Driver intelligenceVulnerableVerified

KmWpsMs.sys

KmWpsMs.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / a6340f12-b0ee-41c5-acf0-92be886d1296ADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

KmWpsMs.sysSample 1 · HVCI FALSE

MD5: 0c488b536a5df62166894d1e89b39c9a
SHA1: 1e711120242c556c4521e7859cd543ebc71c1c9d
SHA256: b045c00f3b921da2e9a5c7977e51c8beceff4a89ec9c4e365f3e4d41f8129e98
Imphash: 23f361e3c0f41a57dc3b5555e6b0ebc9
Authentihash MD5: b8fdb11c0d176457c5096d2a7f9ca744
Authentihash SHA1: 00d640774fb95e636b86abf23211ee12bf53e8bf
Authentihash SHA256: 8a7f6dbb674b86bc7c26642da1262fa54d4f5698b63cf01412aa917550aa8fa9
Machine: AMD64
Version: 12.1.0.0
Publisher: NComputing Co., Ltd

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create KmWpsMs binPath=C:\windows\temp\KmWpsMs.sys type=kernel && sc.exe start KmWpsMs

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint