mhyprot2.sys

mhyprot2.sys is the anti-cheat kernel driver associated with miHoYo / HoYoverse titles, notably Genshin Impact. It was registered as a kernel service at install time, which means it can be loaded on a machine even if the game itself is no longer present.

The driver's IOCTL surface gives a caller read and write access to arbitrary kernel memory and the ability to terminate processes with kernel-level privilege. Proof-of-concept exploits have been public on GitHub since 2020. The signing certificate has not been revoked, so the driver still loads on modern Windows.

On the public record: Trend Micro published a detailed write-up in 2022 documenting criminal data-extortion operators using mhyprot2.sys on machines that never had Genshin ImpactGameGenshin ImpactOpen plate → installed, loading it specifically to terminate endpoint-protection processes before deploying their payload. BleepingComputer, PC Gamer, SecurityWeek, and others covered the story. It became one of the cleanest cautionary examples of why an anti-cheat driver is part of every gamer's security surface.

If you have ever installed a HoYoverse title, the driver may be registered on your system regardless of whether the game is currently installed. Removing the game does not always remove the kernel service; check Windows services for mhyprot2 and remove it if you are not playing.

mhyprot2.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 8 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.