Driver intelligenceVulnerableVerified

NPR0.sys

NPR0.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.

UUID / cf9ed92d-d39b-4562-a256-b36f6560ccfaADDED / 2026-04-17AUTHOR / Michael Haag

Known samples 1

1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

NPR0.sysSample 1 · HVCI TRUE

MD5: 85e702c8d8de0d489f7cf61691f2ce42
SHA1: a79573bd65237874046f3eb8f4cdba66aaf8cd65
SHA256: 3e73d22b534a4c5996121750e3fc0f6913d5ad4c6dbc630b590647201656d714
Imphash: b62e9f4f8363c29992802646a5b4fa4b
Authentihash MD5: 0a9066116e4fdba1ed04ccdec1bc7e5f
Authentihash SHA1: 7632ceaa5c73f9da33fae1c9c78a9aee7b69d872
Authentihash SHA256: e69e909233b99ba2765ea1124eb0d5054641db17ee8f15135b18767f77d943aa
Machine: AMD64
Version: 1.0.0.23
Publisher: noping.com

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create NPR0 binPath=C:\windows\temp\NPR0.sys type=kernel && sc.exe start NPR0

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references

Acknowledgement: @rainbowdynamix, @DbgPrint