← Back to driver explorer
Driver intelligenceVulnerableVerified
KRegExp.sys
KRegExp.sys is Pavel Yosifovich's Kernel Registry Explorer driver and is listed as a KDU-compatible provider. KDU uses provider drivers to perform privileged kernel operations including kernel memory access and process-object manipulation.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
KRegExp.sysSample 1 · HVCI unknown
- MD5
a5406327e13ad633b00bc62353e7dedc- SHA1
f3383fe0ff00bdea1aa9e68bcaad8b83885e306d- SHA256
5c237dcec01f5e31a78cf8c883e41d85c74675b1426379302b46b771d091dce6- Imphash
0b9365a82a9033a116c4ea996fdc6315- Authentihash MD5
c8b9281ccc87adb65ca3e4ebf56d3bbf- Authentihash SHA1
d889e03ce654903a5113f49f49a1c23f3317e7d0- Authentihash SHA256
a057a2e353d94358ceba83114d8f94adf77c7c25ab9ca47029c80a6bf2d6d35f- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create KRegExp binPath=C:\windows\temp\KRegExp.sys type=kernel && sc.exe start KRegExpAccess kernel primitives through a KDU-supported provider driver. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KDU Project / SharpKernel @hfiref0x / @hsheric0210