6UdtN9RkXFoX3V6BCadctmmHF
MD5:	11C6DA2B3CC3A247D7115B3E53CD35CC
SHA1:	9F473F33761DCD5BD312EA5A774BE3B019621FF9
SHA-256:	034FE8201FD72B39D5F35B59AF8F301813222FB9159DD8F9DB638F82E84333F2
SHA-512:	B914F89C314F79E4807CE61CDFA5CF82B570E28B2499E194622A67FCB680F5E914089C680233E7C72255AB69D73D07DFA78DAFA39EDB85D62EF75CEC10598A31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.S.4.=Q4.=Q4.=Q=.Q5.=Q4.<Q_.=Q=.Q?.=Q=.Q7.=Q=.Q0.=Q=.Q].=Q=.Q5.=Q=.Q5.=QRich4.=Q........PE..d....+'].........."..........\|......d`...............................................<.......................................................`..x....p..`....0...&...@...`...... ...P...................................................H............................text............................... ..h.rdata...B.......D..................@..H.data...`.... ......................@....pdata...&...0...(..................@..HINIT....Z....`.......&.............. ..b.rsrc........p.......4..............@..B.reloc...............:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\ella-dock-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	888048
Entropy (8bit):	7.999763743901625
Encrypted:	true
SSDEEP:	24576:SswcBlSP/G5BnbvFvWuwfdMhXIkjpIVVsM1Ok40YQLQz:iG5PvdrZIAIVKZk4FQLQz
MD5:	E4A41DA40DE01AEDD59D2A49CE3ABB30
SHA1:	C79E216B90893E455ABB2FE11CBFDEE3C5F979AD
SHA-256:	33B7E13905739FCD02730BC82196AD831352BF2C4ACFECD78496F8FEC7239EB8
SHA-512:	A1135EF8FE03868BEFA58F92A65483D7587614A23C394158764B962D82536D31A832B375138266F7DEAFCE8B2A3766A662E5E2D9C184EE73E8FC461DFF17D829
Malicious:	false
Preview:	ELLA....._\...._..h....`.6...I.L^W........'d...@.( ..O..N.(..pf....u..t...${?s%l..........N).9....=.....ev....Hf..:c.2..,..`A.RV.....Q.P.{...'[M..%........@...^..j.[.S..3..v..G..T...C.......o.gr&......`2......F...".P........IHw.f...q.. & AC\.X..M.C.{fL...w.?.4.Oh...e.0..t..Z.OX..2.3........Ab....}R.$.......2...#.hG. D.(._/.G..P.2).Y{.P[..S.......Q.C..-.<....... ....u\|..2S.`......`.O.....k.Wudc.m.4.......~..k!.].O...`...)...<!>.C(.p....S....d....a......c.......`F..\|U.U]..Y..\|. e..C.(..A5..{..........%..b.\|.5..t>...k.....HW.~Q.....{i{m...+.!.2+...I.^.2~.{?.[.,...p......L'.sji.'j.dB7#..(s.L:g.\..jR..V...7...f..y.5.U.`) .......J...Gn.&T.....&..B..cL...h.._ 8..P...?Qh^ZW.(..../.....w....Hb...1X....lG....n..{XO..g..}.\H....k....U.9........j.#?...n.N..r..<......~.....`H..m=W..^L.X7..<..J.......t....lV?M.g[.bO..$....x.c...:..R..8..._..9p.-. ...I..Eq!....#.......s.x..z.......L.=......8.?s..0.....n.6.59..`J.$....(]..yP.....-....t....n....R..u

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\firefly-monitor-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	349216
Entropy (8bit):	7.9994424256959515
Encrypted:	true
SSDEEP:	6144:as2gKc1+Yvf3rqOidtLuNQh7bYnb3e1aTckqdk23np2gU4zT7Uq2o9tv9PeNE:P1+6/+tuN8b00ndT3nNTr9P
MD5:	C9E694592E01FC16D65F6AE3A07B6661
SHA1:	A7C62D57FB9DAFE11E295EEA3B63BD72E8778291
SHA-256:	15CF40279890D5E374C5A0BE9B6A393FCA6F077E763EB76A0A25480033DC4914
SHA-512:	5F72854783AA787C6C3ED4C4CAFF1C7DC740FC724FE56A5CA787F85B0051350505E453B00CFF0C1B713E8CC4660678C7AAD952E275FA5171702324A6DFAD5D01
Malicious:	false
Preview:	ELLA T..0,.....,...9.E.C...Y.$...m..,.V>.....AH.?}&...Z.l.+?2..F.mD...]...({.!..x.i.....a.+.......Q...w......Y\..W...n,.......vU....M.....V..P<....v.......{.....\Z...{.W.>!S..>J.V.......i.+..........b.~........S9&.J.3..:......u.94........+.28).!..q2N.~...g...3....&&....}q.doD.2.q.XdlL.........e.;..xn.J.d. .hM...O}...\|.~B.v..\,N.......p.Dr...b....V...._\z....L.$yY....Ipw.......!R.R.dO.n.$.6.[....WZ.f....;....,..-.^.U.........s..'o`."24..-.Ks@....0...V.&.(..O.1@9...}l.#..R.(Q.....C......n%H.E.4]Y.....%a<.ZT..pn.\.bC.....X...<...:.......2T ...nt.'w..`......1."..K.....2.tk72.&....G\W.O.8..d&.=.u.M..ac.0.[..d.`G.A..:#..t......9.e...".......6..OK....W..4.C...U.q...cm.....<.6...E..Wh.K....?G.....x.O6......BF[...^.`.N......J\|l.].w.A..7V.a...:..rs.;y.q..sa)...L.uyIT....F..sl....e.....c.F.d...k};.nz.TI\|...T......V...6..VO..m......\....z.A....@/.....J.5..pr*......\|..}_.5e.v..Q#uPh..8..7...9A.Us".n..l..7..R..q.....Q.......X..GI.,.P.Z.i.

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64\ridge-dock-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	752336
Entropy (8bit):	7.999722476182654
Encrypted:	true
SSDEEP:	12288:23bAFm05XMdVw6yV6X8BoIkks/LdWnJOCP5U8CJPdb8IxR6AMl26aFDAO/ZFX:bT5X0Vw6yQAoIADdKJO+5U8CJPdwIX66
MD5:	82F4457C9F4A5B37B0218593CBF51767
SHA1:	E270FA14455AB2C6D6E53E24DA2E0380AE0B3488
SHA-256:	A263784D70A94712DB3DA50DFBE762FEDAF0CCFB8BA54F128467F1B6B98F8C85
SHA-512:	60AB06BDD7CB050CE421A7ED66204BFB43B18726ACD9AAA659FDA47F2CAFD7D773058F05A28CC328267F31B4D549B336A71BDBAEFEBBA99985A52A6EFAC156CD
Malicious:	false
Preview:	ELLA.z...0<...x0.2........v....u.f..0....dB.L..Z.A...$FN..9.... .s...........a.....i9.I..C...5.p._Z...3F.D}...@z'.D..i..P..F...x...!...q...zk.J..../'....0..tp.iy+....\|L...Gb.1p../.S...:.I...+kaj.~...4..8!c.#..E.(.g!...8{.....7.k..h.....k5.R....Tv........0..C.a.K...\|.Y!O..o..IY...Xa....v.or..!=.@.0.h`r.P.Cc....)Y...N.......AY..\|..r.L.j....?.7j.w..qd...#>Z..W..A@..>...\.K..f4.7V..nd(9.....l.)...U......1/5$......." ..`.v../.P..F..j............p~...5..(..>..h...5\|Z..JP....'!..,.f....%..\D.C.....P..........b.e?R....D.......>E...:....h.Y..@1.Er...E........f...J..@....l1Z...}4Y...S......4t..G49..\#&..@...1t.YTc.-?.4....w..0P.]I."....P....G.S.......@\.X"...6.....PI.p.z.bht....d%.........~b...;3'..$....drU.-..w.\|.q&.......S'...aX......L..o+s.g........7...IK..j..w3A..9-..5$.}Qe}..Z.....Ln9z..cv...[.E9.X.8}.]....l.E..74..?_.r.t.V....DH....p/2.Y.Z.G.u]...rK.\|..f.c*.D.{.........m...0..'....5L..6...i.....OH.W..C/d$gI{..RW...[........

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dl-usbnet-ncm.cat

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	55971
Entropy (8bit):	5.214854959109016
Encrypted:	false
SSDEEP:	192:4R4J24JCHMEiLCHRoURbi79B0019m+/fbEa5Aq3j2812sFDEoLRy+mEfw0HMOVd0:40Hw0eoPl/k6h3Tp4ATKAR9zLflI
MD5:	A17A1D49D0CCB1C31FCEAD1AB5C29E4C
SHA1:	80B006F52518B81CA34779ED1630B5859B7CD28F
SHA-256:	0A6A6B8360688D2B2ACCCEF396B7DFCE5DD4892F09039FD973B40489F2475EE6
SHA-512:	494FB18A9E6D34C404B68FEFB21C69D69D889B1BA59185EBDA7DC17B3B1F382F132A1D46268FA21BB9D4913BA39AF39C4B01116F058DC8324F39AB26F2CEE399
Malicious:	false
Preview:	0.....H.........0.....1.0...`.H.e......0.....+.....7......0...0...+.....7.....Y....NI......Jc..211220152529Z0...+.....7.....0...0.... ..b!...+...L..c.w".....Au..v1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..b!...+...*L..c.w".....Au..v0.........u.L.UJj.Q.+Z.01..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...s.y.s...0........y......Huri.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0.... .......i.xo......B3........y.UH1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$d.l.-.u.s.b.n.e.t.-.n.c.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dl-usbnet-ncm.inf

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	48291
Entropy (8bit):	5.662944047616262
Encrypted:	false
SSDEEP:	384:q5f1tY7js1E+HDXSby46qXlCmzQi95ZGULNKkE9xkn2n8ndn1n9eEE6haemsstFV:szksSAqJBBI
MD5:	C9226A47200F6427774BE186F9722656
SHA1:	B8E9C18F79041200FE978948757269838396F494
SHA-256:	DDDFDC8AD7FAF4EF6906786F8C808012F314423387F8881DC62E14AA79D75548
SHA-512:	8CE61EEAE8C8C0AA29EA6CD3823FA2A36B11D14341706083C94A1F14D157BAC79B360F7071B5A5E6A36DB57B214E4336C729A97BB6B2C886845D9F851F397A6C
Malicious:	false
Preview:	;..; USB CDC NCM Driver setup information file..; Copyright (c) 2009 - 2021 DisplayLink (UK) Ltd...;..; This file supports:..; Windows 10......;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..PnpLockdown = 1..; 11/24/2021,12/07/2021,3.64.0.20958 For Windows 10 RS1 and later..DriverVer = 12/20/2021,10.2.6683.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat..Class=net..ClassGUID={4d36e972-e325-11ce-bfc1-08002be10318}........;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; 10.0 - Windows 10 and later..%S_Mfg%=_Models, ntx86....;****************************************************************************..; Models Section..;------------------------------------------

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dl-usbnet-ncm.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118096
Entropy (8bit):	6.773752255554001
Encrypted:	false
SSDEEP:	3072:KlYWMTLzWIzSchTEzIV1I0a9jWonrxcz2xf5cVZrOUh:KhMTLCe5Q8Hza9jWcrxUVT
MD5:	23FF5CDEC7E56D72355679ED39AC760D
SHA1:	386AD969F2FF63DDF3F77F8FEA23FB9CCE76E9A1
SHA-256:	CDF766E4416823CB6C99B7F1FB8B9138AA7D430A9A73D6D73CB8D2E357559211
SHA-512:	42651B8E6E4C2C053D442A9389BA7173199747818ABB79FDE90A2D5C9FCB7D3E57EBB8BCC4F0E459E0B361E9B02332731657174409AEC4888B5F798C5A440B20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j............J.......J.......e.......J.......J...............J.......@.......@.......@.......Rich....................PE..L...O9.a.................V...4......P-.......`....@.................................><....@A................................ ...d.......................PG...........q..T...........................`q...............`..\............................text....H.......J.................. ..h.rdata..p....`.......N..............@..H.data................d..............@...PAGE.................f.............. ..`INIT....v............h.............. ..b.rsrc................r..............@..B.reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	281703
Entropy (8bit):	4.405763742551111
Encrypted:	false
SSDEEP:	1536:TJVR/lqHZioRO7MK6gOuGG+OmGQOpHFaG6+iGyJNRv1XpX1qHf3n/X//H/eA6IOf:uX
MD5:	850D1EF72788D63523FC65CDFFDA26D4
SHA1:	30986921845778E2772DC6F0A365DDBDF0082A3D
SHA-256:	B1DF21CB7BD0F1DD362DFACC4F912B3EC9241704CF320DF1A3B428E9A300C3B6
SHA-512:	67872576A142D9B129DE2C5FC0A604E45FF8245600F31E7472AA561FCD33A46B6FF14417AE55DE82765CF0C130AE72DE55E6927BAAFBB8E9D9AD42E9ADDF72F7
Malicious:	false
Preview:	0..Lb...H.........LR0..LM...1.0...`.H.e......0..+#..+.....7.....+.0..+.0...+.....7......%.{...L.u........220113023601Z0...+.....7.....0..<0..". ..@'....t...j9?.o.~v>.j.%H.3.I.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..@'....t...j9?.o.~v>.j.%H.3.I.0\..+.....7...1N0L...F.i.l.e.......:f.i.r.e.f.l.y.-.m.o.n.i.t.o.r.-.r.e.l.e.a.s.e...s.p.k.g...0....-v[.4zP..;....m.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........d.l.i.d.u.s.b...d.l.l...0.... 3..9.s...s..!....R.,J.......#..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0P..+.....7...1B0@...F.i.l.e........e.l.l.a.-.d.o.c.k.-.r.e.l.e.a.s.e...s.p.k.g...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... 3..9.s...s..!....R.,J.......#..0....>U..H..j....'.....S.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8728488
Entropy (8bit):	6.789866250449058
Encrypted:	false
SSDEEP:	196608:B5fmhxPDAE1jkIxyd8lRT9yYU+H5QhNnch:B5Ih1dG8HT9yY5H5QhNn4
MD5:	160889CEF00A6A40F715D8A1E73B7CA6
SHA1:	DE0FD1EA9EE63F2374FB670D0D59DEF26401050E
SHA-256:	05752DC4581FBFD1A175D1A62893F143478769A8AB4E4F03E860B20F3204DF3D
SHA-512:	6242937B9736176F4A1BBA4F5B28AE401F7BA79DB341255C01ED36DE4D84450D85EA7FBA9562AE8D12CA557418A0A8219F6398BE77310D03FF00566894DC7351
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......d.c= ..n ..n ..n{..o..n{..o;..n...o1..n...o:..n{..o...n...o5..n...o...n...o...n{..o,..n{..o#..n).n=..n ..n...n{..o!..n...o...n...o!..n...n!..n...o!..nRich ..n........................PE..L...W..a...........!......M.."?......?7...... M.....................................q>....@A........................0.p.T.....p.........................!.......... .e.T...................t.e......,d.............. M.......p.@....................text...4.M.......M................. ..`.rdata..Z.#.. M...#...M.............@..@.data....r...@p..V....p.............@....didat.. ............r..............@....rsrc...............t..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	494953
Entropy (8bit):	5.149168035426433
Encrypted:	false
SSDEEP:	768:4J4TtB/87BW/yKVEik+Vy4upaRobXlDWvbcTaQX8Uii3IoKz2unaTYD9rv0Ino7b:Rb6BxKy26NpUbLQMEifJtvjogQjjPD
MD5:	B37190F9FA92EBDBD680178A693C0A06
SHA1:	A8A2725370E9BFE8A533253174F0EEF8F528A592
SHA-256:	CF4BCC196B1EDF19E72F7A3C999975B230E86D02A75D17103E648812C047C7BC
SHA-512:	90F32A8755D6FB9168675B14E6E1AE232294B4AD455E5942A44AD1293FF85B640E8914602A680BB766E247D0AB1F53987A47FAA254831CC04DFAABCBC003961D
Malicious:	false
Preview:	;.. ; Installation inf for DisplayLink USB Display Adapters... ; Copyright (c) 2016 - 2022 DisplayLink (UK) Ltd... ;....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=dlidusb.cat..DriverVer = 01/10/2022,10.2.6709.0......[Manufacturer]..%ManufacturerName%=Standard, NTx86, NTx86.10.0...16209, NTx86.10.0...17134....[Standard.NTx86]..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0010..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0011..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0012..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0013..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0014..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0015..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0016..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0017..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0018..%DeviceName%=dlidusb_Install, USB\VID_17e9&PID_0019..%DeviceName%=dlidusb_Inst

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb2.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8728488
Entropy (8bit):	6.7898927933749
Encrypted:	false
SSDEEP:	196608:5hYTMJZcksttxIYl3WVrK9yYU+H5QhNn7:5h3KL9ZW9K9yY5H5QhNn
MD5:	E3EB444C135A84EC90030D89CD9E9FB9
SHA1:	D5275EF2841D9E2D606239E40BAFE742988FA3A7
SHA-256:	2E844AE704B6F4352AB5C0DEC08C9F14AAC175DCAB7F294F82734A0D2B890FAD
SHA-512:	B55958BE64C868F4E1538A259768D0588EA117867D65F01384F34C37020AAC2F3950CE6C14175561DA9622564C0ADBD308EC32B6B1085F5E3FBAF9951F16B443
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......d.c= ..n ..n ..n{..o..n{..o;..n...o1..n...o:..n{..o...n...o5..n...o...n...o...n{..o,..n{..o#..n).n=..n ..n...n{..o!..n...o...n...o!..n...n!..n...o!..nRich ..n........................PE..L......a...........!......M.."?......?7...... M...........................................@A........................ .p.T...t.p.........................!............e.T...................d.e......,d.............. M.......p.@....................text...4.M.......M................. ..`.rdata..J.#.. M...#...M.............@..@.data....r...@p..V....p.............@....didat.. ............r..............@....rsrc...............t..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlidusb3.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8730536
Entropy (8bit):	6.788607110728472
Encrypted:	false
SSDEEP:	196608:PP/w714e+AiN74MzzWwapACf9yYU+u5QhNns:PPvvuM2Npnf9yY5u5QhNns
MD5:	70B24DF75B0B19BB33BBB943FC1EE355
SHA1:	2291FF89862632E817C7C33C321245176A9F1945
SHA-256:	93F70FB41D3E91C385AEFDB78C2D2DE621A45E6783E97F6AC698C03255AEA6B1
SHA-512:	F58811A8C8D60D21D5A28DF0C15735A880BB81A0680D8355476950706F2B3666ABEB56A023F72215B56520114F39AEE5F3006DB60C424236C3B62D42FE55A6DE
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......d.c= ..n ..n ..n{..o..n{..o;..n...o1..n...o:..n{..o...n...o5..n...o...n...o...n{..o,..n{..o#..n).n=..n ..n...n{..o!..n...o...n...o!..n...n!..n...o!..nRich ..n........................PE..L...z..a...........!......M..$?......F7...... M.........................................@A........................P.p.T.....p.........................!......\...@.e.T.....................e......,d.............. M.....<.p.@....................text.....M.......M................. ..`.rdata..z.#.. M...#...M.............@..@.data....s...@p..V..."p.............@....didat.. ............x..............@....rsrc...............z..............@..@.reloc..\............~..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio.cat

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	56778
Entropy (8bit):	5.223715380209655
Encrypted:	false
SSDEEP:	192:/a7wxRg2/taontFwL8qXcZbv2NpJCzg/4bEl5nqQjZ8q2rFEEPLOyBmE4wzHLOKk:BJtFCRXZp+lrK9M3rPFRHR1ltxzu
MD5:	DE78B1D44CE14FA1C5D45225323B56FD
SHA1:	BDA52AB7F8525007544D25B15574063A91BD68FF
SHA-256:	186C32442A423474D45AD050BCAE56F38D514BC3B0C36A1AD47895B2D8F9B378
SHA-512:	3CB6F37C3F9D957ACF01E0164B8ED87B5D6C129EB9DFFC83F9BA87844F61D01FA1BA91BDC23DDE8B50DE5EC1A589A972259DE27B271059C655AA4AF896E28E89
Malicious:	false
Preview:	0.....*.H.........0.....1.0...`.H.e......0.....+.....7......0...0...+.....7.....F...8UG...>.J"..211007225007Z0...+.....7.....0..I0....R3.A.C.4.7.A.7.A.1.3.6.6.F.5.C.0.C.D.B.8.C.4.8.3.1.7.2.6.4.9.E.0.B.F.9.5.3.C.0.3...1..G0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........:.zz.f.....&I.<.0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R4.E.9.A.6.6.3.6.6.F.B.E.9.2.1.B.8.9.D.A.D.D.3.5.4.2.4.5.8.E.A.9.1.C.2.6.0.C.0.8...1...04..+.....7...1&0$...D.R.M.L.e.v.e.l........1.3.0.0...0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...s.y.s...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..y..+.....7...1..i0..e0..>..+.....7...0.....

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio.inf

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	126813
Entropy (8bit):	5.287768025455325
Encrypted:	false
SSDEEP:	384:MBVJQ7BVJQnrx5A3drx5AfATM/NSeKzWqqp79y8Ao1yzU8OxipYde:MJwJ8/2/cATeSeKzWqq99y818Oxiade
MD5:	4E408C8AAD29D03EA6CF3451C563472B
SHA1:	3AC47A7A1366F5C0CDB8C483172649E0BF953C03
SHA-256:	37F8141F17A88184F5DF26A68BA569E0DD3B008525512AC53458F81EFCB87139
SHA-512:	AB8F7CE350104D88924B0BDEE54FE0B4A04879C195FCACFFA908B2EC87E72A215214061C1DF0D895CB7C0BE9286AB376ADE1512237D3CABE39688574E1F30CA8
Malicious:	false
Preview:	;..; DisplayLink USB Audio Adapter Driver..; Copyright (c) 2011 - 2021 DisplayLink (UK) Ltd...;....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..; 07/11/2019,1.55.0.0..DriverVer = 10/07/2021,10.2.6554.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat....Class=MEDIA..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}....[SignatureAttributes]..dlusbaudio.sys=SignatureAttributes.DRM..dlusbaudio_x64.sys=SignatureAttributes.DRM....[SignatureAttributes.DRM]..DRMLevel=1300......;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; Windows from build 16288 will use inbox audio driver..%S_Mfg%=_Models, ntx86.10.0...16288, ntamd64.10.0...16288, ntx86, ntamd64......;***************

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176368
Entropy (8bit):	6.633174130570561
Encrypted:	false
SSDEEP:	3072:2MRFxRfYLrOJfp9jfpR80ieWh19JBWdGFAgo5Vg9/rY:vTwLrMb5WP93q/g+mY
MD5:	F5D75845F9719B78DC808473D5C27102
SHA1:	5CA17DF42D2C6B075E7C391E96AFD221DC3534E0
SHA-256:	AB4FD1C41A408DE8615B3B0D198410980573E3C97DD912079376E3CA969EB7C8
SHA-512:	A687C3C01E0D3D9D656A0FD9CAEE0BAE830E0B630C08037387EEE1520E64FB288D55315FE4E4E050B294BA91DE8F2BE4D605A0942A3F70C3622EB5D7CEB2CBDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7..7..7..7..7..7..7..7..7..7..7Rich..7........PE..L....+'].....................6......>P....... ..............................................................................PP..x....`...............P...`...p.......!............................................... ...............................text...\........................... ..h.rdata..H.... ......................@..H.data...@....@.......&..............@...INIT.........P.......(.............. ..b.rsrc........`.......4..............@..B.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\dlusbaudio_x64.sys

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	237808
Entropy (8bit):	6.4733574762486885
Encrypted:	false
SSDEEP:	3072:equVkUSvUtN9pY5JmUI4+hbtYekXFoX/W/IV29B1ZKaDx7VUx3zRT9QZog9NSF:e6UdtN9RkXFoX3V6BCadctmmHF
MD5:	11C6DA2B3CC3A247D7115B3E53CD35CC
SHA1:	9F473F33761DCD5BD312EA5A774BE3B019621FF9
SHA-256:	034FE8201FD72B39D5F35B59AF8F301813222FB9159DD8F9DB638F82E84333F2
SHA-512:	B914F89C314F79E4807CE61CDFA5CF82B570E28B2499E194622A67FCB680F5E914089C680233E7C72255AB69D73D07DFA78DAFA39EDB85D62EF75CEC10598A31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.S.4.=Q4.=Q4.=Q=.Q5.=Q4.<Q_.=Q=.Q?.=Q=.Q7.=Q=.Q0.=Q=.Q].=Q=.Q5.=Q=.Q5.=QRich4.=Q........PE..d....+'].........."..........\|......d`...............................................<.......................................................`..x....p..`....0...&...@...`...... ...P...................................................H............................text............................... ..h.rdata...B.......D..................@..H.data...`.... ......................@....pdata...&...0...(..................@..HINIT....Z....`.......&.............. ..b.rsrc........p.......4..............@..B.reloc...............:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\ella-dock-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	888048
Entropy (8bit):	7.999763743901625
Encrypted:	true
SSDEEP:	24576:SswcBlSP/G5BnbvFvWuwfdMhXIkjpIVVsM1Ok40YQLQz:iG5PvdrZIAIVKZk4FQLQz
MD5:	E4A41DA40DE01AEDD59D2A49CE3ABB30
SHA1:	C79E216B90893E455ABB2FE11CBFDEE3C5F979AD
SHA-256:	33B7E13905739FCD02730BC82196AD831352BF2C4ACFECD78496F8FEC7239EB8
SHA-512:	A1135EF8FE03868BEFA58F92A65483D7587614A23C394158764B962D82536D31A832B375138266F7DEAFCE8B2A3766A662E5E2D9C184EE73E8FC461DFF17D829
Malicious:	false
Preview:	ELLA....._\...._..h....`.6...I.L^W........'d...@.( ..O..N.(..pf....u..t...${?s%l..........N).9....=.....ev....Hf..:c.2..,..`A.RV.....Q.P.{...'[M..%........@...^..j.[.S..3..v..G..T...C.......o.gr&......`2......F...".P........IHw.f...q.. & AC\.X..M.C.{fL...w.?.4.Oh...e.0..t..Z.OX..2.3........Ab....}R.$.......2...#.hG. D.(._/.G..P.2).Y{.P[..S.......Q.C..-.<....... ....u\|..2S.`......`.O.....k.Wudc.m.4.......~..k!.].O...`...)...<!>.C(.p....S....d....a......c.......`F..\|U.U]..Y..\|. e..C.(..A5..{..........%..b.\|.5..t>...k.....HW.~Q.....{i{m...+.!.2+...I.^.2~.{?.[.,...p......L'.sji.'j.dB7#..(s.L:g.\..jR..V...7...f..y.5.U.`) .......J...Gn.&T.....&..B..cL...h.._ 8..P...?Qh^ZW.(..../.....w....Hb...1X....lG....n..{XO..g..}.\H....k....U.9........j.#?...n.N..r..<......~.....`H..m=W..^L.X7..<..J.......t....lV?M.g[.bO..$....x.c...:..R..8..._..9p.-. ...I..Eq!....#.......s.x..z.......L.=......8.?s..0.....n.6.59..`J.$....(]..yP.....-....t....n....R..u

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\firefly-monitor-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	349216
Entropy (8bit):	7.9994424256959515
Encrypted:	true
SSDEEP:	6144:as2gKc1+Yvf3rqOidtLuNQh7bYnb3e1aTckqdk23np2gU4zT7Uq2o9tv9PeNE:P1+6/+tuN8b00ndT3nNTr9P
MD5:	C9E694592E01FC16D65F6AE3A07B6661
SHA1:	A7C62D57FB9DAFE11E295EEA3B63BD72E8778291
SHA-256:	15CF40279890D5E374C5A0BE9B6A393FCA6F077E763EB76A0A25480033DC4914
SHA-512:	5F72854783AA787C6C3ED4C4CAFF1C7DC740FC724FE56A5CA787F85B0051350505E453B00CFF0C1B713E8CC4660678C7AAD952E275FA5171702324A6DFAD5D01
Malicious:	false
Preview:	ELLA T..0,.....,...9.E.C...Y.$...m..,.V>.....AH.?}&...Z.l.+?2..F.mD...]...({.!..x.i.....a.+.......Q...w......Y\..W...n,.......vU....M.....V..P<....v.......{.....\Z...{.W.>!S..>J.V.......i.+..........b.~........S9&.J.3..:......u.94........+.28).!..q2N.~...g...3....&&....}q.doD.2.q.XdlL.........e.;..xn.J.d. .hM...O}...\|.~B.v..\,N.......p.Dr...b....V...._\z....L.$yY....Ipw.......!R.R.dO.n.$.6.[....WZ.f....;....,..-.^.U.........s..'o`."24..-.Ks@....0...V.&.(..O.1@9...}l.#..R.(Q.....C......n%H.E.4]Y.....%a<.ZT..pn.\.bC.....X...<...:.......2T ...nt.'w..`......1."..K.....2.tk72.&....G\W.O.8..d&.=.u.M..ac.0.[..d.`G.A..:#..t......9.e...".......6..OK....W..4.C...U.q...cm.....<.6...E..Wh.K....?G.....x.O6......BF[...^.`.N......J\|l.].w.A..7V.a...:..rs.;y.q..sa)...L.uyIT....F..sl....e.....c.F.d...k};.nz.TI\|...T......V...6..VO..m......\....z.A....@/.....J.5..pr*......\|..}_.5e.v..Q#uPh..8..7...9A.Us".n..l..7..R..q.....Q.......X..GI.,.P.Z.i.

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x86\ridge-dock-release.spkg

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	752336
Entropy (8bit):	7.999722476182654
Encrypted:	true
SSDEEP:	12288:23bAFm05XMdVw6yV6X8BoIkks/LdWnJOCP5U8CJPdb8IxR6AMl26aFDAO/ZFX:bT5X0Vw6yQAoIADdKJO+5U8CJPdwIX66
MD5:	82F4457C9F4A5B37B0218593CBF51767
SHA1:	E270FA14455AB2C6D6E53E24DA2E0380AE0B3488
SHA-256:	A263784D70A94712DB3DA50DFBE762FEDAF0CCFB8BA54F128467F1B6B98F8C85
SHA-512:	60AB06BDD7CB050CE421A7ED66204BFB43B18726ACD9AAA659FDA47F2CAFD7D773058F05A28CC328267F31B4D549B336A71BDBAEFEBBA99985A52A6EFAC156CD
Malicious:	false
Preview:	ELLA.z...0<...x0.2........v....u.f..0....dB.L..Z.A...$FN..9.... .s...........a.....i9.I..C...5.p._Z...3F.D}...@z'.D..i..P..F...x...!...q...zk.J..../'....0..tp.iy+....\|L...Gb.1p../.S...:.I...+kaj.~...4..8!c.#..E.(.g!...8{.....7.k..h.....k5.R....Tv........0..C.a.K...\|.Y!O..o..IY...Xa....v.or..!=.@.0.h`r.P.Cc....)Y...N.......AY..\|..r.L.j....?.7j.w..qd...#>Z..W..A@..>...\.K..f4.7V..nd(9.....l.)...U......1/5$......." ..`.v../.P..F..j............p~...5..(..>..h...5\|Z..JP....'!..,.f....%..\D.C.....P..........b.e?R....D.......>E...:....h.Y..@1.Er...E........f...J..@....l1Z...}4Y...S......4t..G49..\#&..@...1t.YTc.-?.4....w..0P.]I."....P....G.S.......@\.X"...6.....PI.p.z.bht....d%.........~b...;3'..$....drU.-..w.\|.q&.......S'...aX......L..o+s.g........7...IK..j..w3A..9-..5$.}Qe}..Z.....Ln9z..cv...[.E9.X.8}.]....l.E..74..?_.r.t.V....DH....p/2.Y.Z.G.u]...rK.\|..f.c*.D.{.........m...0..'....5L..6...i.....OH.W..C/d$gI{..RW...[........

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	56778
Entropy (8bit):	5.223715380209655
Encrypted:	false
SSDEEP:	192:/a7wxRg2/taontFwL8qXcZbv2NpJCzg/4bEl5nqQjZ8q2rFEEPLOyBmE4wzHLOKk:BJtFCRXZp+lrK9M3rPFRHR1ltxzu
MD5:	DE78B1D44CE14FA1C5D45225323B56FD
SHA1:	BDA52AB7F8525007544D25B15574063A91BD68FF
SHA-256:	186C32442A423474D45AD050BCAE56F38D514BC3B0C36A1AD47895B2D8F9B378
SHA-512:	3CB6F37C3F9D957ACF01E0164B8ED87B5D6C129EB9DFFC83F9BA87844F61D01FA1BA91BDC23DDE8B50DE5EC1A589A972259DE27B271059C655AA4AF896E28E89
Malicious:	false
Preview:	0.....*.H.........0.....1.0...`.H.e......0.....+.....7......0...0...+.....7.....F...8UG...>.J"..211007225007Z0...+.....7.....0..I0....R3.A.C.4.7.A.7.A.1.3.6.6.F.5.C.0.C.D.B.8.C.4.8.3.1.7.2.6.4.9.E.0.B.F.9.5.3.C.0.3...1..G0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........:.zz.f.....&I.<.0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R4.E.9.A.6.6.3.6.6.F.B.E.9.2.1.B.8.9.D.A.D.D.3.5.4.2.4.5.8.E.A.9.1.C.2.6.0.C.0.8...1...04..+.....7...1&0$...D.R.M.L.e.v.e.l........1.3.0.0...0@..+.....7...1200...F.i.l.e........d.l.u.s.b.a.u.d.i.o...s.y.s...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..y..+.....7...1..i0..e0..>..+.....7...0.....

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	126813
Entropy (8bit):	5.287768025455325
Encrypted:	false
SSDEEP:	384:MBVJQ7BVJQnrx5A3drx5AfATM/NSeKzWqqp79y8Ao1yzU8OxipYde:MJwJ8/2/cATeSeKzWqq99y818Oxiade
MD5:	4E408C8AAD29D03EA6CF3451C563472B
SHA1:	3AC47A7A1366F5C0CDB8C483172649E0BF953C03
SHA-256:	37F8141F17A88184F5DF26A68BA569E0DD3B008525512AC53458F81EFCB87139
SHA-512:	AB8F7CE350104D88924B0BDEE54FE0B4A04879C195FCACFFA908B2EC87E72A215214061C1DF0D895CB7C0BE9286AB376ADE1512237D3CABE39688574E1F30CA8
Malicious:	false
Preview:	;..; DisplayLink USB Audio Adapter Driver..; Copyright (c) 2011 - 2021 DisplayLink (UK) Ltd...;....;****************************************************************************..; Version Section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..; 07/11/2019,1.55.0.0..DriverVer = 10/07/2021,10.2.6554.0..Provider=%S_Provider%..CatalogFile=%S_DriverName%.cat....Class=MEDIA..ClassGUID={4d36e96c-e325-11ce-bfc1-08002be10318}....[SignatureAttributes]..dlusbaudio.sys=SignatureAttributes.DRM..dlusbaudio_x64.sys=SignatureAttributes.DRM....[SignatureAttributes.DRM]..DRMLevel=1300......;**************************************************************************..; Manufacturer..;------------------------------------------------------------------------------..[Manufacturer]..; Windows from build 16288 will use inbox audio driver..%S_Mfg%=_Models, ntx86.10.0...16288, ntamd64.10.0...16288, ntx86, ntamd64......;***************

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176368
Entropy (8bit):	6.633174130570561
Encrypted:	false
SSDEEP:	3072:2MRFxRfYLrOJfp9jfpR80ieWh19JBWdGFAgo5Vg9/rY:vTwLrMb5WP93q/g+mY
MD5:	F5D75845F9719B78DC808473D5C27102
SHA1:	5CA17DF42D2C6B075E7C391E96AFD221DC3534E0
SHA-256:	AB4FD1C41A408DE8615B3B0D198410980573E3C97DD912079376E3CA969EB7C8
SHA-512:	A687C3C01E0D3D9D656A0FD9CAEE0BAE830E0B630C08037387EEE1520E64FB288D55315FE4E4E050B294BA91DE8F2BE4D605A0942A3F70C3622EB5D7CEB2CBDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7..7..7..7..7..7..7..7..7..7..7Rich..7........PE..L....+'].....................6......>P....... ..............................................................................PP..x....`...............P...`...p.......!............................................... ...............................text...\........................... ..h.rdata..H.... ......................@..H.data...@....@.......&..............@...INIT.........P.......(.............. ..b.rsrc........`.......4..............@..B.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DLUSBAUDIO\dlusbaudio_x64.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	237808
Entropy (8bit):	6.4733574762486885
Encrypted:	false
SSDEEP:	3072:equVkUSvUtN9pY5JmUI4+hbtYekXFoX/W/IV29B1ZKaDx7VUx3zRT9QZog9NSF:e6UdtN9RkXFoX3V6BCadctmmHF
MD5:	11C6DA2B3CC3A247D7115B3E53CD35CC
SHA1:	9F473F33761DCD5BD312EA5A774BE3B019621FF9
SHA-256:	034FE8201FD72B39D5F35B59AF8F301813222FB9159DD8F9DB638F82E84333F2
SHA-512:	B914F89C314F79E4807CE61CDFA5CF82B570E28B2499E194622A67FCB680F5E914089C680233E7C72255AB69D73D07DFA78DAFA39EDB85D62EF75CEC10598A31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.S.4.=Q4.=Q4.=Q=.Q5.=Q4.<Q_.=Q=.Q?.=Q=.Q7.=Q=.Q0.=Q=.Q].=Q=.Q5.=Q=.Q5.=QRich4.=Q........PE..d....+'].........."..........\|......d`...............................................<.......................................................`..x....p..`....0...&...@...`...... ...P...................................................H............................text............................... ..h.rdata...B.......D..................@..H.data...`.... ......................@....pdata...&...0...(..................@..HINIT....Z....`.......&.............. ..b.rsrc........p.......4..............@..B.reloc...............:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST32\DpInst.exe

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922176
Entropy (8bit):	5.6988225484803525
Encrypted:	false
SSDEEP:	6144:9ZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6r+LyIH:9ZxSpwmxvL/f3vCN1PMaLi6rAyIQjm
MD5:	E6213CEC602F332BF8E868B7B8BF2BB1
SHA1:	593775390B8A474A0BDB8A49B5D26B50B6E3CACE
SHA-256:	4478F6FCFD2FC9BE012668592BFBF6838A115D983F9D30171669B20CAFE529B9
SHA-512:	24F96CD7A5043547997167F46C32381CA86932FE7D3A9CF32EDD72E7A0CC0FA165152246DA913C56D124D1F821E00F09872AA0E3DFF23B655E83D9676E14482F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..o4..<4..<4..<=.`<"..<=.v<...<=.f<)..<4..<@..<=.q<o..<=.a<5..<=.d<5..<Rich4..<................PE..L......J................. ..........j........0...............................0......)y....@...... ..............................,....p..lY..............@.......XC...................................=..@...............L............................text............ .................. ..`.data...`>...0.......$..............@....rsrc....`...p...Z...<..............@..@.reloc..._.......`..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\DPINST64\DpInst.exe

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1047632
Entropy (8bit):	5.609497799841998
Encrypted:	false
SSDEEP:	6144:ZsSOzpPId26dQcEaUrPvwgwkRVagRoDHTj8K1sqI6VLp4XOigSbduP/1HHm/hHAW:zIId79EaUTvwieMozMEcOigSpuPMaLiD
MD5:	AA0A91227631A09CD075D315646FB7A9
SHA1:	C0B86C4D6F1E05B842573081BCC7754FCBCAF5BB
SHA-256:	C20A5D3F5BE543A8E73CD25F9DBF14AA0FC4BA1FDC249EE4FF91D159D174D0EA
SHA-512:	685AE6A514128EEFE8FEE6CB9E456EA584B91358090DFFB41205AB2A2F37E91B4007E6745CCB1E29BC42D191CDB651337C7CA3CF29EF31E8D1AEEA56AF34C2C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g9I.#X'.#X'.#X'.* ..!X'.* ..7X'.* ..<X'.#X&.Y'.* ..fX'.* ...X'...Y."X'.* .."X'.* .."X'.Rich#X'.................PE..d......J..........".......................................................................@.......... ......................................H...@.......pY...0..\m......P............................................................................................text............................... ..`.data... ...........................@....pdata..\m...0...n..................@..@.rsrc....`.......Z...v..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DPInst.xml

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.788676021239895
Encrypted:	false
SSDEEP:	24:sQmWrLE9mfPfidACTiZW/gl6W/+L85HPZaIJPFfwLoPRZDjQOLIRaQLWfCIeLDR7:sMrLe/CC+t61L8xPZaIJPV1NmhIqmvu1
MD5:	CC950004F5BEE0C5242D7F6471165E75
SHA1:	9C8641708400A0233C1C787C40147D6A7B7C2A14
SHA-256:	6CDE65F3E7493CAD425BCB5109524CAC2621E83BFE14D526885589047BB65720
SHA-512:	9A0C1AAA6182CEFD4B8644C9466F236F2ACC14A4E4EAA6F38D81A765D7538D27AE2C677FA024F9FC3D197051BB5DF5584BF694E329E9AF55B9ECBB636F273E93
Malicious:	false
Preview:	<?xml version="1.0" ?>.. <dpinst>.... The following search and subDirectory elements direct.. DPInst to search all subdirectories (in the root.. directory that contains DPInst.exe) to locate driver.. packages. -->.. <search>.. <subDirectory>.</subDirectory>.. </search>.... The following language element localizes its child elements.. for the English (Standard) language. The child elements.. customize the text that appears on the DPInst wizard pages. -->.. <language code="0x0409">.. <dpinstTitle>DisplayLink Installer</dpinstTitle>.. <welcomeTitle>Welcome to the DisplayLink Installer!</welcomeTitle>.. <welcomeIntro>This wizard will walk you through installing or updating the driver for your DisplayLink device.</welcomeIntro>.. <installHeaderTitle>Installing the software for your DisplayLink device...</installHeaderTitle>.. <finishTitle>Congratulations! You have finished installing your DisplayLink device.</finishTitle>..

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore.dat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22408528
Entropy (8bit):	6.285253649965881
Encrypted:	false
SSDEEP:	196608:EdL5aBxbrfMGeLngRXtm3BySXK0w50BD3NGwDlM3sqQ8ndyXmX39FI:EdL4BxbYNnyQs05DA2e8qQeyW9FI
MD5:	F30C4672C69CC5A4204A5C0638997FB5
SHA1:	1810BFB086C75398B3D7E90366999410D5B7AD4A
SHA-256:	6E50A6ADFB782161F38E80AB39E8C84FA278F49B8C35B0B5812327ED6762B165
SHA-512:	AA0379EE30D70701BE019B871FA09B2E8837FBF290B05D6369F0047C0EE468792D09E8762DA6D571FB57EDA3D818B007138B40CACB5CC9EB4545E3D8F950079A
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........{..........D4.....D4..T...D4................................................S..........................Rich...........................PE..L...b.U[.................V..................p....@.................................TqV...@.....................................(....@..X.............U.PV...`..lQ......p................... ...........@............p..........`....................text....T.......V.................. ..`.rdata...M...p...N...Z..............@..@.data....p.......$..................@....rsrc...X....@......................@..@.reloc..lQ...`...R..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkCore64.dat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22741944
Entropy (8bit):	6.321401257406254
Encrypted:	false
SSDEEP:	196608:UdLc1lFY5W7E1cLyrKoeIaPf7o2lfe7CAO6NJQ/4Bvx/Cwc:UdL+YW7iRrbnaPf7bUX7LI4XCwc
MD5:	BA7A6D3223756E7BB08E4117ECCA6DEB
SHA1:	A36065FACC38A19C2CE39D3B9DE66CD99EDBFCBD
SHA-256:	D73A933626F6466FC064F3A4F1098D79A8311A5EA587D2127350AEF8F742E15B
SHA-512:	076AAEA8D48A0C59569B15A67A6F0A7A72BC3CCFCFF7B58B9426DE15D602F6C8EBE2AE1F985C8355A996B71C58C6ECC3FFA5E53C3BCFB4A1358EDF908A21BA2C
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........{..........D4.....D4..T...D4................................................S..........................Rich...........................PE..L...b.U[.................V..................p....@..................................G[...@.....................................(....@..X...........0.Z..Z...`..lQ......p................... ...........@............p..........`....................text....T.......V.................. ..`.rdata...M...p...N...Z..............@..@.data....p.......$..................@....rsrc...X....@......................@..@.reloc..lQ...`...R..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsb.inf

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	392296
Entropy (8bit):	5.12957699585389
Encrypted:	false
SSDEEP:	768:Rl5mary78hyOmoBV0ku0Vngi9e/0T1UNCHeGremoBV0ku0Vngi9e/0T1UNCHeGro:RZwOpV1llesSOZKpV1llesSOZk
MD5:	7B8466EC604005617A8BDF175743696C
SHA1:	12EBBEB7C53DC5F59D5C255DDE5ECDC01B550668
SHA-256:	7E81F31A789AB01AE1F1DA9F16745A3A7DE1E741BE3579F06E4BBC2300CEA72C
SHA-512:	98BA9CCD52E1904BEAE1FC429EA23BD5EB0B5EEFC5BFFBC27C805221EC773939BBB3A1A491B187852A86F735A335F873DB9812542D8FD2AA88BFEF5A191467F6
Malicious:	false
Preview:	;..; Installation inf for DisplayLink USB Display Adapters...; Copyright (c) 2013 - 2022 DisplayLink (UK) Ltd...;....;****************************************************************************..; Version section..;------------------------------------------------------------------------------..[Version]..Signature="$Windows NT$"..Provider=%S_Provider%..; 02/29/2016,2.91.0.0..DriverVer = 01/10/2022,10.2.6709.0..CatalogFile=DisplayLinkUsb.cat....Class=USB Display Adapters..ClassGUID={3376F4CE-FF8D-40a2-A80F-BB4359D1415C}....;**************************************************************************..; Class Install section (optional)..;------------------------------------------------------------------------------..[ClassInstall32]..AddReg=_AddReg_ClassInstall....[_AddReg_ClassInstall]..HKR,,,,"USB Display Adapters"..HKR,,Icon,,"-20"....;****************************************************************************..; Options..;------------------------------------------------------

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo2.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1886104
Entropy (8bit):	6.48531373661134
Encrypted:	false
SSDEEP:	49152:u4EJBLSQnA74J7nZtgl2NfylYaTsHBrflLF1L/s2UyqS0b:u4EjSQA746lYaTsdflL/sD
MD5:	778D42246CE17A6390D39FBC69FAE206
SHA1:	D014BDC3BE2434BF8388DF6875859B3AF1FC3E6D
SHA-256:	C29562A6F15FA7BFD89DB967639D55CF9D3EEA82F7467FBA6EF8C995072846E7
SHA-512:	8930F89FD5048DBF4FFF8FE9E9A4102A60A29F24D0580DF9ECDD2CA89A049212BC9194790DAC30B04B18C522967DA572EAD9BA310C67D05C2FE7A19FDA75E4E5
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........C.Pe-,Pe-,Pe-,...-Be-,..(-.e-,..(-\e-,..)-Ae-,...-Je-,..(-.e-,..)-Ze-,..$-We-,..)-He-,Uir,Qe-,UiM,Qe-,..,-qe-,Pe,,.d-,..(-.e-,..--Qe-,...,Qe-,Pe.,Se-,../-Qe-,RichPe-,................PE..L......a...........!.........l......q2.......0............................................@.........................0\|..l....\|..@........................!......@$...A..T....................B......(B..@............0...............................text............................... ..`.rdata...k...0...l..................@..@.data...D!.......B..................@....rsrc...............................@..@.reloc..@$.......&..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbCo64.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2061720
Entropy (8bit):	6.3978210549124075
Encrypted:	false
SSDEEP:	24576:wt9V5yzwfHfkHhbHpv82gLujgvemcxqp0p2qZt/0zwd3L6CFdYhk:wt9V5yzw3ahrpk2gLemwqp0p2qPw1hk
MD5:	A83EF52645E09774F557A55038ACE822
SHA1:	59705E9F864D705AB50C061F820A79CAD75FD139
SHA-256:	DDEE72C9F9993FFAFC2E77A6A6782BCF4D01742BAB33A2AB3B588BF8A96088A7
SHA-512:	8096157D87F7668B15BFB9BE03E820B7AF8DDF0AF8AC6EF527538D997A07EEBCD42D12ADEB5278C1CE3D79491A4C8B24732495BFF0F89472446A9AC73186086C
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........DH_a._a._a...).Ta.../..a.../.Sa.....Pa...).Va.../..a.....Ua...#.Ma.....Ja.V...^a.V...^a...+.~a._a+..`.../..a....^a.....^a._a..\a...(.^a.Rich_a*.................PE..d...C..a.........." .................0........................................ .....".....`.............................................l...\|...@..............d....T...!...` .....@k..T....................l..(....k.................. ............................text..."........................... ..`.rdata..............................@..@.data....M...P...Z...6..............@....pdata..d...........................@..@_RDATA...............z..............@..@.rsrc................\|..............@..@.reloc.......` .. ...4..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49344
Entropy (8bit):	6.8511781667838845
Encrypted:	false
SSDEEP:	1536:Cay3x8svrxBW+B+jPsxOCe3notPg2J/x:CN3x8svlBZB+IxOCe3nw
MD5:	4E30CC314AC5E40FF839A8FF1BD37E24
SHA1:	8C96CDF039ECF3C1DAADF251B23E352799D891FC
SHA-256:	0B677BE83D8857EEDB4A1B0FB3256CB617DA79EB8816000EDC3EC1472EFD44AF
SHA-512:	473CC0328FE9ECD984195AEC7D0F8B4C570AFFA7C3D481F2FBBAC37C6E08658FD45465FEA8F09809B988E046D3D29CF229D4B0DAFD89941A5B1396738EC8EBEF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..8g.jkg.jkg.jkg.kk).jk@5.k`.jk@5.kf.jk@5.ks.jk@5.kf.jk@5.kf.jkRichg.jk........PE..L......W.................l..................................................................................................H...P........................@..........@...................................................@............................text...M`.......b.................. ..h.rdata...............f..............@..H.data................l..............@...INIT....6............n.............. ..b.rsrc................x..............@..B.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\DisplayLinkUsbIo_x64.sys

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58560
Entropy (8bit):	6.594756192244668
Encrypted:	false
SSDEEP:	1536:7Z8PDGLQGvmuK3GyG0ekMziOCd1U6Ww2w/x:73LQLB3WHkkiOCdW6
MD5:	894349CC299785796A831E7CCA341216
SHA1:	3B22F41622E29E9F92BEFBA12814784AC3B3C2B3
SHA-256:	A88DFAA656969139745225600093D0ED58051FAD9AB2057B045109C36F984AAD
SHA-512:	16B126F56A7AED648BEA9E0ACB613BB6A66251FCFACAC72660D46969E1FFDCB34F32764E29F03364CBF03C8E36454F78749CCF695BD7B9FEF092A21E6EB5ED82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m..................3x....3~....3n....3q....3.....3{....Rich....................PE..d......W..........".........................................................................................................................d...P...............t........@......8...P...................................................H............................text....x.......z.................. ..h.rdata...............~..............@..H.data...<...........................@....pdata..t...........................@..HINIT................................ ..b.rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DL2.tmp\NIVO\displaylinkusb.cat

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	data
Category:	dropped
Size (bytes):	281492
Entropy (8bit):	4.390015144880257
Encrypted:	false
SSDEEP:	1536:RJVR/lqHZioRO7MK6gOuGG+OmGQOpHFaG6+iGyJNRv1XpX1qHf3n/X//H/eA6IOG:g+
MD5:	AA2815E66E470C47B6F155BC0F76C6C6
SHA1:	1D41D175722ACB305AA8855F24FCA20FDE68C1C1
SHA-256:	4D1C8247766E38704C426FC8855FE2D9D28CCFEA94942D001A13940249114C68
SHA-512:	267B42DE7245C06CAB342E9EDA7EFEDB708EFA0F3A48E5077F9068B225094802034C1C799E230B13AD63998509661B1FF45D935D4B5EAB75F343C1C0DEF81CD2
Malicious:	false
Preview:	0..K....H.........K.0..Kz...1.0...`.H.e......0..\..+.....7.....L0..G0...+.....7............O.I.A.$o...220112092141Z0...+.....7.....0...0....R1.2.E.B.B.E.B.7.C.5.3.D.C.5.F.5.9.D.5.C.2.5.5.D.D.E.5.E.C.D.C.0.1.B.5.5.0.6.6.8...1..50>..+.....7...100....O.S.A.t.t.r........2.:.6...1.,.2.:.6...3...0E..+.....7...17050...+.....7.......0!0...+...........=...\%].^...U.h0H..+.....7...1:08...F.i.l.e.......&d.i.s.p.l.a.y.l.i.n.k.u.s.b...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.F.6.B.3.B.B.E.2.A.8.C.E.4.F.5.1.2.6.8.2.E.5.D.F.3.9.0.2.C.3.B.8.C.9.E.F.0.0.3...1..]0>..+.....7...100....O.S.A.t.t.r........2.:.6...1.,.2.:.6...3...0M..+.....7...1?0=0...+.....7...0...........0!0...+........_k;.*....h.].,;....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0h..+.....7...1Z0X...F.i.l.e.......Fd.i.s.p.l.a.y.l.i.n.k.u.s.b.c.o.6.4._.1.0...2...6.7.0.9...0...d.l.l...0....R7.8.5.8.5.2.4

C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41935376
Entropy (8bit):	7.999912839503517
Encrypted:	true
SSDEEP:	786432:UOCrlTT9N6E90Zc7kCgsd8gSyLcNzRDRhAVAnl/mWwgJCUmIRcdlKe3I5umo:OUEkhCZGgCFVTAVAnlnPJPmIRcVmo
MD5:	36A497196AD65CDBD3A4F50B1760DED1
SHA1:	B0F94B6923C3D0B282BBF456DDD0C45DFE622A57
SHA-256:	D9715E20B2CAB49E58AAD7D0936D1580B89EBE4D4A5D73F87E6D134522C58D80
SHA-512:	1640640734842FD6E56393D96D7F7284190D708771FE6F6C983E25FB668138AA314A8D1747FB4D2425465AD09FE8BBBB78964A69B59C2226D8CF90594F50DE48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I..8..k..k..kb.k..k..k..kb.k..kb.k..k...k..k..kq.k...k..k;..kF.k*..k..k;..k..k..k..kRich..k................PE..L...$.WG............................R.............@..........................p..................................................d....`..................................................................................\|............................text...~........................... ..`.rdata..\|L.......N..................@..@.data....U..........................@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI206C.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI23B9.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI257F.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2707.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3561528
Entropy (8bit):	6.302779949355829
Encrypted:	false
SSDEEP:	49152:wjLwLzixux9E7/3PauxNOGDQJKtWPO+YuSt1nRC0Vb:wfuzfPu8Jsd1j
MD5:	04276A8401400CE3566EE8E3D5396ED3
SHA1:	0F74DC7C7AA0C1B314C4F4E1B2054312B4735961
SHA-256:	CBF18E8C21ECFDDA03569FD51780383F972C69A4F8B88BB9BD8418F2CD425DE9
SHA-512:	09099D321704551BD168D79A1EC57FF516CF6EDC185DB2377FF437E189DA08711F933844B2814325DE2EEAF211BF23B1DB9595F1A925FC05BF6A1F214CE50D9D
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........E`..+3..+3..+3.(2..+3..2p.+3`./2..+3`.(2..+3...2..+3)./2..+3)..2..+3.,2..+3./2..+3...3..+3...3..+3`..2".+3.2..+3..3..+3)."2..+3).+2..+3)..3..+3..3..+3).)2..+3Rich..+3........PE..d...w..a.........." ......#..................................................p7.......6...`...........................................,......#,.@....@/.......-..b...86.8 ...@7.T+....'.p................... .'.(....&...............#.......,.@....................text....#.......#................. ..`.rdata..*.....#.......#.............@..@.data....m...P,..v...<,.............@....pdata...b....-..d....,.............@..@_RDATA.......0/.....................@..@.rsrc........@/.....................@..@.reloc..T+...@7..,....6.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI28CD.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2AF1.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2C59.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2DB2.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3561528
Entropy (8bit):	6.302779949355829
Encrypted:	false
SSDEEP:	49152:wjLwLzixux9E7/3PauxNOGDQJKtWPO+YuSt1nRC0Vb:wfuzfPu8Jsd1j
MD5:	04276A8401400CE3566EE8E3D5396ED3
SHA1:	0F74DC7C7AA0C1B314C4F4E1B2054312B4735961
SHA-256:	CBF18E8C21ECFDDA03569FD51780383F972C69A4F8B88BB9BD8418F2CD425DE9
SHA-512:	09099D321704551BD168D79A1EC57FF516CF6EDC185DB2377FF437E189DA08711F933844B2814325DE2EEAF211BF23B1DB9595F1A925FC05BF6A1F214CE50D9D
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........E`..+3..+3..+3.(2..+3..2p.+3`./2..+3`.(2..+3...2..+3)./2..+3)..2..+3.,2..+3./2..+3...3..+3...3..+3`..2".+3.2..+3..3..+3)."2..+3).+2..+3)..3..+3..3..+3).)2..+3Rich..+3........PE..d...w..a.........." ......#..................................................p7.......6...`...........................................,......#,.@....@/.......-..b...86.8 ...@7.T+....'.p................... .'.(....&...............#.......,.@....................text....#.......#................. ..`.rdata..*.....#.......#.............@..@.data....m...P,..v...<,.............@....pdata...b....-..d....,.............@..@_RDATA.......0/.....................@..@.rsrc........@/.....................@..@.reloc..T+...@7..,....6.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI345A.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI38DF.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI414C.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179360
Entropy (8bit):	6.66273052333922
Encrypted:	false
SSDEEP:	3072:C6g9WJSimJWLHKfo9m/sxfA+mPWAg0Fub/8drAAAAAAArK/9R:B2imTfootuAODUAAAAAAArUT
MD5:	47F84947E6374F8707129C36833212D5
SHA1:	A317BCC7368756101519E28F8036104A6022766F
SHA-256:	B79DD5190E2C885F12CF54DCF0BB0AFC72CEA4FFCB21376685F028D235F9771E
SHA-512:	48788FE16986E30C03D465BD5C088B02CFBCD0851DA7AE7BB27F08BFA6E1C2FA6FA7FA1F946B803E36D12F9BD568E146E7911F185CA187B816F39C38D4230888
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................fJI....fJK.^..fJJ..........................+.......P...............G....../..........Rich...........PE..L....U[...........!......................................................................@.....................................<...................................0e..p............................e..@............................................text...?........................... ..`.rdata..............................@..@.data................t..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4852.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3561528
Entropy (8bit):	6.302779949355829
Encrypted:	false
SSDEEP:	49152:wjLwLzixux9E7/3PauxNOGDQJKtWPO+YuSt1nRC0Vb:wfuzfPu8Jsd1j
MD5:	04276A8401400CE3566EE8E3D5396ED3
SHA1:	0F74DC7C7AA0C1B314C4F4E1B2054312B4735961
SHA-256:	CBF18E8C21ECFDDA03569FD51780383F972C69A4F8B88BB9BD8418F2CD425DE9
SHA-512:	09099D321704551BD168D79A1EC57FF516CF6EDC185DB2377FF437E189DA08711F933844B2814325DE2EEAF211BF23B1DB9595F1A925FC05BF6A1F214CE50D9D
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........E`..+3..+3..+3.(2..+3..2p.+3`./2..+3`.(2..+3...2..+3)./2..+3)..2..+3.,2..+3./2..+3...3..+3...3..+3`..2".+3.2..+3..3..+3)."2..+3).+2..+3)..3..+3..3..+3).)2..+3Rich..+3........PE..d...w..a.........." ......#..................................................p7.......6...`...........................................,......#,.@....@/.......-..b...86.8 ...@7.T+....'.p................... .'.(....&...............#.......,.@....................text....#.......#................. ..`.rdata..*.....#.......#.............@..@.data....m...P,..v...<,.............@....pdata...b....-..d....,.............@..@_RDATA.......0/.....................@..@.rsrc........@/.....................@..@.reloc..T+...@7..,....6.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4A86.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3561528
Entropy (8bit):	6.302779949355829
Encrypted:	false
SSDEEP:	49152:wjLwLzixux9E7/3PauxNOGDQJKtWPO+YuSt1nRC0Vb:wfuzfPu8Jsd1j
MD5:	04276A8401400CE3566EE8E3D5396ED3
SHA1:	0F74DC7C7AA0C1B314C4F4E1B2054312B4735961
SHA-256:	CBF18E8C21ECFDDA03569FD51780383F972C69A4F8B88BB9BD8418F2CD425DE9
SHA-512:	09099D321704551BD168D79A1EC57FF516CF6EDC185DB2377FF437E189DA08711F933844B2814325DE2EEAF211BF23B1DB9595F1A925FC05BF6A1F214CE50D9D
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........E`..+3..+3..+3.(2..+3..2p.+3`./2..+3`.(2..+3...2..+3)./2..+3)..2..+3.,2..+3./2..+3...3..+3...3..+3`..2".+3.2..+3..3..+3)."2..+3).+2..+3)..3..+3..3..+3).)2..+3Rich..+3........PE..d...w..a.........." ......#..................................................p7.......6...`...........................................,......#,.@....@/.......-..b...86.8 ...@7.T+....'.p................... .'.(....&...............#.......,.@....................text....#.......#................. ..`.rdata..*.....#.......#.............@..@.data....m...P,..v...<,.............@....pdata...b....-..d....,.............@..@_RDATA.......0/.....................@..@.rsrc........@/.....................@..@.reloc..T+...@7..,....6.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4D75.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI98D7.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265888
Entropy (8bit):	6.57911361618338
Encrypted:	false
SSDEEP:	6144:PI9YEsyXz4ZnwQVx/QjrYAOX1RrEqFqQO:PvEsy0ZwQH4jkNjqv
MD5:	6B2590DF5E5C28C0765161EA334108A5
SHA1:	A7CA20E24B212B0BDB56DD9C692D3FCD946CA803
SHA-256:	6DD214389728CA6D66E2A2DAF23A700060C0389447EABCBA8BE3157D2BDBFDB7
SHA-512:	7D1126487395D9F44F0942D1CD465BAC0348841F76723B0C28C8B3D95F3B21EE7906533A5D2C37B185D734FF0416362EE37ECB6FC9A1329DB451CC32D0BC30EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z....b~..b~..b~......b~......b~......b~...}..b~...z.>b~...{.)b~......b~......b~..b..3c~._.w.Vb~._.~..b~._....b~..b...b~._.\|..b~.Rich.b~.................PE..L..._.U[...........!.....X...........J.......p...............................0......h'....@.............................................0.......................t,......p........................... ...@............p...............................text...(V.......X.................. ..`.rdata...V...p...X...\..............@..@.data...............................@....rsrc...0...........................@..@.reloc..t,..........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\banner.html

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.795268611747226
Encrypted:	false
SSDEEP:	12:bHj9/RFzHFbqlYJjyT9LLmuMD3w0rXjBeZQYvwKG4JGH0dKDDRRGfNHMbb:bzhApPARrXjEqYvJ2UdKfRRGRM/
MD5:	6442B834BE3353ED06D861117F4A5C23
SHA1:	B7B9C1A131F267F0858B853A4BF9321028C559D2
SHA-256:	3834B5A4B896AECF24D2E73E1C7232C0E623E9B3A1F2A17CBCE34922FA541CA7
SHA-512:	7FC52A6737EC47AE8A5DD29B8FAA13CD01170EBD7BE8A0532EFB681C2ED9A4145DD979EE282FB8964AE731BE2C91575DBD98AA3EE6DE11249252AC9734F6777D
Malicious:	false
Preview:	<html>.. <style type="text/css">.. body {.. margin: 0px;.. border: 0px;.. }.. .. #banner {.. width: 100%;.. height: 100%;.. }.. </style>.. .. <body onLoad="initPage();">.. <img src="" id="banner">.. </body>.. .. <script TYPE="text/javascript">.. function initPage().. {.. replaceBanner();.. setTimeout(function(){ replaceBanner(); }, 1000);.. }.... function replaceBanner() {.. var brandingBanner = external.MsiGetProperty("DL_BRANDING_BANNER");.. if (brandingBanner != null && brandingBanner != "" && brandingBanner != "0") {.. document.getElementById("banner").src = brandingBanner;.. }.. }.. </script>..</html>

C:\Users\user\AppData\Local\Temp\cl_6709.exe

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1529912
Entropy (8bit):	6.416384181489552
Encrypted:	false
SSDEEP:	24576:M2F1t6lko+b1dXXuyz3r/Y5YVYtTix2Zmj0OipG6YesZsG:/1t6Go+pdXXdz3rQ5YV2ixAmYJpG7
MD5:	A28D0DA2C620E6AF46DC6E29FFC388A3
SHA1:	E5FC4D005E93398CDD0AC092E47A9F6E687BDF41
SHA-256:	6636420E3416F87C31EC452545A3C79138B6B4E051FB7759CA6FB5F72FD81150
SHA-512:	09783D55BEAB5E56FEF9C101C7DCC1090116783A4483A9F8F9DB18BBE5BF1DA142DDB623A4235FD35CF5CE28492EECE066997557450D2A8C276711FD3A8577C9
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......}.j9..99..99..9b..82..9b..8...9...8?..9...8(..9...80..9...8...9...83..9...8:..9b..8,..90.w98..90.p98..9b..8...99..9p..9...8\|..9...98..99.c98..9...88..9Rich9..9........................PE..d......a.........."............................@..........................................`.................................................D........P.......p.......8..8 ...`......@...T.......................(....................................................text.............................. ..`.rdata..FT.......V..................@..@.data...TB... ...D..................@....pdata.......p.......J..............@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi1E77.tmp

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3440640
Entropy (8bit):	6.332754172601424
Encrypted:	false
SSDEEP:	49152:iGfM3glOz6pNbH2qLG1cWJ2asQceg4LApnrkLgQ63lOT0q4Fn6rmLn:Lc3wFeyCulhqUn
MD5:	59A74284EACB95118CEDD7505F55E38F
SHA1:	ACDC28D6A1EF5C197DE614C46BA07AEAEB25B50B
SHA-256:	7C8EA70CA8EFB47632665833A6900E8F2836945AA80828B30DA73FBF4FCAF4F5
SHA-512:	E69A82ADC2D13B413C0689E9BF281704A5EF3350694690BA6F3FE20DA0F66396245B9756D52C37166013F971C79C124436600C373544321A44D71F75A16A2B6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E..2..a..a..a..=aa.an..`..an..`..an..`..a..a..an..`..an..`..an..`l.an.Qa..an..`..aRich..a........................PE..d...5..r.........." .....n...H......P.........................................4.....g.4...`A........................................p.0.L&....0.......2......@1...............4......F'.T....................*..(....................q..8...Tc0......................text...o........................... ..`.wpp_sf.Y........................... ..`.rdata...Z.......\...r..............@..@.data....A....0.......0.............@....pdata.......@1.......0.............@..@.didat........2......V2.............@....rsrc.........2......b2.............@..@.reloc........4......b4.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\systemCheck.html

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2483
Entropy (8bit):	4.467732460136009
Encrypted:	false
SSDEEP:	48:pJmsbZ6yOn3FBfXqfiwzIiOX69KAtXtx6tS8M:SsbZjO3FZXqfXzIbGWM
MD5:	21778637A4157E9A24AA633A11FA0DD0
SHA1:	D981CDF8CCB6D56C448E3EAE264BFBC610D20D3F
SHA-256:	714FD6C38C9FD9C68BAE760906DCF7CF7FAD5408B0AFE83846E521B9FF64CCAB
SHA-512:	1EFA034EC9A3B5682EE2E3031DBFF082757A7223B9646E3B95B794DB3663FBC8C82A2066AA8DC9FEDB536E680D30C5D1C882B376770021F9C821C8D8A78C2A32
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd" >..<html>.. <head>.. <meta http-equiv="Content-Type" content="text/html;UTF-8"> .. <title>System Checks</title>.. <style type="text/css">.. body {.. margin: 0px;.. border: 0px;.. font-family: Corbel;.. font-size: 9pt;.. background-color: #FFFFFF;.. }.... p#title {.. font-weight: bold;.. }.... li.errorLi {.. list-style: circle;.. margin-bottom:10px;.. color: red;.. }.... li.warningLi {.. list-style: circle;.. margin-bottom:10px;.. color: orange;.. }.... li p.. {.. color: black;.. }.. </style>.. <script TYPE="text/javascript">.. function ini

C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\1033.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370688
Entropy (8bit):	2.923207248973534
Encrypted:	false
SSDEEP:	768:IXxvoRRRRRRRRjZKGlOJQaddd0J/lY2ehp6SUJwHc75W6jnrg:sUlxehp6nw8U4rg
MD5:	DFA96F38D5105B650B4A5312590D98F6
SHA1:	6C11233B7AC2740909D73645FAB2C2088824A244
SHA-256:	BCACE435C26ACA220E9F4F0BFD9A812CE679EFEF341D1D6FB4A59822F3BA5B61
SHA-512:	B3EFEFA819BAFE200B27C058B78AF47B862FF203EFA59A9A55E5268A6F45D1B8C42558E2516B854634C6A112408A67820D21A8BB72D0DA1540B01E95062427AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%..%..%..d...$..%...$..d...$..Rich%..........PE..L...3.U[...........!......................................................................@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....3.U[........T........................rdata......T....rdata$zzzdbg.... .......rsrc$01..... .......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\4D81215\DisplayLinkIDD.msi

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1251, Title: Installation Database, Subject: DisplayLink Graphics, Author: DisplayLink Corp., Keywords: Installer, MSI, Database, Comments: Installs DisplayLink Graphics., Create Time/Date: Fri Dec 11 11:47:46 2009, Name of Creating Application: Advanced Installer 15.1 build 1ac8a36b05, Security: 0, Template: x64;2057, Last Saved By: x64;1049, Revision Number: {312AEE13-2735-4088-B726-C3CA64D81215}10.2.6709.0;{3B719D3D-BF94-4CEF-80B9-2C1E4AEDE0AC}10.2.6709.0;{0AECE230-D5D2-4880-B3ED-F23905ED66A9}, Number of Pages: 200, Number of Characters: 63
Category:	dropped
Size (bytes):	11059712
Entropy (8bit):	6.312294664571844
Encrypted:	false
SSDEEP:
MD5:	12529E3334449287500B2E462E525E28
SHA1:	26F7EF14C19C8A0B63F6139ECAE1F2C443F8CA0E
SHA-256:	8786664E76B6D3D039977BA0C52DAF5FFDAEDE0619A2B926B8A20A952F4C030D
SHA-512:	05880DF25BD90AE07F0C0D8A961AEF9F3A6C2E4B4167D4584E2E61B3A5EBFA3E917E965991D0621D8360D106FE6AFC4ADD884F5E951DB6184EFFD0CAABF0E625
Malicious:	false
Preview:	......................>.......................................................{...............E.......:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...............9...:...;...<...E...F...G...H...I...J...G...H...I...J...K...L...........................c...d...e...f...g...h...i...j...k...l...m...................................................................................................................................................................................................................................>...............?............................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...@...2...3...4...5...6...7...8...9...:...;...<...=.......K...A...C...B...H...D...E...F...G...J...I...]...L...s...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...a...^..._...`.......b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...L9..t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\decoder.dll

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	153088
Entropy (8bit):	6.550143660306436
Encrypted:	false
SSDEEP:
MD5:	0D219A13EA4DB9FC7A9DED2E646EF6DC
SHA1:	04E2284DE279B27A5935AF7A33A12B0E92D3A181
SHA-256:	08E5EFFA4E03563DF4B418E859E5A05B8EDEE1D037E4A0E8947663667F8D9C03
SHA-512:	38A5A463A8F80945F32579B6EDEA1422B599AF2B2760BEBB7908E46C95FE01D864D458AE48D85953DE6005D26A249CACCD061C55D8935906FC267BFFADF46FD7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Db................~.......\|.}.....}......e.......e.......e.......{.......{..............Ad..]...Ad......Adp.............Ad......Rich............PE..L....U[...........!......................................................................@......................... -.......-..<....... ...............................8...............................@...............d............................text...-........................... ..`.rdata...u.......v..................@..@.data...$W...@.......*..............@....rsrc... ............6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{312AEE13-2735-4088-B726-C3CA64D81215}\holder0.aiph

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	data
Category:	dropped
Size (bytes):	17400854
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	16CB84F98B9A21DBC47919339B55874E
SHA1:	D46D6C5A14F60FFA3DB526F3E83CE3BB908525AE
SHA-256:	7319E34403925D78A2B48470CDEF79DA8B51AFBE59456D7EC79DB45BEB889768
SHA-512:	F7C27361E950C14FAED3EA3938DAB0EF6129B023E091E829DC46DDA7CF6B21A2BB1670D2415920E1937C5C54A65A6DB83E1D0F525975F6BDFFFB528D5A459211
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC74A98E467F75109.TMP

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
File Type:	data
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	5.481384191763515
Encrypted:	false
SSDEEP:
MD5:	86060E7D2C8D35CC3E081BDA7884A134
SHA1:	77760DB2314427B4CF89EAD9304E5C69AB05304C
SHA-256:	57CF3D9417698236A917D1C944987BD8076147C6C12FA0B9AE122683E8E06530
SHA-512:	7A4E7932BA628C599250DB5EE870C3A20A0E2779E0661A737C0DBCBBDDB018CB07F42FA8A02CEA29B77D3513B2ADC2BF1D096A65EB54278C74BB51B51B271B00
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\oem0.PNF

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	5364
Entropy (8bit):	3.1238070403290243
Encrypted:	false
SSDEEP:
MD5:	BFF3682F21C59F967E951032716CC0D0
SHA1:	5A3DB81640DAC577F982C9A3DF36CE7E55E43627
SHA-256:	811451F9A8E86C3D2DA7698DAEDCC5A6927713628123B5010C105B5ACA65349B
SHA-512:	13771AF65622EA187042EA3A123315DB7C8876C9F5D37A9AFACC4EFFC804A6D8F8306284C1AAE392027F7CD9F4EA8750EF0FC9002FB4B740784BD4BD8228A106
Malicious:	false
Preview:	................H........L...,..............(...................................h.......................C.:.\.W.i.n.d.o.w.s..... ...................................................<.......(...................................................................................................................................`...................................................................................................................................................................................,...........................................................................................................................................................................................l.......................L...................................................................................................................................L...........................................................................................................................................................

C:\Windows\INF\oem1.PNF

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	5180
Entropy (8bit):	3.066382811152814
Encrypted:	false
SSDEEP:
MD5:	8A03613BB0DA48CEFCEABF1080DAEA9B
SHA1:	AB70FF9C8E77427D2C4B2331220AFB9A1E2B8FF8
SHA-256:	6364F2C49CC1377154442DEB886CE0FBE0DBB9AC531B4CCFB0460927DD8BA4AF
SHA-512:	96EE693AB44EFC1DB19FD941067C2EBB7CCECE7DF9ED6F92C41F33E25B47DEB637E5F08ABE9468FB5CB7848C2C5C6A1F6D5063B8CF789A9CEDE21BADDB23E53A
Malicious:	false
Preview:	................H...(....5...,......................p.......(.......(.......0...h...............8.......C.:.\.W.i.n.d.o.w.s.........................................................<.......(.......................................................................................................................................L...................................................................................................................................................................................................................................................................................................................................................................................................L...........................T.......................................................................................................................................d...............................................................$...........................................................

C:\Windows\INF\oem2.PNF

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	3.229401916447362
Encrypted:	false
SSDEEP:
MD5:	5263CFAC4DDFB9C99EDB3D88A18EC667
SHA1:	4FB05127272EA6246E68C346D88D5D80B948B83C
SHA-256:	2407E7E93C9EB8B5219CCB7BC9F2BF07FBB8C2234808EB92CC0FFA904793F07C
SHA-512:	79B22562731F385EFD994718A09D8F7CA6760621E9D6C0D8809C439ADC3B07A30B702BF95C9EF2655C3ACEF07DE2BCF0B22944CD508B8E3B982A33E5A2437B8B
Malicious:	false
Preview:	................X.........H..a......................h.......p...D.......d... ...h.......................C.:.\.W.i.n.d.o.w.s.............................................................................................................................................................................................................H...........................................8.......................................H.......................................................................................................................................................................................................................................,.......................................................................................................................................................................................................................................................................................................h...............................................8...........

\Device\ConDrv

Process:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	5.271022603090197
Encrypted:	false
SSDEEP:
MD5:	85D14D8F05739A205A6B7C96F272D860
SHA1:	9785DEBAEC6F344E877F9F8A7AA349F3E14B20F1
SHA-256:	490040C156D3BFC1047C8574A7AF9EAD20D26BCB335356DDC04AE5B32B062C52
SHA-512:	473C7648DBBAF1BDE78336D28DA17E9661D59C9657B5E370AC4D59E62737E85EBECE7577CAEBEB986553EC5A963152018A2D9F92C341907112291A7A17F0D12E
Malicious:	false
Preview:	..7-Zip SFX 4.57 Copyright (c) 1999-2007 Igor Pavlov 2007-12-06....Processing archive: C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe....Extracting NIVO\DisplayLinkCore.dat..Extracting NIVO\DisplayLinkCore64.dat..Extracting DL-USBNET-NCM\x64\dl-usbnet-ncm.cat..Extracting DL-USBNET-NCM\x64\dl-usbnet-ncm.inf..Extracting DL-USBNET-NCM\x64\DPInst.xml..Extracting DL-USBNET-NCM\x86\dl-usbnet-ncm.cat..Extracting DL-USBNET-NCM\x86\dl-usbnet-ncm.inf..Extracting DL-USBNET-NCM\x86\DPInst.xml..Extracting DLCDCNCM\dlcdcncm.cat..Extracting DLCDCNCM\DPInst.xml..Extracting DLIDUSB\x64\DPInst.xml..Extracting DLIDUSB\x86\DPInst.xml..Extracting DLUSBAUDIO\dlusbaudio.cat..Extracting DLUSBAUDIO\DPInst.xml..Extracting NIVO\DPInst.xml..Extracting DLUSBAUDIO\dlusbaudio.inf..Extracting DLIDUSB\x64\dlidusb.cat..Extracting DLIDUSB\x64\firefly-monitor-release.spkg..Extracting DLIDUSB\x86\dlidusb.cat..Extracting DLIDUSB\x86\firefly-monitor-release.spkg..Extracting NIVO\DisplayLi

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.174300593530014
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	79416048
MD5:	37c6031e6d7ed0910fab1ab8d18f76f4
SHA1:	37e4ea50f7668a52abe951fb540c7ced71c6500a
SHA256:	1200ec02f814bcd7a6de8035ec139548a80b628601b90f4a13a5b35cf976a4e0
SHA512:	1cb9942c0b23cbbb289aef240a0a87897f5541330b50131d8a87fcc776fc94071af30e65cee72cebbe8df4159dece3cb4ceaa0613290e71f8c0dce9c60258c2f
SSDEEP:	1572864:uUEkhCZGgCFVTAVAnlnPJPmIRcVm+dcOJ70ds3LDz:uUtCwfnxsHP
TLSH:	A8080159A29E4A37E1F36E34C9FD82DA042ABD50CF605A4FA309F50F17B1941C87D72A
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......T#T6.B:e.B:e.B:eK9d.B:eK?d.B:e.!?d.B:e./>d.B:e./9d.B:e.,>d.B:e.,?diB:e./?d.B:eK>d.B:e.Nee.B:e.NZe.B:eK;d.B:e.B;e.C:e.,3d.B:

File Icon


Icon Hash:	417d632b2939415d

Static PE Info

General

Entrypoint:	0x4e944f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61DCB48D [Mon Jan 10 22:34:53 2022 UTC]
TLS Callbacks:	0x4e9c68, 0x4e9b7f
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	384b25d0ab5f94c6616ef62254c2934b

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/2/2019 5:00:00 PM 7/13/2022 5:00:00 AM
Subject Chain	CN=DISPLAYLINK (UK) LIMITED, O=DISPLAYLINK (UK) LIMITED, L=Cambridge, C=GB, SERIALNUMBER=04811048, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=GB
Version:	3
Thumbprint MD5:	0D5B1D63A98B8AE79E2853114FC4A769
Thumbprint SHA-1:	BC59F06175DD978FA261989FB1D673D284D8432C
Thumbprint SHA-256:	C1400A1DD753F57534E5F9DFB3DA619B0D89A456BE1986387C69456411D7F633
Serial:	0DCAE65FEAC8DAD35AD3F9729044F0C4

Entrypoint Preview

Instruction
call 00007F99189B70E9h
jmp 00007F99189B5E2Fh
call 00007F99189B5FD7h
push 00000000h
call 00007F99189B5BB7h
pop ecx
test al, al
je 00007F99189B5FC0h
push 004E9502h
call 00007F99189B5D35h
pop ecx
xor eax, eax
ret
push 00000007h
call 00007F99189B6E15h
int3
push esi
push edi
push 00000FA0h
push 005BAE78h
call dword ptr [0056722Ch]
push 00574F00h
call dword ptr [005673ACh]
mov esi, eax
test esi, esi
jne 00007F99189B5FC3h
push 0058485Ch
call dword ptr [005673ACh]
mov esi, eax
test esi, esi
je 00007F99189B5FF8h
push 005721E4h
push esi
call dword ptr [00567384h]
push 005721C8h
push esi
mov edi, eax
call dword ptr [00567384h]
test edi, edi
je 00007F99189B5FC4h
test eax, eax
je 00007F99189B5FC0h
mov dword ptr [005BAE90h], edi
mov dword ptr [005BAE94h], eax
pop edi
pop esi
ret
xor eax, eax
push eax
push eax
push 00000001h
push eax
call dword ptr [005671F8h]
mov dword ptr [005BAE74h], eax
test eax, eax
jne 00007F99189B5F99h
push 00000007h
call 00007F99189B6D93h
int3
push 005BAE78h
call dword ptr [00567228h]
mov eax, dword ptr [005BAE74h]
test eax, eax
je 00007F99189B5FB9h

Rich Headers

Programming Language:

[C++] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b2a98	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c8000	0x49eea60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4bbae00	0x1cf0	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bb7000	0x14410	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x189b70	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x189be0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x182c90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x167000	0x4c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x1b271c	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x165446	0x165600	False	0.434924525621	data	6.46032188249	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x167000	0x4d7a0	0x4d800	False	0.393516885081	data	5.05136073643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b5000	0x12ae0	0x4a00	False	0.201541385135	data	4.44267625064	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1c8000	0x49eea60	0x49eec00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4bb7000	0x14410	0x14600	False	0.559552338957	data	6.64662733117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
EXE	0x1c9044	0x24	ASCII text, with no line terminators
EXE	0x1c9068	0x8ce	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
EXE	0x1c9938	0x27fe210	PE32 executable (console) Intel 80386, for MS Windows
EXE	0x29c7b48	0x1063220	PE32 executable (GUI) Intel 80386, for MS Windows
EXE	0x3a2ad68	0x109b578	PE32 executable (GUI) Intel 80386, for MS Windows
EXE	0x4ac62e0	0x2866	Microsoft Cabinet archive data, 2366 bytes, 3 files
RT_BITMAP	0x4ac8b48	0x1714c	data
RT_ICON	0x4adfc94	0x32028	data
RT_ICON	0x4b11cbc	0xc828	data
RT_ICON	0x4b1e4e4	0x70a8	dBase IV DBT of \300.DBF, block length 27648, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x4b2558c	0x4ee8	data
RT_ICON	0x4b2a474	0x4048	data
RT_ICON	0x4b2e4bc	0x3228	dBase IV DBT of \200.DBF, blocks size 0, block length 12288, next free block index 40, next free block 4076469490, next used block 4243782140
RT_ICON	0x4b316e4	0x1ca8	data
RT_ICON	0x4b3338c	0xca8	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x4b34034	0x748	data
RT_ICON	0x4b3477c	0x368	GLS_BINARY_LSB_FIRST
RT_ICON	0x4b34ae4	0x32028	data
RT_ICON	0x4b66b0c	0xc828	data
RT_ICON	0x4b73334	0x70a8	dBase IV DBT of \300.DBF, block length 27648, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x4b7a3dc	0x4ee8	data
RT_ICON	0x4b7f2c4	0x4048	data
RT_ICON	0x4b8330c	0x3228	dBase IV DBT of \200.DBF, blocks size 0, block length 12288, next free block index 40, next free block 4076469490, next used block 4243782140
RT_ICON	0x4b86534	0x1ca8	data
RT_ICON	0x4b881dc	0xca8	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0x4b88e84	0x748	data
RT_ICON	0x4b895cc	0x368	GLS_BINARY_LSB_FIRST
RT_DIALOG	0x4b89934	0xb8	data
RT_DIALOG	0x4b899ec	0x264	data
RT_DIALOG	0x4b89c50	0x2d4	data
RT_DIALOG	0x4b89f24	0x254	data
RT_STRING	0x4b8a178	0x106	data
RT_STRING	0x4b8a280	0x41e	data
RT_STRING	0x4b8a6a0	0x3bc	data
RT_STRING	0x4b8aa5c	0x43a	data
RT_STRING	0x4b8ae98	0x44c	data
RT_STRING	0x4b8b2e4	0x43c	data
RT_STRING	0x4b8b720	0x50c	data
RT_STRING	0x4b8bc2c	0x4d0	data
RT_STRING	0x4b8c0fc	0x456	data
RT_STRING	0x4b8c554	0x3a0	data
RT_STRING	0x4b8c8f4	0x4ba	data
RT_STRING	0x4b8cdb0	0x456	data
RT_STRING	0x4b8d208	0x47a	data
RT_STRING	0x4b8d684	0x2ac	data
RT_STRING	0x4b8d930	0x2d0	data
RT_STRING	0x4b8dc00	0x468	data
RT_STRING	0x4b8e068	0x4c2	data
RT_STRING	0x4b8e52c	0x46a	data
RT_STRING	0x4b8e998	0x476	data
RT_STRING	0x4b8ee10	0x49e	data
RT_STRING	0x4b8f2b0	0x418	data
RT_STRING	0x4b8f6c8	0x442	data
RT_STRING	0x4b8fb0c	0x424	data
RT_STRING	0x4b8ff30	0x42c	data
RT_STRING	0x4b9035c	0x436	data
RT_STRING	0x4b90794	0x442	data	Norwegian	Norway
RT_STRING	0x4b90bd8	0x1d2	data	Chinese	China
RT_STRING	0x4b90dac	0x20c	data
RT_STRING	0x4b90fb8	0x35c	data
RT_STRING	0x4b91314	0x322	data
RT_STRING	0x4b91638	0x3fa	data
RT_STRING	0x4b91a34	0x3a8	data
RT_STRING	0x4b91ddc	0x3ce	data
RT_STRING	0x4b921ac	0x3de	data
RT_STRING	0x4b9258c	0x428	data
RT_STRING	0x4b929b4	0x466	data
RT_STRING	0x4b92e1c	0x362	data
RT_STRING	0x4b93180	0x3b2	data
RT_STRING	0x4b93534	0x3f4	data
RT_STRING	0x4b93928	0x424	data
RT_STRING	0x4b93d4c	0x21e	data
RT_STRING	0x4b93f6c	0x220	data
RT_STRING	0x4b9418c	0x430	data
RT_STRING	0x4b945bc	0x3a0	data
RT_STRING	0x4b9495c	0x46a	data
RT_STRING	0x4b94dc8	0x3ba	data
RT_STRING	0x4b95184	0x422	data
RT_STRING	0x4b955a8	0x3e8	data
RT_STRING	0x4b95990	0x3d4	data
RT_STRING	0x4b95d64	0x3b0	data
RT_STRING	0x4b96114	0x3b8	data
RT_STRING	0x4b964cc	0x43c	data
RT_STRING	0x4b96908	0x35c	data	English	United States
RT_STRING	0x4b96c64	0x3c8	data	Norwegian	Norway
RT_STRING	0x4b9702c	0x170	data	Chinese	China
RT_STRING	0x4b9719c	0x35c	data	English	Great Britain
RT_STRING	0x4b974f8	0x176	data
RT_STRING	0x4b97670	0x111e	data
RT_STRING	0x4b98790	0xf66	data
RT_STRING	0x4b996f8	0x11dc	data
RT_STRING	0x4b9a8d4	0x10c6	data
RT_STRING	0x4b9b99c	0x1230	data
RT_STRING	0x4b9cbcc	0x138a	data
RT_STRING	0x4b9df58	0x140a	data
RT_STRING	0x4b9f364	0x128a	data
RT_STRING	0x4ba05f0	0x1130	data
RT_STRING	0x4ba1720	0x13fe	data
RT_STRING	0x4ba2b20	0x1148	data
RT_STRING	0x4ba3c68	0x1334	data
RT_STRING	0x4ba4f9c	0xbe4	data
RT_STRING	0x4ba5b80	0xb50	data
RT_STRING	0x4ba66d0	0x12b4	data
RT_STRING	0x4ba7984	0x137c	data
RT_STRING	0x4ba8d00	0x1294	data
RT_STRING	0x4ba9f94	0x116a	data
RT_STRING	0x4bab100	0x11cc	data
RT_STRING	0x4bac2cc	0x111c	data
RT_STRING	0x4bad3e8	0x1258	data
RT_STRING	0x4bae640	0x10ce	data
RT_STRING	0x4baf710	0x11ae	data
RT_STRING	0x4bb08c0	0x12dc	data
RT_STRING	0x4bb1b9c	0x111e	data	English	United States
RT_STRING	0x4bb2cbc	0x1180	data	Norwegian	Norway
RT_STRING	0x4bb3e3c	0x886	data	Chinese	China
RT_STRING	0x4bb46c4	0x111e	data	English	Great Britain
RT_STRING	0x4bb57e4	0x8c4	data
RT_RCDATA	0x4bb60a8	0x11b	data
RT_GROUP_ICON	0x4bb61c4	0x92	data
RT_GROUP_ICON	0x4bb6258	0x92	data
RT_VERSION	0x4bb62ec	0x384	data
RT_MANIFEST	0x4bb6670	0x3f0	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetSystemInfo, CreateProcessA, CreateToolhelp32Snapshot, Process32First, Process32Next, InitializeCriticalSection, FindResourceExW, GetModuleHandleA, LocalFree, FormatMessageA, FormatMessageW, IsValidLocale, GetUserDefaultUILanguage, SetLastError, GetStdHandle, CreateDirectoryW, DeleteFileW, GetFileAttributesW, GetFullPathNameW, GetTempFileNameW, SetFileAttributesW, GetTempPathW, WaitForSingleObject, Sleep, GetCurrentProcessId, GetExitCodeProcess, CreateProcessW, OpenProcess, MoveFileW, GetTickCount, CloseHandle, RaiseException, CreateThread, GetCurrentThread, SetThreadPriority, ResumeThread, ExpandEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetCurrentProcess, GetSystemDirectoryW, GetSystemWindowsDirectoryW, GetSystemWow64DirectoryW, FreeLibrary, GetModuleFileNameW, GetModuleHandleExW, LoadLibraryExA, LocalAlloc, VerSetConditionMask, GetVersionExA, GetProductInfo, IsWow64Process, VerifyVersionInfoW, QueryPerformanceFrequency, CreateFileA, IsDebuggerPresent, GetCurrentThreadId, GetLocalTime, CreateFileW, GetTempPathA, GetModuleFileNameA, FindFirstFileA, FindNextFileA, OutputDebugStringA, DeviceIoControl, FileTimeToSystemTime, GetVersionExW, LoadLibraryExW, GetEnvironmentVariableW, CreateEventW, WaitForMultipleObjects, WriteFile, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, MultiByteToWideChar, WideCharToMultiByte, GetStringTypeW, WaitForSingleObjectEx, SwitchToThread, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, EncodePointer, DecodePointer, TryEnterCriticalSection, GetCPInfo, CompareStringW, LCMapStringW, GetLocaleInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, SetEvent, ResetEvent, GetStartupInfoW, InitializeSListHead, GetCurrentDirectoryW, RemoveDirectoryW, SetEndOfFile, SetFilePointerEx, CreateDirectoryExW, AreFileApisANSI, CreateTimerQueue, SignalObjectAndWait, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibraryAndExitThread, VirtualAlloc, VirtualProtect, VirtualFree, DuplicateHandle, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RtlUnwind, VirtualQuery, ExitProcess, HeapAlloc, HeapFree, GetFileType, GetFileSizeEx, GetTimeZoneInformation, FlushFileBuffers, GetConsoleCP, GetConsoleMode, GetDateFormatW, GetTimeFormatW, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW, lstrcmpW, lstrcmpA, MoveFileExW, GetProcAddress, FindResourceW, LoadResource, LockResource, GetLastError, CreateMutexW, SizeofResource, OutputDebugStringW, CopyFileW, SetCurrentDirectoryW, GetModuleHandleW, QueryPerformanceCounter, GetBinaryTypeW
USER32.dll	GetSystemMetrics, SendNotifyMessageW, LoadCursorW, SetCursor, MessageBoxW, GetMessageW, CreateDialogParamW, PostMessageW, GetWindowRect, DestroyWindow, SendMessageW, SetWindowTextW, ShowWindow, IsWindow, OffsetRect, DispatchMessageW, IsDialogMessageW, CopyRect, TranslateMessage, GetDlgItem, GetDesktopWindow, SetWindowPos
ADVAPI32.dll	CreateProcessAsUserW, OpenProcessToken, StartServiceA, QueryServiceConfigA, DeleteService, ControlService, DuplicateTokenEx, GetUserNameW, RegCloseKey, RegOpenUserClassesRoot, RegCreateKeyExW, RegDeleteValueW, RegEnumKeyW, RegFlushKey, RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, CloseServiceHandle, RegEnumValueW, CheckTokenMembership, FreeSid, AllocateAndInitializeSid, OpenSCManagerA, RegEnumKeyA, InitiateSystemShutdownA, RegEnumValueA, RegEnumKeyExA, RegDeleteKeyA, RegOpenCurrentUser, RegSetValueExA, RegQueryValueExA, RegDeleteValueA, RegCreateKeyExA, ConvertSecurityDescriptorToStringSecurityDescriptorW, ConvertStringSidToSidA, ConvertSidToStringSidA, SetSecurityInfo, GetSecurityInfo, SetEntriesInAclA, CreateServiceW, LookupPrivilegeValueA, LookupAccountSidA, RevertToSelf, ImpersonateLoggedOnUser, GetTokenInformation, GetLengthSid, CopySid, AdjustTokenPrivileges, DuplicateToken, OpenThreadToken, SetThreadToken, ConvertStringSecurityDescriptorToSecurityDescriptorA, QueryServiceStatusEx, OpenServiceA
SETUPAPI.dll	SetupDiGetClassDevsA, SetupDiCallClassInstaller, SetupDiGetDeviceInstallParamsA, SetupDiSetClassInstallParamsA, SetupDiClassGuidsFromNameA, CM_Get_Device_IDA, CM_Get_DevNode_Status, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyW, SetupDiGetDeviceInstanceIdW, SetupDiBuildDriverInfoList, SetupDiEnumDriverInfoA, SetupCopyOEMInfW, SetupDiGetINFClassW, SetupGetInfFileListW, SetupDiClassNameFromGuidW, CM_Locate_DevNodeA, CM_Get_Sibling, CM_Get_DevNode_Registry_PropertyA, CM_Get_Child, SetupDiSetDeviceInstallParamsA, SetupDiOpenDevRegKey, SetupDiGetDeviceInterfaceDetailA, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInstanceIdA, SetupDiGetDeviceRegistryPropertyA, SetupDiDeleteDevRegKey, SetupDiRemoveDevice, SetupDiGetClassDevsW, SetupDiDestroyDriverInfoList, SetupDiEnumDeviceInfo
SHLWAPI.dll	SHGetValueW, SHCopyKeyA, SHDeleteKeyA
SHELL32.dll	SHFileOperationW, ShellExecuteW
ole32.dll	CoCreateGuid, StringFromGUID2

Version Infos

Description	Data
LegalCopyright	Copyright (c) 2003 - 2022 DisplayLink Corp. All rights reserved.
InternalName	Setup
FileVersion	10, 2, 6751, 0
CompanyName	DisplayLink Corp.
ProductName	DisplayLink Core Software 10.2.6751.0
ProductVersion	10, 2, 6751, 0
FileDescription	Installs DisplayLink Software
OriginalFilename	Setup.exe
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Norwegian	Norway
Chinese	China
English	United States
English	Great Britain

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Setup.exePID: 6404, Parent PID: 3964

General

Target ID:	0
Start time:	15:03:43
Start date:	20/04/2022
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x9d0000
File size:	79416048 bytes
MD5 hash:	37C6031E6D7ED0910FAB1AB8D18F76F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: additional.exePID: 3956, Parent PID: 6404

General

Target ID:	4
Start time:	15:04:02
Start date:	20/04/2022
Path:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DL2.tmp\additional.exe" -y -o"C:\Users\user\AppData\Local\Temp\DL2.tmp\
Imagebase:	0x400000
File size:	41935376 bytes
MD5 hash:	36A497196AD65CDBD3A4F50B1760DED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exePID: 3572, Parent PID: 3956

General

Target ID:	6
Start time:	15:04:03
Start date:	20/04/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6406f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: DLC3A4.exePID: 6084, Parent PID: 6404

General

Target ID:	16
Start time:	15:05:10
Start date:	20/04/2022
Path:	C:\Users\user\AppData\Local\Temp\DL2.tmp\DLC3A4.exe
Wow64 process (32bit):	true
Commandline:	DLC3A4.exe /exelang 1033 ALLOW64BIT=Yes DL_PROMOTE_STORE_APP=Yes DL_PRODUCT_NAME="DisplayLink Graphics" DL_BRANDING_UPGRADE_CODE="{78A36ACD-80D5-490f-B4C4-83D7FCC08391}" DL_BRANDING_PRODUCT_CODE="{08DDE00A-EEEA-416E-9E61-B9085D542140}" DL_BRANDING_CAB="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLCABA.tmp" DL_BRANDING_NEW_DEVICE_ACTIVITY=mirror DL_ID_USBDRIVER_PATH="C:\Users\user\AppData\Local\Temp\DL2.tmp\DLIDUSB\x64" DL_HOTDESK_SERVICE="No" DL_INSTALL_ANALYTICS=Yes DL_TEMP_DIR="C:\Users\user\AppData\Local\Temp\DL2.tmp\" /lv "C:\Users\user\AppData\Local\Temp\DLC335A.LOG"
Imagebase:	0x380000
File size:	17413496 bytes
MD5 hash:	F501A103478D855B0088A41117A4D4EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: msiexec.exePID: 5484, Parent PID: 588

General

Target ID:	19
Start time:	15:05:23
Start date:	20/04/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff774db0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: msiexec.exePID: 6748, Parent PID: 5484

General

Target ID:	21
Start time:	15:05:26
Start date:	20/04/2022
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A63054042D1C239EA3B02585E95E450D C
Imagebase:	0x840000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: msiexec.exePID: 6744, Parent PID: 5484

General

Target ID:	22
Start time:	15:05:28
Start date:	20/04/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding A71763BA0B19F12D058A5205CCDD4884 C
Imagebase:	0x7ff774db0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high