wfshbr64.sys

wfshbr64.sys is the kernel driver for the anti-cheat system in Heaven Burns Red, a mobile and PC RPG developed by Wright Flyer Studios (a subsidiary of GREE, headquartered in Tokyo). A 32-bit companion, wfshbr32.sys, also exists.

The driver carries a valid Microsoft digital signature. CVE-2022-42046 documents a privilege-escalation flaw: crafted IOCTL commands let a local user manipulate EPROCESS structure fields (Protection and SignatureLevel flags), which means anything on the machine can give itself the kernel-level protections normally reserved for critical system processes. CVE-2022-48019 documents a related privilege-escalation issue affecting the same driver family across WFS titles.

The driver is categorized as malicious on the public LOLDrivers list and appears in Sigma detection rules for malicious driver loads. Versions v3.0.20 and v2.14.200 and later address the reported flaws. If you play Heaven Burns Red and the game is up to date, the driver should be the patched version.

wfshbr64.sys is listed as malicious on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.