96ba5e53-6a40-4813-b6f1-ccce31a883cf

xhunter1.sys :inline

Description

Wellbia xhunter1.sys is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-3609 through version 2023.12.7.78. Public research demonstrates that its unauthenticated command channel can expose protected-process handles, read cross-process memory, terminate security processes, elevate privileges, and inject code from kernel context.

  • UUID: 96ba5e53-6a40-4813-b6f1-ccce31a883cf
  • Created: 2026-06-16
  • Author: Michael Haag
  • Acknowledgement: BlackSnufkin | @BlackSnufkin42

Download

This download link contains the vulnerable driver!

Block xhunter1.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create xhunter1 binPath= C:\windows\temp\xhunter1.sys type= kernel && sc.exe start xhunter1
Use CasePrivilegesOperating System
Terminate protected processes by abusing vulnerable xhunter1 kernel command paths.kernelWindows 10, Windows 11

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/BlackSnufkin/BYOVD/tree/main/Xhunter1-Killer
  • https://web.archive.org/web/20180820182619/https://x86.re/blog/xigncode3-xhunter1.sys-lpe/
  • https://blacksnufkin.github.io/posts/Hunting-the-Hunter/
  • https://github.com/BlackSnufkin/AxHunter
  • https://www.cve.org/CVERecord?id=CVE-2026-3609

    • CVE

  • C
  • V
  • E
  • -
  • 2
  • 0
  • 2
  • 6
  • -
  • 3
  • 6
  • 0
  • 9

    • Known Vulnerable Samples

    PropertyValue
    Filenamexhunter1.sys
    Creation Timestamp2018-04-16 02:45:02
    MD5c61c16de83acabd35ee18e410c1c37c1
    SHA1852049ecfd6a42370f2d6ed0d5e67e52c8d88211
    SHA256e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e
    Authentihash MD5fab640bd776f3d1098bbc4fb366f1515
    Authentihash SHA15aca2a43c5a9f1fc59bff578e739a8ab8edecc6f
    Authentihash SHA25685a3cacfb0eb01fc5784695ccf6bd92a537637ecad747eb162331e78da68eee4
    RichPEHeaderHash MD51d925fc376773fb63431ac44c280f7b3
    RichPEHeaderHash SHA1040040149603ea0f6dc317b7c1ebc274309b7ba2
    RichPEHeaderHash SHA2566ee450f7bfef5e77fd8c04fc7d82568e83aa57251b7aa6e370e1ec0320440c17
    CompanyWellbia.com Co., Ltd.
    DescriptionXIGNCODE3 System Guard
    ProductXIGNCODE3
    OriginalFilenamexhunter1.sys

    Download

    Certificates

    Expand
    Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
    FieldValue
    ToBeSigned (TBS) MD5d0785ad36e427c92b19f6826ab1e8020
    ToBeSigned (TBS) SHA1365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
    ToBeSigned (TBS) SHA256c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
    ValidFrom2012-12-21 00:00:00
    ValidTo2020-12-30 23:59:59
    Signature03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber7e93ebfb7cc64e59ea4b9a77d406fc3b
    Version3
    Certificate 0ecff438c8febf356e04d86a981b1a50
    FieldValue
    ToBeSigned (TBS) MD5e9d38360b914c8863f6cba3ee58764d3
    ToBeSigned (TBS) SHA14cba8eae47b6bf76f20b3504b98b8f062694a89b
    ToBeSigned (TBS) SHA25688901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
    ValidFrom2012-10-18 00:00:00
    ValidTo2020-12-29 23:59:59
    Signature783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ecff438c8febf356e04d86a981b1a50
    Version3
    Certificate 1734520c9aabc257a502ec5dbf615354
    FieldValue
    ToBeSigned (TBS) MD56dee25e9833b43f283c47c8aa7198c70
    ToBeSigned (TBS) SHA1fc914def7c965d213634d1e95942ac95f9cf47b1
    ToBeSigned (TBS) SHA25612db45f8d63173d8d41489c6e9f94ea13f922033be01aabde4d5fe002aac4bad
    SubjectC=KR, ST=Seoul, L=Guro,Gu, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.
    ValidFrom2018-04-12 00:00:00
    ValidTo2020-05-11 23:59:59
    Signature76af0beb63fe640e30dbbd76c311c39a33d26fc66ee11668de31654b6473ddd400d9a64c9c3971443d543336098d5613c7b8213f7194538554120b8857d1d8b1f222a43414d023f47d1ad6df6491f0c21d49c968bfcc9bbe06b67948c53859310ab9653bcd2d68d59e675ac3bb5c98f45bf23ff15e3f85edc7b4f200624ec5799c3496fe60cb35d93355dfb00834e680edf57e0f4a69932319a38add95d46c290c7d52af6c2ea27c6a952815f4275fbda581643dfacbb24002feb8b64c175d9c5f41efc9702fcfe6c9d43cb57e0c8abdbf16a63655eaf56456456e4671077f5ac207b0d71acdbc5e59978a430ec2e929def31d27cfe121b739473786412ce822
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber1734520c9aabc257a502ec5dbf615354
    Version3
    Certificate 3d78d7f9764960b2617df4f01eca862a
    FieldValue
    ToBeSigned (TBS) MD51f056ff7d5f874984dc605402b7cb042
    ToBeSigned (TBS) SHA1bdb348353a2203deb4b767914fa1bd7248dd728b
    ToBeSigned (TBS) SHA256a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1
    SubjectC=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA
    ValidFrom2013-12-10 00:00:00
    ValidTo2023-12-09 23:59:59
    Signature13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber3d78d7f9764960b2617df4f01eca862a
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • wcsrchr
    • RtlInitUnicodeString
    • ExAllocatePoolWithTag
    • ExFreePoolWithTag
    • ObReferenceObjectByHandle
    • ObfDereferenceObject
    • ZwOpenFile
    • ZwReadFile
    • ZwClose
    • PsGetCurrentProcessId
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ZwWaitForSingleObject
    • ObReferenceObjectByName
    • ZwQueryInformationProcess
    • ObSetHandleAttributes
    • __C_specific_handler
    • IoDriverObjectType
    • MmGetSystemRoutineAddress
    • MmIsAddressValid
    • PsGetProcessId
    • PsProcessType
    • PsThreadType
    • KeEnterGuardedRegion
    • KeLeaveGuardedRegion
    • KeAcquireSpinLockRaiseToDpc
    • KeReleaseSpinLock
    • IoGetCurrentProcess
    • KeSetEvent
    • ExQueryDepthSList
    • ExpInterlockedPopEntrySList
    • ExpInterlockedPushEntrySList
    • ExInitializeNPagedLookasideList
    • ExDeleteNPagedLookasideList
    • IoCreateNotificationEvent
    • _wcsnicmp
    • RtlEqualUnicodeString
    • KeInitializeMutex
    • KeReleaseMutex
    • KeWaitForSingleObject
    • PsSetCreateProcessNotifyRoutine
    • PsLookupProcessByProcessId
    • KeInitializeDpc
    • KeInsertQueueDpc
    • KeSetImportanceDpc
    • KeSetTargetProcessorDpc
    • KeDelayExecutionThread
    • ExAllocatePool
    • ProbeForRead
    • ProbeForWrite
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • MmUnmapLockedPages
    • IoAllocateMdl
    • IoFreeMdl
    • ZwCreateFile
    • ZwQueryInformationFile
    • IoThreadToProcess
    • ObOpenObjectByPointer
    • PsLookupProcessThreadByCid
    • KeNumberProcessors
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ZwUnloadDriver
    • _stricmp
    • ZwQuerySystemInformation
    • KeBugCheckEx
    • PsGetVersion

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • .gfids
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Intermediate",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "1734520c9aabc257a502ec5dbf615354",
      "Signature": "76af0beb63fe640e30dbbd76c311c39a33d26fc66ee11668de31654b6473ddd400d9a64c9c3971443d543336098d5613c7b8213f7194538554120b8857d1d8b1f222a43414d023f47d1ad6df6491f0c21d49c968bfcc9bbe06b67948c53859310ab9653bcd2d68d59e675ac3bb5c98f45bf23ff15e3f85edc7b4f200624ec5799c3496fe60cb35d93355dfb00834e680edf57e0f4a69932319a38add95d46c290c7d52af6c2ea27c6a952815f4275fbda581643dfacbb24002feb8b64c175d9c5f41efc9702fcfe6c9d43cb57e0c8abdbf16a63655eaf56456456e4671077f5ac207b0d71acdbc5e59978a430ec2e929def31d27cfe121b739473786412ce822",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=KR, ST=Seoul, L=Guro,Gu, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.",
      "TBS": {
        "MD5": "6dee25e9833b43f283c47c8aa7198c70",
        "SHA1": "fc914def7c965d213634d1e95942ac95f9cf47b1",
        "SHA256": "12db45f8d63173d8d41489c6e9f94ea13f922033be01aabde4d5fe002aac4bad",
        "SHA384": "851d3c7c0364cd406199d2057ae41fdef12330f023648d22ea76b930b094d26095ba32d516e73c9cb8d0ce31544ddcb5"
      },
      "ValidFrom": "2018-04-12 00:00:00",
      "ValidTo": "2020-05-11 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "3d78d7f9764960b2617df4f01eca862a",
      "Signature": "13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
      "TBS": {
        "MD5": "1f056ff7d5f874984dc605402b7cb042",
        "SHA1": "bdb348353a2203deb4b767914fa1bd7248dd728b",
        "SHA256": "a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1",
        "SHA384": "fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"
      },
      "ValidFrom": "2013-12-10 00:00:00",
      "ValidTo": "2023-12-09 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
      "SerialNumber": "1734520c9aabc257a502ec5dbf615354",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}
    PropertyValue
    Filenamexhunter1.sys
    Creation Timestamp2023-12-06 22:44:37
    MD501d01adc1241c8f0a4caf6764439679c
    SHA1722a040af40397626f701b7e02ef3a6715c8259a
    SHA2560d1fd685dc98d0c193529df3ddde7144d839f56b7b38251fd7039c33c0fcf760
    Authentihash MD51234fcf09d3fd5643e17eaab620a40dc
    Authentihash SHA1bd42b25e6cb86e49c1ae0f6c563545c53b9c1c24
    Authentihash SHA25612d5000637d3894acd900082f22efd5aa2133b679b1cc145444493e25297f1ee
    RichPEHeaderHash MD5
    RichPEHeaderHash SHA1
    RichPEHeaderHash SHA256
    CompanyWellbia.com Co., Ltd.
    DescriptionWellbia.com System Guard
    ProductWellbia.com System Guard
    OriginalFilenamexhunter1.sys

    Download

    Certificates

    Expand
    Certificate 0c067d0f436427b359b7a6babd673873
    FieldValue
    ToBeSigned (TBS) MD549b9bd0cbef7207f21058c8b87469b17
    ToBeSigned (TBS) SHA15df3b2527bcc229063f5bdc434ae5e81f7e4e9d3
    ToBeSigned (TBS) SHA256e8063d72e3e59d980203cc5eb5baef3e0f11f61ad8b02130a3675b9e2f8f487e
    SubjectC=KR, ST=Seoul, L=Geumcheon,gu, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.
    ValidFrom2020-11-26 00:00:00
    ValidTo2024-01-25 23:59:59
    Signature29057a5fec92750f630004359b28348e9001f77f3a2e446e2dc67cdf83efa035737ace5939b0ff088d21445b884fab8808aaa044f2652f4173d28c021e8c53963cdcb6e4b20f30bd7881dc2a0cf72ab658f71c5ce1278b8a0880f4ffa8ff00cf79b0c18bd5275f8e9e50695a799078d13240c87285b92e09494c5a5bdc5208d04c9ad150f7acb3d7f878a8550abd83e17602c16e243273f0b931fe5f5768535d52f60d3781e3a76b3ac37f4a4eccd42b76e386afd0d0fc57c65ad96d8ced88f43dbd39346fad2bed430be6a135f195286c01159d4eb025d53878627c6097aa81372e1efa0ec21a0d797020fb048e50701fe40db741e84cff2234d5991000d4fc
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0c067d0f436427b359b7a6babd673873
    Version3
    Certificate 611cb28a000000000026
    FieldValue
    ToBeSigned (TBS) MD5983a0c315a50542362f2bd6a5d71c8d0
    ToBeSigned (TBS) SHA18047f476001f5cb16a661d2a3fd0c3576168f5e2
    ToBeSigned (TBS) SHA2565f6a519ed2e35cd0fa1cdfc90f4387162c36287bbf9e4d6648251d99542a9e83
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
    ValidFrom2011-04-15 19:41:37
    ValidTo2021-04-15 19:51:37
    Signature5cf5b22d02ceed01b53512d813f7aa4014c7a15ca08a55ed7e55ea6ac457176fd04722423658efc5ac61c5f62c52ce6ae6c80d85dab334420ea40225182672b92a4ea57e4b16f2a0e40c449ce24d9af474f0f927a6699031c244654348c74869d0fc8409f286140ac22996857f11eb8713176ed3ec6bff1d578ab17b1ea5a07ce9a27a68e5fac6b161d67263fa379163835599f81d614f0c6fa3f7bcb1152acc8d85e31417ef7e49443fb022c0f0acbe2fdbe10c86b0f4585c5a10a94bcdf3448a4652083e0a6210e9459504b78b8d4b074f500db7bbe7fb8ca27878c6c53b7663b2cfe521845a66fce04c79834ecfa8ee700586587cc29cd73ca3ad3c7e76625c87d0ed7cd5c55b1421f4be75a275d2e9e15ad020307841624d6b5e6e1b1710244ad8588775d015d762bbfd185665842561977faad49df4f35d6da031c2e19e02ac3e90c3327ee832903416d08b14cf95accee58c54a265b8bfed186a57073ed3e79a4a2f081a041c49871a8ae61b08a365d81c31c50d9cbab368ddf45076160675fec403e7d13edfdc862e10027e661296534e7af3365879b12042d8963f35be3f8ef2999743f5e40ce13c68728c8d49d75a52b573fb7a35943a61b08482c04885c19732d39b725fa0d2348f7ef0467cf28c7294c707b0d7b5b230b81965f09c8327b0a0abd0a2727e050fb3aeddb95b9b42bcc32663456b86f11d4643edc8
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611cb28a000000000026
    Version3
    Certificate 0fa8490615d700a0be2176fdc5ec6dbd
    FieldValue
    ToBeSigned (TBS) MD5a9a31555bbc92b6033975c5428fb3679
    ToBeSigned (TBS) SHA147f4b9898631773231b32844ec0d49990ac4eb1e
    ToBeSigned (TBS) SHA256c826846e4b1d73edb7561ab1b41c949354e237a91e82fe1be5b7e2e1701f52d1
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA,1
    ValidFrom2011-02-11 12:00:00
    ValidTo2026-02-10 12:00:00
    Signature7b721d64ff88c83ac1b7e9e7a9c487bbdb9492d7905933fa2b87dea85b80253f138f9b831b7c43c4e68cdf393ec315ecb0da3b21257b24c1725db84791811346fa9c3f6a5138deb425cbf0abdfc528015479104624d1380f26a161904dbabd28e63ff1c4aa9bf6da35534fc9f23dd36cdc23edaaa04d6709f33a803d3cfb364c90e776a4ddf23abf56352fa24c65e8e0d4dad1c7c8916a2d234f373b199418d4d59c103cd5b11c19ff8fc86b9b9ef8ae9c999678d1cd9c51155b4226725a8d0a4a239240e886de22c2933ad49b68a6df297f06b93c0ebd9fc4869c82474271328609997209794b9d7169f541ff7f397764f1848dbe8b1eb27d68a3a590b10cff
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0fa8490615d700a0be2176fdc5ec6dbd
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • RtlInitUnicodeString
    • MmGetSystemRoutineAddress
    • ZwClose
    • ObOpenObjectByPointer
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • ZwWaitForSingleObject
    • PsGetProcessSectionBaseAddress
    • __C_specific_handler
    • PsProcessType
    • wcsrchr
    • ExAllocatePoolWithTag
    • ExFreePoolWithTag
    • IoGetCurrentProcess
    • ObfDereferenceObject
    • ZwCreateFile
    • ZwOpenFile
    • ZwReadFile
    • MmSecureVirtualMemory
    • PsGetCurrentProcessId
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObReferenceObjectByName
    • ZwQueryInformationProcess
    • ObSetHandleAttributes
    • IoDriverObjectType
    • KeReleaseMutex
    • KeWaitForSingleObject
    • MmIsAddressValid
    • ObReferenceObjectByHandle
    • PsLookupProcessByProcessId
    • PsLookupThreadByThreadId
    • IoThreadToProcess
    • PsThreadType
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • MmUnmapLockedPages
    • IoAllocateMdl
    • IoFreeMdl
    • PsSetLoadImageNotifyRoutine
    • PsRemoveLoadImageNotifyRoutine
    • RtlCompareUnicodeString
    • DbgPrint
    • ZwQueryValueKey
    • RtlPrefixUnicodeString
    • PsGetProcessId
    • KeEnterGuardedRegion
    • KeLeaveGuardedRegion
    • _stricmp
    • MmProtectMdlSystemAddress
    • ZwQuerySystemInformation
    • KeInitializeEvent
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • ZwOpenSection
    • ZwMapViewOfSection
    • ZwUnmapViewOfSection
    • KeSetEvent
    • ExQueryDepthSList
    • ExpInterlockedPopEntrySList
    • ExpInterlockedPushEntrySList
    • ExInitializeNPagedLookasideList
    • ExDeleteNPagedLookasideList
    • IoCreateNotificationEvent
    • _wcsnicmp
    • RtlEqualUnicodeString
    • KeInitializeMutex
    • PsSetCreateProcessNotifyRoutine
    • ProbeForRead
    • ProbeForWrite
    • ObfReferenceObject
    • ZwQueryInformationFile
    • ZwQueryVirtualMemory
    • PsLookupProcessThreadByCid
    • MmSystemRangeStart
    • IofCompleteRequest
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ZwUnloadDriver
    • RtlInitAnsiString
    • RtlAnsiStringToUnicodeString
    • PsGetVersion
    • RtlFreeUnicodeString
    • KeEnterCriticalRegion
    • KeLeaveCriticalRegion
    • RtlImageNtHeader
    • ExAcquireResourceExclusiveLite
    • ExReleaseResourceLite
    • ZwOpenProcess
    • ZwDuplicateObject
    • PsAcquireProcessExitSynchronization
    • PsReleaseProcessExitSynchronization
    • PsGetProcessImageFileName
    • PsIsSystemProcess
    • strcmp
    • PsInitialSystemProcess
    • PsSetCreateProcessNotifyRoutineEx
    • RtlEnumerateGenericTableAvl
    • ExAcquireSpinLockExclusive
    • ExReleaseSpinLockExclusive
    • KeBugCheckEx

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .~<p
    • .reloc
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Intermediate",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "1734520c9aabc257a502ec5dbf615354",
      "Signature": "76af0beb63fe640e30dbbd76c311c39a33d26fc66ee11668de31654b6473ddd400d9a64c9c3971443d543336098d5613c7b8213f7194538554120b8857d1d8b1f222a43414d023f47d1ad6df6491f0c21d49c968bfcc9bbe06b67948c53859310ab9653bcd2d68d59e675ac3bb5c98f45bf23ff15e3f85edc7b4f200624ec5799c3496fe60cb35d93355dfb00834e680edf57e0f4a69932319a38add95d46c290c7d52af6c2ea27c6a952815f4275fbda581643dfacbb24002feb8b64c175d9c5f41efc9702fcfe6c9d43cb57e0c8abdbf16a63655eaf56456456e4671077f5ac207b0d71acdbc5e59978a430ec2e929def31d27cfe121b739473786412ce822",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=KR, ST=Seoul, L=Guro,Gu, O=Wellbia.com Co., Ltd., CN=Wellbia.com Co., Ltd.",
      "TBS": {
        "MD5": "6dee25e9833b43f283c47c8aa7198c70",
        "SHA1": "fc914def7c965d213634d1e95942ac95f9cf47b1",
        "SHA256": "12db45f8d63173d8d41489c6e9f94ea13f922033be01aabde4d5fe002aac4bad",
        "SHA384": "851d3c7c0364cd406199d2057ae41fdef12330f023648d22ea76b930b094d26095ba32d516e73c9cb8d0ce31544ddcb5"
      },
      "ValidFrom": "2018-04-12 00:00:00",
      "ValidTo": "2020-05-11 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "3d78d7f9764960b2617df4f01eca862a",
      "Signature": "13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
      "TBS": {
        "MD5": "1f056ff7d5f874984dc605402b7cb042",
        "SHA1": "bdb348353a2203deb4b767914fa1bd7248dd728b",
        "SHA256": "a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1",
        "SHA384": "fa2729064b49e0d77540c1ee95d5f74acaf8eaf55197851a3a40383335f8113e51190bc48b552196edf8ac5cf0c89278"
      },
      "ValidFrom": "2013-12-10 00:00:00",
      "ValidTo": "2023-12-09 23:59:59",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
      "SerialNumber": "1734520c9aabc257a502ec5dbf615354",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-09-08