Knowlu-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Knowlu-setup.exe
Size 5.7MB
Sample261113-ka21eahv8w
SHA256 69a8ff9b577892a1c8f32d6311f0b3a3121abecb37d8f24f07a75a8cd1a87e06
MD5 d28d1069aa7d4366dfaa2db4603bdfdd
SHA1 3452efed498c1d6f29fa0f96b6d70c472f8d0fc7
SHA512 88fe91a5fd17ec981a416e0371f3b9331029daef2a2c4bb43a40a85d40c144e7412406a366aec1f7f766c9d6e7c68193543e4369610860d1736daadd3ba041ec
SSDEEP 98304:tCWPx1ImYT3wGzTf+Gag8ACeythwy/U7xfyWnYw+wlZDeIQoa+4T6Lnk6B5jmkmZ:tCW5Gm63w8yrrAAHc7BHR3e0umpB5jly
TLSH
T1EB56335A561D7EABFE745334A56CA1349AE3FCB3C144C708624CB7AF3C1924A8D1DA32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
Knowlu-setup.exe
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/knowlu-engine.exe
unpack001/knowlu.exe

File Explorer

Knowlu-setup.exe

.exe 5.7MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.8MB
WebView2Loader.dll

.dll 156KB
knowlu-engine.exe

.exe 5.3MB
knowlu.exe

.exe 8.9MB

Knowlu-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 69a8ff9b577892a1c8f32d6311f0b3a3121abecb37d8f24f07a75a8cd1a87e06
MD5 d28d1069aa7d4366dfaa2db4603bdfdd
SHA1 3452efed498c1d6f29fa0f96b6d70c472f8d0fc7
SHA512 88fe91a5fd17ec981a416e0371f3b9331029daef2a2c4bb43a40a85d40c144e7412406a366aec1f7f766c9d6e7c68193543e4369610860d1736daadd3ba041ec
SSDEEP 98304:tCWPx1ImYT3wGzTf+Gag8ACeythwy/U7xfyWnYw+wlZDeIQoa+4T6Lnk6B5jmkmZ:tCW5Gm63w8yrrAAHc7BHR3e0umpB5jly
TLSH
T1EB56335A561D7EABFE745334A56CA1349AE3FCB3C144C708624CB7AF3C1924A8D1DA32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 f414de01c4680f0bb0694d1ea7803c6968f3a81bf6bad01b89bfc65dce14c2a2
MD5 851343f374301cf0beddb31a5a81bde7
SHA1 dcfa6ecf2d8f2135662fe9731cf1a3bde25b7160
SHA512 b01ddb5452645683370bf3fce211495c1ba25213e47da751b831df82337b4a4c52d9f67d19fe45cf50110d1e96110c2a80ee3d81dac772e0cbc5f0ae66863711
SSDEEP 49152:ZiGV3T3JgjEwu1LDIo5/r22ysIZrjQGRiOiwjMGp6HWXTzDS:Zik3cEwu1HIqr2JdvzRbLNzG
TLSH
T1E995222572E48031F1B31E7155F49AB21A3EBD301B7009DF27919A6E2E70ED2E639B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

55:de:6e:43:16:b6:26:6d:37:c1:97:54:50:10:d7:b5:69:58:d0:84:83:d8:a7:3a:24:93:6a:ce:3b:53:8b:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Nov 6, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

55:de:6e:43:16:b6:26:6d:37:c1:97:54:50:10:d7:b5:69:58:d0:84:83:d8:a7:3a:24:93:6a:ce:3b:53:8b:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 16, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:32:4e:ae:a6:30:09:6a:5e:7a:00:00:00:00:02:32

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WebView2Loader.dll

IMPHASH 90db803f7a0acc2517ef287c1dc1bb76
SHA256 8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c
MD5 b7f10b8066ee96c628e09c439b8d0b9b
SHA1 3a2fe02d9d43100056b7dd1ccd2dfb3f30ad0f55
SHA512 4ce26a59faadfa0a20e098caf297f3403ac1542706f72879ed7248dee4026a5c7ffc3aa95912d8e3510ac7593082429ce0e83978a5843cfce52fb475cc975333
SSDEEP 3072:1mJgy7/ph9euiDNQ6A93jJBC9JGv6T/MEtJ6mj4UrqhQ:w/NVZ6A93j//EtJnrX
TLSH
T173F35C5BB2E900BBE17BC278C5A34A15E772B8111760AAEF036447791F137D0AE3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

20:0a:0b:1d:57:67:2c:96:ed:25:eb:8b:ac:94:71:7c:b9:ef:20:b6:a5:c9:21:f6:fb:30:b0:72:47:ef:a7:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 1, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

18608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WebView2Loader.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

knowlu-engine.exe

IMPHASH 8625c9823a9112f55940c2daeeb63890
SHA256 c6545d951dd80fa8a89c8d57ce767b06dca4adb3c9b2b79c37cd426512e2f6a1
MD5 ecec4241114e7769279ecaebc28a34db
SHA1 b069da0053da875ca2f75330b9c42befcf6dc158
SHA512 b5a4778ab7d3e25338e6c0e8f96ffbae4c7ca8116931d1d669e7ac0bece5ee680eaffce3f4622b1828bf6f90cc744fb2c460e7bda9f5c42307f8424fc8bf9eac
SSDEEP 98304:zJOuAZN0N8EL9ODPDZ+sJOyuzoo6Fl98Dzin4+s:C05OQhq4
TLSH
T11E466D03F6A5D1E9C09DC179835BA233F636BC8D4931B2AB5BD04B212E26F50AF4DB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036 CredFree CredReadW

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CompareStringOrdinal CreateDirectoryW CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetWindowsDirectoryW HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection LoadLibraryA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFilePointerEx SetFileTime SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteFileEx __C_specific_handler GetDynamicTimeZoneInformation CloseHandle DuplicateHandle FreeLibrary GetLastError SetHandleInformation SetLastError GetProcAddress FormatMessageW GetProcessHeap HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetStdHandle SetConsoleMode SetConsoleTextAttribute WriteConsoleW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm atexit abort calloc exit fflush fprintf free ldexp malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf wcslen

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockopt ioctlsocket recv select send setsockopt

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

knowlu.exe

IMPHASH d33885dd34d531912e8d862fcd2082a8
SHA256 7c87134d2a591c1120a0e9f650f17c64021ed8152ee40ce0c796c88e190146df
MD5 812d51ddb0b314ad108d40c6a561235e
SHA1 6a8b514554eb16da8b043e40f9096df4937d85a0
SHA512 7a2febcad5f176846f5af3a7ab6c85ea161f7e81b9efc7b61a551d0ed8db3981bf27ed96c7a229d19f542bbc4cc194a2a98a37c5bee3e78f7f4f05993eb083eb
SSDEEP 98304:tidViujWPJdbFJSyAmZMtYKQ2XblZHKsvwu5JOyuzoo6Fl98DwK8rn+se:vJvEKYnQ
TLSH
T158967C07F69181E9C09DC5B8835BA237FB32B88D4920B29F5BD44F112E26F50AF1DB59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036 RegGetValueW CredDeleteW CredFree CredReadW CredWriteW ImpersonateAnonymousToken RevertToSelf RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AddVectoredExceptionHandler CreateFileMappingA CreateToolhelp32Snapshot FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlVirtualUnwind SetEnvironmentVariableW SetUnhandledExceptionFilter DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler GetDynamicTimeZoneInformation GetModuleHandleA CompareStringOrdinal GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetUserDefaultUILanguage GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapReAlloc LCIDToLocaleName LoadLibraryA LoadLibraryW MapViewOfFile MultiByteToWideChar RtlLookupFunctionEntry UnmapViewOfFile WideCharToMultiByte lstrlenW CreateEventW CreateMutexW CreateProcessW CreateThread CreateWaitableTimerExW DuplicateHandle ExitProcess FlsAlloc FlsFree FlsSetValue FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetLastError GetProcessId GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetWindowsDirectoryW GlobalFree InitOnceBeginInitialize InitOnceComplete IsThreadAFiber OpenProcess ReleaseMutex SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForMultipleObjects WaitForSingleObject GetProcAddress LoadLibraryExA CloseHandle GetProcessHeap HeapAlloc HeapFree FormatMessageW CancelIo CancelIoEx CopyFileExW CreateDirectoryW CreateFileW CreateIoCompletionPort CreateSymbolicLinkW DeleteFileW DeviceIoControl FindClose FindFirstFileExW FindNextFileW FlushFileBuffers GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetOverlappedResult GetQueuedCompletionStatusEx GetStdHandle GetTempPathW LockFileEx MoveFileExW PostQueuedCompletionStatus ReadFile ReadFileEx RemoveDirectoryW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime WriteConsoleW WriteFile WriteFileEx

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm atexit abort calloc ceilf exit fflush fprintf free ldexp malloc memcmp memcpy memmove memset setvbuf signal strerror strlen strncmp vfprintf wcslen

ntdll

NtCreateNamedPipeFile RtlGetVersion RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

bcryptprimitives

ProcessPrng

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor

ole32

CoCreateInstance CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

shell32

SHCreateItemFromParsingName DragFinish DragQueryFileW SHAppBarMessage SHGetKnownFolderPath ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

shlwapi

SHCreateMemStream

user32

ChangeDisplaySettingsExW ClientToScreen CloseClipboard CloseTouchInputHandle DrawIconEx DrawTextW EmptyClipboard EnableWindow EnumDisplayMonitors FillRect GetActiveWindow GetAsyncKeyState GetClipboardData GetDC GetKeyState GetKeyboardLayout GetKeyboardState GetMenuItemInfoW GetMonitorInfoW GetRawInputData GetTouchInputInfo GetUpdateRect GetWindowDC InvalidateRect InvalidateRgn IsClipboardFormatAvailable IsWindowEnabled MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow OffsetRect OpenClipboard RedrawWindow RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterRawInputDevices RegisterTouchWindow ReleaseCapture ReleaseDC ScreenToClient SendInput SetCapture SetClipboardData SetFocus SetMenuItemInfoW SetWindowRgn ToUnicodeEx TrackMouseEvent UpdateWindow ValidateRect VkKeyScanW AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeWindowMessageFilterEx CheckMenuItem ClipCursor CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawMenuBar EnableMenuItem EnumChildWindows FindWindowExW FindWindowW FlashWindowEx GetClientRect GetClipCursor GetCursorPos GetForegroundWindow GetMenu GetMenuBarInfo GetMessageA GetMessageW GetParent GetSystemMenu GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW IsIconic IsProcessDPIAware IsWindow IsWindowVisible KillTimer LoadCursorW MessageBoxW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterWindowMessageA RemoveMenu SendMessageW SetCursor SetCursorPos SetForegroundWindow SetMenu SetParent SetPropW SetTimer SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW TrackPopupMenu TranslateAcceleratorW TranslateMessage

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

bcrypt

BCryptGenRandom

crypt32

CertAddEncodedCertificateToStore CertCloseStore CertCreateCertificateChainEngine CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

202KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Knowlu-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

WebView2Loader.dll

kernel32

generic

knowlu-engine.exe

advapi32

bcrypt

kernel32

msvcrt

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

generic

knowlu.exe

advapi32

kernel32

msvcrt

ntdll

webview2loader

bcryptprimitives

dwmapi

gdi32

ole32

shell32

shlwapi

user32

api-ms-win-core-synch-l1-2-0

comctl32

oleaut32

combase

bcrypt