← Back to driver explorer
Driver intelligenceVulnerableVerified
EnPortv.sys
Guidance Software EnPortv.sys is an older EnCase kernel driver documented in KOSEC BYOVD research and in public reporting on signed forensic drivers used by EDR-killer tooling. KOSEC documents a KillProc IOCTL path that can terminate a target process when called from an administrator context with the expected caller PID material.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
EnPortv.sysSample 1 · HVCI unknown
- MD5
20a783d3d7076d7a51c66e9eac2ae643- SHA1
4914037cdf1c8bce60be2ca64b19a4af728c932a- SHA256
d42f1b420747b82533e33107c710c45c29ff20aa5da3d1c8498b7bed7f9ebc81- Imphash
fbd5760fdc3436bed9ce5f31879f26db- Authentihash MD5
dbc20ced55dcb73277cef7c54c1b16c2- Authentihash SHA1
2492f2f92f3db5768f3a4a6164139f633634ee53- Authentihash SHA256
46663d7d250954a56199847ba99e133fba7fb0ff82a5cef8099fa5cc9b1dcd99- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Guidance Software Inc.
Recorded command
sc.exe create EnPortv binPath=C:\windows\temp\EnPortv.sys type=kernel && sc.exe start EnPortvTerminate processes from kernel mode through the EnPortv KillProc IOCTL path. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KOSEC LLC