{
  "family": "relevantknowledge",
  "sample_count": 209,
  "category": "spyware",
  "description": "Adware:Win32/RelevantKnowledge is a highly intrusive, pervasive adware and spyware application that deceptively masquerades as a legitimate market research tool to silently harvest extensive user browsing habits and system data.<br><br><b>What is RelevantKnowledge?</b><br>To the average consumer, RelevantKnowledge is often installed entirely without their knowledge, later manifesting as unexpected pop-up surveys or sluggish internet performance. For IT security and compliance teams, RelevantKnowledge is a severe privacy violation. It acts as a system-wide spyware agent, actively monitoring, recording, and exfiltrating every website visited, search query entered, and software application utilized on the endpoint.<br><br><b>Infection Vectors & Threat Hunting</b><br>RelevantKnowledge is almost exclusively distributed via Pay-Per-Install (PPI) software bundlers. It is wrapped inside the installers of freeware (like file converters or media players). It utilizes Dark Patterns—obscure EULAs and pre-checked boxes—to claim the user 'consented' to the data harvesting. Once executed, it installs a core executable (often <code>rlvknlg.exe</code>) in the <code>%ProgramFiles%</code> directory. It establishes deep persistence by installing a Windows Service, ensuring the tracking agent runs continuously in the background, even before a user logs in.<br><br><b>Forensic Analysis & Impact</b><br>Threat hunters will observe continuous, anomalous outbound HTTP/HTTPS connections originating from <code>rlvknlg.exe</code> to known data collection domains (like <code>rlvknlg.com</code>). The Windows Registry will show modifications under <code>HKLM\\System\\CurrentControlSet\\Services</code>. The impact is a massive loss of endpoint privacy; the harvested data frequently includes access to sensitive corporate portals, internal URLs, and potentially sensitive search queries.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1204.002",
    "T1112",
    "T1543.003",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the continuous exfiltration of sensitive browsing habits and internal corporate URLs.",
    "Open Windows Services (services.msc) and forcefully stop and disable the 'RelevantKnowledge' tracking service.",
    "Audit the 'Add/Remove Programs' list and methodically uninstall the RelevantKnowledge application and the freeware that bundled it.",
    "Deploy specialized adware removal tools (like Malwarebytes) to identify and strip the deep registry hooks left by the spyware."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' threat; the exfiltrated data poses a massive compliance and privacy risk to the organization.",
    "Avoid trusting the built-in uninstaller completely; always follow up with an EDR sweep to ensure the tracking service was actually removed."
  ],
  "target_industries": [
    "Government",
    "Defense",
    "Journalists"
  ],
  "motivation": "Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}