ccekrnl.dat

Comodo KillSwitch ccekrnl.dat (file version 12, 2, 2, 8012) is a kernel driver despite its .dat extension. Its CCEKrnl device exposes IOCTL 0x22e01f, whose handler passes a caller-supplied process identifier, desired access mask, and output-handle pointer to ZwOpenProcess without a target or access-mask restriction in that handler. The submitter reports opening the device from an unrelated client, obtaining PROCESS_TERMINATE access to a self-created ordinary child, and terminating it in user mode. This is a kernel process-handle broker, not a direct driver termination command or a trusted-client injection chain. Static analysis confirms the device and process-open dispatch path; the bounded runtime result is externally reported. The driver must be loaded and its device accessible. Protected-process access, EDR termination, and behavior of other versions are not established.