goodbyedpi-0.2.3rc3-turkey.zip
- SHA256 b1f93b2e9434d93c5321275c4a3d0a87f3b822c552eceabdbeb1610c879e1863
Overview
overview
7Static
static
3goodbyedpi...ey.zip
windows11-21h2-x64
1README-BENİ OKU.txt
windows11-21h2-x64
3licenses/L...ne.txt
windows11-21h2-x64
3licenses/L...pi.txt
windows11-21h2-x64
3licenses/L...sh.txt
windows11-21h2-x64
3licenses/L...rt.txt
windows11-21h2-x64
3service_in...ey.cmd
windows11-21h2-x64
1service_in...ne.cmd
windows11-21h2-x64
1service_in...ne.cmd
windows11-21h2-x64
1service_in...ne.cmd
windows11-21h2-x64
7service_in...ne.cmd
windows11-21h2-x64
7service_in...ne.cmd
windows11-21h2-x64
7service_in...ne.cmd
windows11-21h2-x64
7service_remove.cmd
windows11-21h2-x64
7turkey_dnsredir.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1turkey_dns...ne.cmd
windows11-21h2-x64
1x86/WinDivert.dll
windows11-21h2-x64
3x86/WinDivert32.sys
windows11-21h2-x64
1x86/WinDivert64.sys
windows11-21h2-x64
1x86/goodbyedpi.exe
windows11-21h2-x64
3x86_64/WinDivert.dll
windows11-21h2-x64
1x86_64/Win...64.sys
windows11-21h2-x64
1x86_64/goodbyedpi.exe
windows11-21h2-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
goodbyedpi-0.2.3rc3-turkey.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
README-BENİ OKU.txt
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
licenses/LICENSE-getline.txt
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
licenses/LICENSE-goodbyedpi.txt
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
licenses/LICENSE-uthash.txt
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
licenses/LICENSE-windivert.txt
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
service_install_dnsredir_turkey.cmd
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
service_install_dnsredir_turkey_alternative2_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
service_install_dnsredir_turkey_alternative3_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
service_install_dnsredir_turkey_alternative4_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral11
Sample
service_install_dnsredir_turkey_alternative5_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral12
Sample
service_install_dnsredir_turkey_alternative6_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral13
Sample
service_install_dnsredir_turkey_alternative_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral14
Sample
service_remove.cmd
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
turkey_dnsredir.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral16
Sample
turkey_dnsredir_alternative2_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral17
Sample
turkey_dnsredir_alternative3_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral18
Sample
turkey_dnsredir_alternative4_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral19
Sample
turkey_dnsredir_alternative5_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral20
Sample
turkey_dnsredir_alternative6_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral21
Sample
turkey_dnsredir_alternative_superonline.cmd
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral22
Sample
x86/WinDivert.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral23
Sample
x86/WinDivert32.sys
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
x86/WinDivert64.sys
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
x86/goodbyedpi.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral26
Sample
x86_64/WinDivert.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
x86_64/WinDivert64.sys
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
x86_64/goodbyedpi.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
General
- Target goodbyedpi-0.2.3rc3-turkey.zip
- Size 301KB
- Sample260605-e7y25aaz6w
- SHA256 b1f93b2e9434d93c5321275c4a3d0a87f3b822c552eceabdbeb1610c879e1863
- MD5 78cb0650461d2194cecde1d92b8d15dd
- SHA1 374bc8d83ae35cdd7db02265648e5379ecb7ac20
- SHA512 6094a16569279f9e94dad62e4aa54a9a5348a20247a75c092c139b563d69832fa86d7dc30bf871a6e997f0c2928ccb20b3cd40b463767d8990c4935020fac189
- SSDEEP 6144:AtScsXc4aVSZGIFH0Yev0fUIo4rhAN6v0Wh6ZguYbytxHKMKkcIo4rhs:PXEVaGIBO0v9rhAHWh6Zg1I+29rhs
- TLSH T13E6423FBF9E80D7FED1D9ABAB126484F93D034804030F55B6A5C700615A77CC8B56AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/x86/WinDivert.dll unpack001/x86/goodbyedpi.exe unpack001/x86_64/WinDivert.dll unpack001/x86_64/goodbyedpi.exe
File Explorer
-
goodbyedpi-0.2.3rc3-turkey.zip.zip 301KB
-
README-BENİ OKU.txt11KB
-
licenses/LICENSE-getline.txt1KB
-
licenses/LICENSE-goodbyedpi.txt11KB
-
licenses/LICENSE-uthash.txt1KB
-
licenses/LICENSE-windivert.txt39KB
-
service_install_dnsredir_turkey.cmd804B
-
service_install_dnsredir_turkey_alternative2_superonline.cmd801B
-
service_install_dnsredir_turkey_alternative3_superonline.cmd749B
-
service_install_dnsredir_turkey_alternative4_superonline.cmd740B
-
service_install_dnsredir_turkey_alternative5_superonline.cmd740B
-
service_install_dnsredir_turkey_alternative6_superonline.cmd653B
-
service_install_dnsredir_turkey_alternative_superonline.cmd808B
-
service_remove.cmd355B
-
turkey_dnsredir.cmd303B
-
turkey_dnsredir_alternative2_superonline.cmd204B
-
turkey_dnsredir_alternative3_superonline.cmd300B
-
turkey_dnsredir_alternative4_superonline.cmd302B
-
turkey_dnsredir_alternative5_superonline.cmd302B
-
turkey_dnsredir_alternative6_superonline.cmd215B
-
turkey_dnsredir_alternative_superonline.cmd213B
-
x86/WinDivert.dll.dll 42KB
-
x86/WinDivert32.sys.sys 75KB
-
x86/WinDivert64.sys.sys 89KB
-
x86/goodbyedpi.exe.exe 98KB
-
x86_64/WinDivert.dll.dll 46KB
-
x86_64/WinDivert64.sys.sys 89KB
-
x86_64/goodbyedpi.exe.exe 99KB
README-BENİ OKU.txt
- SHA256 305c1a9f5be2a5107c8153d6fd0bf4c361b476b54bbc54078e4f0e4823851088
- MD5 34b87edc8b4c59cafe5eec2750a57988
- SHA1 6441b0f60da656eb177375dc0573c54a37b1542a
- SHA512 e2c05e06f8af6eb0d5e5f599411298a7ce0c5f137295234bd42fcfe646310e1f3215545e47d71f2c4903f0a7d4a35de7c025449ce00315dcbd4ee6ee993c7ef7
- SSDEEP 192:yaCBPAsLhGrigeK1Y5KJPJ32w7AbYs9TcpOOZitKvgwc:e4MGykJPpPcbYsB9Ev6
- TLSH T1CB32944469ED783C9EBA13CFE16B069EF5DF42E3A321E80B66699734B30437A02D511D
- MD5 SHA1 SHA512 SSDEEP TLSH
licenses/LICENSE-getline.txt
- SHA256 ec5f8e03fccb3842cc62ad79ea5f6f6058988e2721a3e6566e8fb72786d485c4
- MD5 3a7edebc3612bcea2306f73b92342a44
- SHA1 9b177bac083f79d4334373a8144899b60155ecc6
- SHA512 17e987e112d02b1afd430db553ba0826c4b2ae7cfeba9adc3b9d8cebc93bbb6f02024a6ef95adf623eab5331af718fd10bafbf20b2dc5e906c0d2381ca11ba8d
- TLSH T1BA31504B268417A25AF3575676A6DD84F04D902D3B136D0D387AA2446F3B02EE4B7C05
- MD5 SHA1 SHA512 TLSH
licenses/LICENSE-goodbyedpi.txt
- SHA256 e03ba41d7fab20700769fe4118bab50d800cb74f990353a05d2f5fff1c228363
- MD5 c4082b6c254c9fb71136710391d9728b
- SHA1 ff426822972c8972e3e4e782baac6f5304fd458c
- SHA512 4c71355f37002b14cf072328fe42569405cac2dc13b8c6ae871a1a5e958411417b7d4238a49c60c9bf5d956c5488b8ec9f4af99a6a6f8e5d8508443e4ceed2fa
- SSDEEP 192:ff9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8mjHfH2:9Ou9b01DY/rGBt+dc+aclkT8SH+
- TLSH T15B32722BBA4903771AF20122AB4764CEF31EA03F37591525315CC1682F7B96583FB69E
- MD5 SHA1 SHA512 SSDEEP TLSH
licenses/LICENSE-uthash.txt
- SHA256 d3c6556e48104c31e3e0c62238c749c2a09ca79ee87da50b9cd29c6c9027d57d
- MD5 5cc1f1e4c71f19f580458586756c02b4
- SHA1 08473f885bd0231790223311cc3a712faf8abded
- SHA512 d038952606c33cac0870b7018e8a33fc0e4d120363b392d9f5af36fd4e2519d95f51da1f87c30787db02d71208e40f806e8e0f6c9766791086150f98b3b8a489
- TLSH T19821338B12404FEB5991579126A66A44D0CEA03E3A236D04187BF3496B3712EE8BA411
- MD5 SHA1 SHA512 TLSH
licenses/LICENSE-windivert.txt
- SHA256 e5453b2e71e4c4dcdb89a2539655add3a63202521cf3012b768e8bfeda199312
- MD5 b864fbb188a7c3a11cef80f3ee902d77
- SHA1 7a3f0538f8fd2ee1c30fc1952cbf83b13b360b3f
- SHA512 eb03bb26490535d98e270c89d70dfc9d1a0e2a22ad2bc09ed316e522fb52177b24bb6a2c023c9b010837b6b9a28dfe6492dc0b77f45883385a7e66dd00463c32
- SSDEEP 768:Qs57D0LVw7Y+tNdSz3ZlqXOWoInuzx3Y8N3Wib:QspD8VwVtNIq1uzZY1I
- TLSH T1E703735BA74513B202E202516E4FA4CEE32E907A376A4464786DC15C27B7D3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
service_install_dnsredir_turkey.cmd
- SHA256 2b0d9f7d76a198b83f4f344dc0d9ffcdb09a7616af6b9ce41dfd74e417ce8ded
- MD5 ce60ef0ddef529d2685513afe1a90c95
- SHA1 66a1ca5771ba7f5bde41bf20046f2063625cb2bc
- SHA512 591eb0bcfda46849339bd27b55998ac0374d88c43be0987a738a5436b0e9e3ad2640f33d9d125d4db0f168f734cb432ae8f96c6197113ad641b97a29e9435402
- TLSH T12501AF7A739551749BCBC2C2FD3E5A8375498127251196DE5D216F2409106FF90C1126
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative2_superonline.cmd
- SHA256 9cb59b3139481f0981f08d55c56add61eb6c3a692db2894df7f19c1a403783d8
- MD5 cf87621900707b268783534851c5083e
- SHA1 81461ec7595e708532c7f474e1a04bc866ae0cd4
- SHA512 f746546c04a43e1c746a961b0325c57e7582aef7c38279764ccdfde3d506eaebb087ecd6351e7d30fe3ce3e88ad8b1da2da20a332fb6d49dd4211ea536270af2
- TLSH T1AF01ABAA73825064CAC7C2C6F93EAF47B1998127352096EA5D52AF680D212FF90C053A
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative3_superonline.cmd
- SHA256 011830db2f2300de222d512221bdd58b3993bd7f69545a0eee170a45aeadf799
- MD5 23f3829f31416931920148a01c12359c
- SHA1 7a800b7a2a729831026ef6863599b539c9f9b7dc
- SHA512 68eeddfd853a5217e56a97868ea3fe7afbf43951cf260aec931c9a75e8f20999986d1aff483b0d44cf39b59a4825c50374a478840215f2a6bdfe6cc5132077ac
- TLSH T1F701BDBA7386527497CBC2C3BD3E5A43758AC217296192EA5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative4_superonline.cmd
- SHA256 2c83fd943b335db8abc98feec22b990fc2bdc579dab7032c0a8fef5b2b80ec86
- MD5 8f06657ef041527bbeb40730469bd4d3
- SHA1 b41a824a5bb0bd4cbcb9b00110e9984ec8c14833
- SHA512 4c2b2eefea45c2e8842726b4f7fdfdb06e3ca5b582ec7909260a027decf7bc3dbc21bd03f222db45ae60bdfd934b9ae0a99c90a170fdea75170b4ca118250b6a
- TLSH T13A01D0BA7386517497CBC2C3FD3E5E43B58AC217292192EE5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative5_superonline.cmd
- SHA256 f99701eeb815fe7fad228f68760cfc2de1e019592f97b63246e46d9d79a806a1
- MD5 b0df6fbdacf2ac453a2c54661af68b44
- SHA1 9146cc0abfa029b9ff63f881c1ad1b71210dace7
- SHA512 bd5d5720dcc2f86ff52a45d6510b65a65a49e2f7b80cb8720d6963a89dcc3590a55f08d774e390a3178343dd8c95595eace4f92b0a62d41526e84678971017de
- TLSH T13A01D0BA7386517497CBC1C3FD3E5E43B58AC217292192EE5D517F6508202FF80D0436
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative6_superonline.cmd
- SHA256 4285bb298018613fc5c2c6b8bc8533f2af0ed5986f85aa214ade5dba1c33ef9e
- MD5 8e86b2f818ae16f6fa407183ba9e0870
- SHA1 f238bd41eccb7dd2219dbd5d9d5673b86ba64524
- SHA512 8996e46f7af382c91475b27e7f51856d1ee2237d40d313f113ee2913cd32092f315fb9a240ffce942c3dc5bcfb3a46ac5cd0fdeeb29b7e891da2f2166ff3fcd0
- TLSH T175F09EAEB38251748BC7C2C2F93E9F53B189C257392086ED5D416F5908212FF90D0536
- MD5 SHA1 SHA512 TLSH
service_install_dnsredir_turkey_alternative_superonline.cmd
- SHA256 b87532f816fc4c4fe49e0f1049e1fab46ed733434e490c65c9df75f5d98c5225
- MD5 a0429262eb7859768b86b540a6d4007b
- SHA1 d104810dafc586f6cd0b2fd6b1fc3336c9e1dc6e
- SHA512 6d46320f1d5682b649f6498462177ff2702d75777b7084e630c4c24d06a2a365253580b8f28b386196de91504ae8bbd0bf8b05d45145287aebc31ee2f45d2a5b
- TLSH T16001AFAA73825064CAC7C3C6F93E5F5775998127352096DA9D526F640D212FF90C0539
- MD5 SHA1 SHA512 TLSH
service_remove.cmd
- SHA256 78d7910d79862da0b6707d90b0d494c3b3bf34ae733072c89b3da79bb4cc8852
- MD5 527f95833c7bb8fefb5e07f1cb365009
- SHA1 bc8af7d526a40b7837f4b37482dc76093411a394
- SHA512 23166a1ff60037fbb4014f9f9a5f8a3f67183b60c1bcd2423614ca366d7101e9f36fed27021966a88e8f051cdae1bbf76b48bb023a14bb9db9d9852538bddb07
- TLSH T130E0D8EBB7835E910EC7C3CBFC6B5D637A5942869040A2CA0D11BF56C4111BAA414423
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir.cmd
- SHA256 b1961df58e25db76e6d2c22b582a97a1cb135800a4878466e8d1fa6f10c63e22
- MD5 775a903331912fd9867a99b994e1b859
- SHA1 54c9e428e4a178b9ab1c720387703c204ff18245
- SHA512 c92a86261a6b6879061995b6e8b00ffb20307af9d7f6dac7434d4a159b388a1aad48ae984ecd80aa7a1b7ae5516dc80967822c6c43bdb8192c9cd30e14b22035
- TLSH T1E8E07D3E03CC517CF78ED10120282002F4D5D0176E31A6E6A4B8B5301B263DFC4C1159
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative2_superonline.cmd
- SHA256 8f432fb6710d0d2d36d89ab4125157766722928afe2e70077cd921f27579ad5a
- MD5 2e479250a2d20c6d2d5fc5171528694b
- SHA1 e72055aaabf6ae076d45bc6ade3a9aa8c8da33c3
- SHA512 7550871629ce9f72a72fb9e2b17093505c036737cfd0e21722ae9eaad4c8ed99916937c3e73637af63a1d24e392863fe79c6606dc29afc31129fcd6bfb71d67e
- TLSH T1F7D0A71D028C50BDE946D01000082002D4E8D0567D308AB46995E924175368E48C131A
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative3_superonline.cmd
- SHA256 ebef2bf55c4bb7f1327bc62abdc1d90be993efe8e20078550ab63e27efc6b397
- MD5 e712f506d9c8c5e3d40f7bf540ffebcb
- SHA1 cf2eeb7ecfbb59efb8f8fdf5738623d9b8af50da
- SHA512 3d0ccde0b865bade9d75de7b46a968838ebfe03503e73d0ed630b09ee6ae935587b0a0ad1bc6c54b6e7ffc8e065f9b1141ed31e256120f9dc67711025b7b84fe
- TLSH T119E07D3E03CC61BCF78ED01120282002B4D4D0176E31A6E2A478B5302B263DF84C1159
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative4_superonline.cmd
- SHA256 9d6c768971be9db529ec35a55b599b8bc8ccce9f2778c8f521796fa6b0a318d7
- MD5 c67418e03096b645a2f28b5b44fd7ee5
- SHA1 5f40c0e9d24d7d37da6bd84114422bfb278d42b2
- SHA512 bea723feadfd8ca4a1535caa0df2ffba76133fd1a984911afa9135cc8323f8f4c16fbe31077c68c54df659120d1b752da55803a6d7c895761d8861035dbbeb85
- TLSH T16AE0CD3E124D513DB75ED4422098241AF4D9C053AE2549D7A138B57017756DFC5C21AE
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative5_superonline.cmd
- SHA256 e962b1f65370f666f8d26dac23b97d6e603fbaf049b5789d834a22e50eeca96e
- MD5 42c1b40ec2532c1da85c95532b8f6418
- SHA1 0177dfad6da6965c5b208ace73ae8a31a076382e
- SHA512 3372943e609aea7aa4dce5151ba1b2e79273b18119d13e73c11af363d14c1c52d346785087ec6fdc72afcbaffabf95170e8699b1d395233b9e70ad6959de6640
- TLSH T113E0CD3E124D513DB75ED4422098241AF4D9C053AE2649E76139B97017756DFC5C21AE
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative6_superonline.cmd
- SHA256 d763d761a89c1c7875bafda159e1e1b6f66854f658057922186a87fef778a1af
- MD5 ebcd9f9d4b9d90cebbe16a6b15bafb2c
- SHA1 7cc120e6d01503358195b9794891fbaacf71a89f
- SHA512 10582f29222d8e704dc41c3ed65ccec8bf9f6334ef5a8ed7e75479d53ccb5df95f75ff818ee3faa0ff844e181d69b21d5bf5b1060af56a6f4266bafecb5b28c3
- TLSH T11AD0A71D164D507EAD0294410008305BE4ECC097FD358DA57125D9640662ACA988229F
- MD5 SHA1 SHA512 TLSH
turkey_dnsredir_alternative_superonline.cmd
- SHA256 cac6119fb96c9870e1d6c36f13956a1d63a1abbf1569aa2e7cae269ce18f2106
- MD5 0180ec1cb44c76a9a026e04f681ef354
- SHA1 8d7d1cf4bf6a84e979bbba7ccdbd7ccf29506895
- SHA512 7e6d18f762da8ed30d48f71ecf7a8551a191f22c71a394c2b9738b10f14b4a6c0e7525bca6ccbee54deff4e916c3e69d69d3fbed438f47ef0b0cd6272b998afc
- TLSH T1B0D0A71E03CC60FDE946D11000183406E4E8E05A7D309AB4B9A5D92417536CE48C121A
- MD5 SHA1 SHA512 TLSH
x86/WinDivert.dll
- IMPHASH a8e7995c1f834b606568ac0eb04eba9c
- SHA256 625ffdd95bfabff32d0e8a95beabcd303c01c8bba73b90402d4e84d6e15dd8e5
- MD5 1cb0efd60883b5637b31bf46c34ae199
- SHA1 b91de8d5f072f8c6aabd029d96568effdd5662d9
- SHA512 68c7c257b8cd28011f4b9af09b1e4c7b3d69c6f1457ca6f68fe114fcb382e470b87b9c12ca5d6d4aedd27a103a35fac9093c08b288867cceb9621a60ac70a6f7
- SSDEEP 768:/BD4bCa+EfZ9+EwleNwYLWKkR9c5s1R2wdRt7JtXwxwprTKkimOyd:/BD4bCofZ8VYwYyKkR9c542wdRQ0TKkV
- TLSH T14D133B8AE793C0B2C87E8AF0225FF7E619281570F945C6CBD7D41D6C7C569B30839A86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28843
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetCurrentProcess
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
IsWow64Process
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
x86/WinDivert32.sys
- IMPHASH 1238f7a80c6673337c15a82af3ef4030
- SHA256 29ca5ceb59c9c6993a349e82b1fd46078e6f8a302764153ab84fa22e382fcdca
- MD5 cd477ee96ff05cacda8ac3c0e9316d7a
- SHA1 68da0c17728aa672f140477b3822aefb5810c8b5
- SHA512 27e13504eb291a5324d824360532ca6d19c409022c72f5609ca55f92558388e3f25f1e8d657afd3d1e4f9ea9c082483c954d6f4e89df049e4f732383a04adcad
- SSDEEP 1536:tVYIJtdRHzb+uzucD5GYLKYaU6s8BLcHWXizv65Q4:tmidRHzMcDQY/aC8B8gevL4
- TLSH T1C273295A72E91105FDD259B02AB9B2426C35BBA24732C6DF1AC06C1F14F1FE2A970337
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
29:82:91:be:7d:59:14:db:31:b4:b7:3b:29:c0:3b:9b:92:e8:3c:ca:df:4c:47:93:0a:5b:0c:e5:1d:b4:88:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 24, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
29:82:91:be:7d:59:14:db:31:b4:b7:3b:29:c0:3b:9b:92:e8:3c:ca:df:4c:47:93:0a:5b:0c:e5:1d:b4:88:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2019
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2017 - Oct 12, 2020
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:02:91:63:5c:c5:b4:59:b9:3c:00:00:00:00:01:02
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
4381
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\WinDivert\install\MSVC\i386\WinDivert32.pdb
ntoskrnl.exe
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
ObfReferenceObject
ObfDereferenceObject
RtlCopyUnicodeString
ExUuidCreate
PsGetProcessId
IoGetRequestorProcess
_alldiv
KeBugCheckEx
memset
memcpy
_allmul
MmBuildMdlForNonPagedPool
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeReleaseInStackQueuedSpinLock
KeQueryPerformanceCounter
KeAcquireInStackQueuedSpinLock
ndis.sys
NdisAllocateNetBufferPool
NdisGetDataBuffer
NdisFreeNetBufferPool
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisAdvanceNetBufferDataStart
fwpkclnt.sys
FwpsInjectionHandleDestroy0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsFreeNetBufferList0
FwpsAllocateNetBufferAndNetBufferList0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=59, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
x86/WinDivert64.sys
- IMPHASH 505c54af7fa8f0482014ca4fe5cdd53d
- SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
- MD5 6a33620de63bccaf5e5314ee49cd58fb
- SHA1 ac728b339681b2e27099fecc1419821f01d04b34
- SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
- SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
- TLSH T1D9934C46A2E201C5F9F6C97895B59213EF31FA81AB22D7DF11D0981E4F61BE0BD78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 24, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2019
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2017 - Oct 12, 2020
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\WinDivert\install\MSVC\amd64\WinDivert64.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
RtlCopyUnicodeString
ObfReferenceObject
ObfDereferenceObject
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeQueryPerformanceCounter
ndis.sys
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
fwpkclnt.sys
FwpsAllocateNetBufferAndNetBufferList0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=259, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
x86/goodbyedpi.exe
- IMPHASH 158df5f94865a639f7650d946c2d6fe8
- SHA256 66e202c9fce9e769e2bc791b7fd6f56f21eab59f607f4ed0724e0c68c430dd1f
- MD5 9c3f16d5a0aff180f9d04ae6c0fe1f28
- SHA1 c0febd0e54c2a335ee348233e9555eef4816663e
- SHA512 746ccd373f025d95ca4f55cb212ba6b259a6f17d7e2c5807940cc0d1d31ea61c943a6aa4fc91b2ec432ed1d04ffee4b4c3b78db2cdbb474399313bf26f56a4ac
- SSDEEP 3072:wjnafjFO9vbnTrjP7HzfLXDvnTr3jP7HzfLXDvbnT/rjI3XLS84mUgIDJO:46RO9vbnTrjP7HzfLXDvnTr3jP7HzfL2
- TLSH T12FA36C4AFB8794F1E91750F025A6FBBB4630B2328C61DE72FB8C9943AF22E551352345
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
windivert
WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend
WinDivertShutdown
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetEnvironmentVariableW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
SetDllDirectoryA
SetSearchPathMode
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__p___argv
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_exit
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fclose
feof
fgetc
fopen
fprintf
fputc
free
fwrite
localeconv
malloc
memcmp
memcpy
memmove
difftime
puts
realloc
setlocale
signal
strchr
strcpy
strcspn
strerror
strlen
strncmp
strstr
strtok
strtoul
toupper
vfprintf
time
wcslen
_write
_strdup
_open
_close
ws2_32
htonl
htons
inet_pton
ntohl
ntohs
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
55B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
x86_64/WinDivert.dll
- IMPHASH 0b649f8e17494bb31b47f6e959a1769c
- SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
- MD5 88e1c19b978436258f7c938013408a8a
- SHA1 09b77c8c85757e11667a7b83231598dd67fe0b8b
- SHA512 eaa0d8369b76fd9a4978f14702716ae31d801cd0dc36a86531f9320b4ddb683265c4f0e07af2b9d2e85f513270d98d1b11ae7d501d08287442bc505176d16e14
- SSDEEP 768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic
- TLSH T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31106
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
x86_64/WinDivert64.sys
- IMPHASH 505c54af7fa8f0482014ca4fe5cdd53d
- SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
- MD5 6a33620de63bccaf5e5314ee49cd58fb
- SHA1 ac728b339681b2e27099fecc1419821f01d04b34
- SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
- SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
- TLSH T1D9934C46A2E201C5F9F6C97895B59213EF31FA81AB22D7DF11D0981E4F61BE0BD78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 24, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2019
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2017 - Oct 12, 2020
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\WinDivert\install\MSVC\amd64\WinDivert64.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
RtlCopyUnicodeString
ObfReferenceObject
ObfDereferenceObject
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeQueryPerformanceCounter
ndis.sys
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
fwpkclnt.sys
FwpsAllocateNetBufferAndNetBufferList0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=259, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
x86_64/goodbyedpi.exe
- IMPHASH f42f9d878af312b044b65df0b4daca10
- SHA256 8d412b094bb9c137ff25ba9a794d1122ecc84bb776debff6c249723a13cc31cd
- MD5 afa7f66231b9cec7237e738b622c0181
- SHA1 478f336ab054623abfa691f11f12bc3be31deabe
- SHA512 a3833d6018c6ddb63c5bc5b1a2efe2f9e517e80d28d6c59661ff625d42397e484e902ae5f211fc1586a25901c1f0d1700364f604c51a536fcc467703ce76e9d8
- SSDEEP 1536:KuiGy47O/sFTEx/H6+FI87tZQkMvKghPf651Lz5e0yNgnIcm:KTGy47O/sFTExysf7PQ9KghP43VUgID
- TLSH T108A32C1AF353A4F8C51A827046AB2732AB71BC265130EF7E73ACE6701F51E605F1E664
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
windivert
WinDivertClose
WinDivertHelperCalcChecksums
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSend
WinDivertShutdown
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetEnvironmentVariableW
GetLastError
GetModuleHandleW
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
SetDllDirectoryA
SetSearchPathMode
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_difftime64
_errno
_exit
_fmode
_initterm
_lock
_onexit
_time64
_unlock
abort
atoi
calloc
exit
fclose
feof
fgetc
fopen
fprintf
fputc
free
fwrite
localeconv
malloc
memcmp
memcpy
memmove
puts
realloc
signal
strchr
strcpy
strcspn
strerror
strlen
strncmp
strstr
strtok
strtoul
toupper
vfprintf
wcslen
_write
_strdup
_open
_close
ws2_32
htonl
htons
inet_pton
ntohl
ntohs
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
55B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ