← Back to driver explorer
Driver intelligenceMaliciousVerified
windivert.sys
WinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.
Known samples 3
3 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
windivert.sysSample 1 · HVCI TRUE
- MD5
89ed5be7ea83c01d0de33d3519944aa5- SHA1
4c9b9c74529399abacc2284de1dead5f2332ee9b- SHA256
8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2- Imphash
5bfe3723089cbcfcc271ba6d7ab617aa- Authentihash MD5
75982fa2a79981d94b5f765af01bf6f8- Authentihash SHA1
f6062c27168815446f20ca398c24325eb72d87d6- Authentihash SHA256
5aded75d6beb315849f698a78f8033de26eb151955a1cbc01e3037320e2a0eb6- Machine
- AMD64
- Version
- 2.2
- Publisher
- Basil
windivert.sysSample 2 · HVCI TRUE
- MD5
451ec31152318d1249f41aed387dd262- SHA1
d821fa0c9186a5f863528dc6a3e87b3ff40a1ac5- SHA256
2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807- Imphash
bb607f74958acb5ad3d1bbcb8a7407e3- Authentihash MD5
f1ec6b6ce86371c69fb627c10e93a71d- Authentihash SHA1
13863e4ed2485959237c156ecce5d54c62878c2a- Authentihash SHA256
d35bc51acafab893698e6064d286541918a789ac7c06a6442bf4351dde842777- Machine
- I386
- Version
- 2.2
- Publisher
- Basil
windivert.sysSample 3 · HVCI TRUE
- MD5
eb187d171359a5bb1c754107f18cf8bb- SHA1
96e6fce6833ea0f2c81bfe0363393aa3302d6916- SHA256
8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d- Imphash
5bfe3723089cbcfcc271ba6d7ab617aa- Authentihash MD5
98e59da805f38429d3a3ad15e0aa66ef- Authentihash SHA1
732fc0d9c44c96589a9ad8489c6c78e10deec99a- Authentihash SHA256
49373ea79d942e82873583a6515950acc04c578e75720593383ffb7ba4a28f3b- Machine
- AMD64
- Version
- 2.2
- Publisher
- Basil
Recorded command
sc.exe create windivert.sys binPath=C:\windows\temp\windivert.sys type=kernel && sc.exe start windivert.sysElevate privileges · Privileges: kernel · OS: Windows 10