← Back to driver explorer
Driver intelligenceVulnerableVerified
xkpsm.sys
xkpsm.sys is an xkeeper kernel driver from JiranJikyosoft. The driver exposes IOCTL 0x8505E008 to user mode and reaches ZwTerminateProcess, enabling kernel-mediated process termination without sufficient caller or target validation. This makes the driver useful in BYOVD-style process termination and security tool impairment scenarios after it is loaded.
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
xkpsm.sysSample 1 · HVCI FALSE
- MD5
bb08ca77afc108421b8135d22ea6b374- SHA1
d60fc160f73450ee63c9f46dd55d5cede6fe3dcd- SHA256
28c5bb735f9fc38e0ebd366978898f0cfcd455e4ff8bf1a321768b09e01ee84d- Imphash
68dea920d822aa2e15f3dd7f2c59678a- Authentihash MD5
883b58a5cb813602c1031eb7ed5aabc7- Authentihash SHA1
2c069a4256886e514bc0aeeb84ea7f01b4803041- Authentihash SHA256
55b469434acef9803975cdf59c7d80777127847ce27711682f3ba81f9b5f7d9f- Machine
- AMD64
- Version
- 3,0,0,1
- Publisher
- Jiransoft Co. Ltd.
Recorded command
sc.exe create xkpsm binPath=C:\windows\temp\xkpsm.sys type=kernel && sc.exe start xkpsmTerminate processes · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: @wwwab123