AToolsKrnl64.sys

Antiy ATool AToolsKrnl64.sys from the reported 2.0.26.819 package exposes process termination through IOCTL 0x99000050. Its caller check validates an Antiy-signed executable on disk and caches the accepted process, but does not verify the integrity of the running client. A modified genuine client can therefore pass this check and request termination of caller-selected processes. Static analysis of this sample confirms a world-readable device and a kernel-mode target-open path that does not require the caller to already hold termination rights. The termination path rejects targets with a nonzero driver-defined protection/state byte. The public demonstration terminates only a self-created ordinary child; protected-process and EDR termination are not established.