Genshin Impact
Genshin Impact is HoYoversePublisherHoYoverse / miHoYomiHoYo (mainland China), publishing internationally as HoYoverse via Cognosphere, makes Genshin Impact, Honkai: Star Rail, and Zenless Zone Zero. Its legacy anti-cheat driver mhyprot2.sys became a landmark security case after ransomware crews abused the signed driver to disable antivirus; its current games ship a newer driver, HoYoKProtect.sys.3 games in this family →'s free-to-play open-world action RPG, released globally on September 28, 2020 and built on Unity. It is developed by miHoYo (mainland China) and published internationally by Cognosphere under the HoYoverse brand. It runs on its own PC launcher and the Epic Games Store, plus PlayStation, mobile, and (since 2024) Xbox, and has been one of the highest-grossing games in the world since launch.
If you play Genshin Impact today, the kernel driver to expect is HoYoKProtect.sys, loaded while the game runs. If you first installed the game before late 2023, an mhyprot2 or mhyprot3 driver service from that era may still be registered: check Windows services for entries starting with mhyprot and remove any left over from an old install. Keep Microsoft Vulnerable Driver Blocklist switched on in Windows Security, under Device security and Core isolation, because it stops the listed builds of the old mhyprot drivers from loading; it does not list the last mhyprot3 build the game shipped, which is why removing a leftover service matters.
Genshin Impact installs HoYoverse's kernel-mode anti-cheat, whose Windows driver today is HoYoKProtect.sys, a file kept in the game's install folder and loaded when the game starts. That is a change from launch. HoYoverse's own package file lists show the game shipped with mhyprot2.sysDrivermhyprot2.sysGenshin Impact anti-cheat kernel driverOpen plate → (catalogued in this guide's drivers section), added mhyprot3.sysDrivermhyprot3.sysHoYoverse anti-cheat driver (v3)Open plate → in 2022, began carrying HoYoKProtect.sys with version 3.3 in December 2022, and dropped the mhyprot drivers entirely with version 4.1 in September 2023. At the 2020 launch the anti-cheat kept running after the game was closed, and even after it was uninstalled; after player criticism, miHoYo said it would no longer run in the background once the game was closed or uninstalled. HoYoKProtect.sys is not on the public vulnerable-driver lists that catalogue the older mhyprot drivers. The game executables are GenshinImpact.exe (international) and YuanShen.exe (the Chinese client).
mhyprot2.sys is one of the clearest real-world cases of why a signed kernel driver is not a safe kernel driver. In 2022, ransomware operators used it as a bring-your-own-vulnerable-driver tool: they dropped the legitimately-signed Genshin anti-cheat driver onto target machines, loaded it, and from kernel mode disabled antivirus before deploying ransomware. Genshin Impact did not need to be installed for the abuse to work, and at the time the driver's code-signing certificate had not been revoked. The flaw is tracked as CVE-2020-36603. Trend Micro published the analysis in August 2022, and BleepingComputer and The Hacker News covered it. HoYoverse told Motherboard it was working on a solution; the game later moved to a different driver, and Microsoft's Vulnerable Driver Blocklist now carries rules for mhyprot2.sys.
Kernel drivers this game ships with, catalogued in the Field Guide: mhyprot2.sys, mhyprot3.sys.
User-mode processes this game ships with, catalogued in the Field Guide: genshinimpact.exe, yuanshen.exe.
Dated developments, newest first, each one sourced and stated plainly. Vera logs the record; the reader draws the conclusion.
Version 4.1 released; HoYoverse's package lists show it dropped mhyprot3.sys, leaving HoYoKProtect.sys as the game's only anti-cheat driver.
Version 3.3 released; HoYoverse's package lists show it was the first build to carry HoYoKProtect.sys.
Trend Micro reported ransomware operators abusing mhyprot2.sys to disable antivirus from kernel mode on machines that never had the game.
Sentences this plate once carried that were wrong, kept beside what is true, so a correction never looks like a quiet edit.
It said: "Genshin Impact installs miHoYo's kernel-mode anti-cheat, whose Windows driver is mhyprot2.sys (catalogued in this guide's drivers section)." And: "If Genshin Impact is installed, expect mhyprot2.sys at the kernel level while you play."
Now: HoYoverse's own package lists show the game has carried HoYoKProtect.sys since version 3.3 in December 2022 and dropped the mhyprot drivers with version 4.1 in September 2023. mhyprot2.sys is the driver of the game's early years, not today's.
It said: "As context, miHoYo is a Chinese publisher, part of the broader data-handling conversation around the title, though no specific player-data breach is part of that record."
Now: That sentence cited nothing and leaned toward a verdict drawn from where the publisher is based, so it is gone. No player-data breach involving the game is part of the public record Vera found.
It said: "At the 2020 launch the anti-cheat kept running after the game was closed, and even after it was uninstalled; following backlash, miHoYo changed it to run only while the game runs."
Now: PCGamesN reported miHoYo's September 2020 statement that it would make that change, not confirmation that the change shipped, so the plate now says what miHoYo said.
The public sources this plate stands on. Go check our work.
Catalogued by Vera. Trust-architecture details cite the publisher's own anti-cheat documentation and named public reporting from mainstream gaming press (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others).
Vera Project. “Genshin Impact.” Vera Field Guide (Game). The Vera Project. https://www.veraproject.xyz/field-guide/games/genshin-impact