npf.sys
WinPcap
Riverbed Technology, Inc.
npf.sys is the library is part of WinPcap a Windows link-layer network access packet capture and filtering engine and is recompiled by Riverbed Technology, Inc.. It runs as a Windows 64-bit kernel mode device driver named “NetGroup Packet Filter Driver”.
Description:
npf.sys (NT5/6 AMD64) Kernel Driver
MD5:
de7fcc77f4a503af4ca6a47d49b3713d
SHA-1:
8206e2d8374f5e7bf626e47d56d2431edc939652
SHA-256:
4bfaa99393f635cd05d91a64de73edb5639412c129e049f0fe34f88517a10fc6
Scanner detections:
0 / 68
Status:
Clean (as of last analysis)
Analysis date:
2/15/2026 7:26:13 PM UTC (today)
File size:
35.7 KB (36,600 bytes)
Product version:
4.1.0.2980
Copyright:
Copyright © 2010-2013 Riverbed Technology, Inc. Copyright © 2005-2010 CACE Technologies. Copyright © 1999-2005 NetGroup, Politecnico di Torino.
Original file name:
npf.sys
File type:
Driver (Win64 SYS)
Language:
Language Neutral
Common path:
C:\Windows\System32\drivers\npf.sys
Valid from:
9/26/2012 1:00:00 AM
Valid to:
10/27/2015 11:59:59 PM
Subject:
CN="Riverbed Technology, Inc.", OU=Product Marketing, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Riverbed Technology, Inc.", L=San Francisco, S=California, C=US
Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Serial number:
1402AEEF0D31BE743E73F6A7A960C4F4
CTPH (ssdeep):
768:VVRRdUlDRJuOfUhk8ZX2ZeRY4soGLeTZ8wwfKRw:VVRsZREOfUhNK96TZ8wwi6
2 Drivers
Display name:
NetGroup Packet Filter Driver
Type:
Kernel device driver (KernelDriver)
Display name:
WinPcap Packet Driver (NPF)
Type:
Kernel device driver (KernelDriver)