mhyprot2.sys

mhyprot2.sys is the anti-cheat kernel driver associated with miHoYo / HoYoverse titles, notably Genshin Impact. It was registered as a kernel service at install time, which means it can be loaded on a machine even if the game itself is no longer present.

The driver's IOCTL surface gives a caller read and write access to arbitrary kernel memory and the ability to terminate processes with kernel-level privilege. Proof-of-concept exploits have been public on GitHub since 2020. No revocation of its signing certificate has been found. What stops it on modern Windows is Microsoft's Vulnerable Driver Blocklist, which carries rules for mhyprot2.sys and is on by default since the Windows 11 2022 update; a machine with the blocklist switched off can still load it. Genshin ImpactGameGenshin ImpactOpen plate → itself stopped shipping it in 2022 and now loads a different driver, HoYoKProtect.sys.

On the public record: Trend Micro published a detailed write-up in 2022 documenting criminal data-extortion operators using mhyprot2.sys on machines that never had Genshin Impact installed, loading it specifically to terminate endpoint-protection processes before deploying their payload. BleepingComputer, PC Gamer, SecurityWeek, and others covered the story. It became one of the cleanest cautionary examples of why an anti-cheat driver is part of every gamer's security surface.

If you have ever installed a HoYoverse title, the driver may be registered on your system regardless of whether the game is currently installed. Removing the game does not always remove the kernel service; check Windows services for mhyprot2 and remove it, because no current HoYoverse game needs it.

Corrected 2026-10-20: this note used to say the driver "still loads on modern Windows." Where Microsoft's Vulnerable Driver Blocklist is on, known builds of it do not, and current HoYoverse games ship HoYoKProtect.sys instead.

mhyprot2.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 8 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.