heysafe_drv.sys

heysafe_drv.sys is a HeySafe-X protection minifilter submitted as a malicious process killer in issue #468. Static analysis verifies a caller-validated communication port whose message opcode 0x67 queues process-tree termination and attempts to clear ProcessBreakOnTermination before ZwTerminateProcess. The termination path excludes several core Windows processes and registered HeySafe PIDs. The object callback restricts handle access to protected HeySafe processes and can queue termination of werfault.exe. The cited callback helper does not select Task Manager, Process Explorer, WinDbg or Visual Studio for termination. Work items use DelayedWorkQueue. The catalog verification covers the sample identity and these static capabilities; malicious intent, a trusted-caller authorization bypass, protected-process termination, stack spoofing and certificate theft were not established by this review. The embedded code-signing certificate expired in 2013 and has no signing timestamp. Current Windows loading and HVCI behavior remain unknown.