home

knxf.dll

KNConnection

Voicefive Networks, Inc.

The component is part of the TMRG platform which will track various behaviors of web browsing habits including tracking sites and domains visited as well as ads clicked. The module knxf.dll by Voicefive Networks has been detected as adware by 3 anti-malware scanners. Part of RelevantKnowledge, a program typically installed via a software bundle (with the user's knowledge should they read the EULA) and will run in the background collecting and monitoring information about the user's behavior in order to build an extensive profile.
Publisher:
Voicefive Networks, Inc.  (signed and verified)

Product:
KNConnection

Version:
1, 2, 323, 1

MD5:
f36dd6b3b210ea6aa420cfe5d62f6385

SHA-1:
3d763e4067cd33841faedb3e66898bb873fedfdc

SHA-256:
4fb2ac9e98f32a8ff0790e231cf0808276bcaf704e9f737858d943ed1e8bb8cf

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
5/2/2024 7:30:35 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Potentially harmful program RelevantKnowledge
2014.0.4189

Reason Heuristics
PUP.VoicefiveNetworks.E
14.12.3.16

Sophos
Generic Proxy-OSS Application
4.98

File size:
220.7 KB (225,952 bytes)

Product version:
1, 2, 323, 1

Copyright:
Copyright © 2001-2008

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

Common path:
C:\Program Files\knconnection\knxf.dll

Digital Signature
Signed by:
Voicefive Networks, Inc.

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
3/3/2008 6:00:00 PM

Valid to:
3/4/2010 5:59:59 PM

Subject:
CN="Voicefive Networks, Inc.", OU=Secure Application Development, O="Voicefive Networks, Inc.", L=Chicago, S=Illinois, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
69D4A9838720D7B9A606CB8E1E25ADED

File PE Metadata
Compilation timestamp:
3/31/2009 10:15:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:XjcgLHLEbfdFpwPYHL8VjzKFc/OgEzGlDs1rLM:XVLr8drwUL8B2DgEeg1rLM

Entry address:
0x136E7

Entry point:
6A, 0C, 68, 98, 6D, 02, 10, E8, 91, 08, 00, 00, 33, C0, 40, 89, 45, E4, 8B, 75, 0C, 33, FF, 3B, F7, 75, 0C, 39, 3D, 54, 09, 03, 10, 0F, 84, B3, 00, 00, 00, 89, 7D, FC, 3B, F0, 74, 05, 83, FE, 02, 75, 31, A1, 30, D2, 02, 10, 3B, C7, 74, 0C, FF, 75, 10, 56, FF, 75, 08, FF, D0, 89, 45, E4, 39, 7D, E4, 0F, 84, 85, 00, 00, 00, FF, 75, 10, 56, FF, 75, 08, E8, 22, FE, FF, FF, 89, 45, E4, 3B, C7, 74, 72, 8B, 5D, 10, 53, 56, FF, 75, 08, E8, 9D, D6, FF, FF, 89, 45, E4, 83, FE, 01, 75, 0E, 3B, C7, 75, 0A, 53, 57, FF...
 
[+]

Entropy:
6.0546

Developed / compiled with:
Microsoft Visual C++ v7.1

Code size:
144 KB (147,456 bytes)

Remove knxf.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.