Driver intelligenceVulnerableVerified

nxeng.sys

nxeng.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / 6f1d7635-0778-4f17-9c97-b80deca32510ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

nxeng.sysSample 1 · HVCI TRUE

MD5: 8886bdebbc33f3a8830f38065e7f7e40
SHA1: be4fa5c2854d4a33b686d952b97f36f8c29391d8
SHA256: 68d698a978b8ea3bf467bdea2d75ef3099826c3a0d4a1ddb95b078f48f0ae7a1
Imphash: 1859bc8c867407c8a87682eeaa9ec7b2
Authentihash MD5: 0a75050eaf144feb1af5403ee3d25b3f
Authentihash SHA1: b60cc1a57c492faa7d55b2490971c1102caa87fc
Authentihash SHA256: 106ce1afeb0f1177c68f827821dffa6c78942fc896475fafd741501b3091a5c4
Machine: AMD64
Version: 0, 0, 0, 0
Publisher: Beijing Huorong Network Technology Co., Ltd.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create nxeng binPath=C:\windows\temp\nxeng.sys type=kernel && sc.exe start nxeng

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint