← Back to driver explorer
Driver intelligenceVulnerableVerified
GameDriverX64.sys
GameDriverX64.sys is a signed Hotta Studio anti-cheat driver affected by CVE-2025-61155. Its device-access and IOCTL checks rely on spoofable module names, process names, PE checksums, and the hardcoded value 0xFA123456. A local user can reach kernel routines that terminate arbitrary processes, register a process for handle protection, and strip existing handle rights. KSophon_x64.sys is the VMProtect-packed predecessor shipped with Tower of Fantasy; public reverse engineering reports that it retains the same weak authentication and IOCTL capabilities. The tracked files are legitimate vendor-signed drivers, not malicious drivers, although GameDriverX64.sys has been abused for defense evasion in ransomware intrusions.
Known samples 10
0 recorded TRUE · 0 recorded FALSE · 10 unknown for loading despite HVCI. Results apply to individual samples.
GameDriverX64.sysSample 1 · HVCI unknown
- MD5
cb34be5126520f4c402be3c6f09e11cf- SHA1
7edbc5d18449fabd1ac214fa3959ea5a9e330a12- SHA256
b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
aaf2c8be531e06919898a44600b6d9c9- Authentihash SHA1
bd9bc87c0aaeaeef6c4b8b6fa5752a6998aaccaa- Authentihash SHA256
46f2db2a8012348eadc02d2eff62e521326be22cab79e4ebb5fe738ff7255324- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- Shanghai Yuelong IE Culture Technology Co., Ltd.
GameDriverX64.sysSample 2 · HVCI unknown
- MD5
8f0577d28c4ff5f71b149f444bfaba8e- SHA1
7556ae58c215b8245a43f764f0676c7a8f0fdd1a- SHA256
9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
f032db974bc4fa06e5fd4117e8e381b8- Authentihash SHA1
ae691f567a67998e921f13d697c79f89eb6584b7- Authentihash SHA256
6fa8262990fbc2a1370a94c5c6e700183a5619a0d8de4b6e783215907c4b2d68- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- GameDriver
GameDriverX64.sysSample 3 · HVCI unknown
- MD5
0d9bbed76c17b954ec9120bdfb144ec9- SHA1
1b648ce9b743bf2d9c8da10143f4995ffd055b50- SHA256
9d396b83647f5233cd93f47caa05e0a0d0dd5dd2f17ba2b0ae5cd1afc0afa69d- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
aaf2c8be531e06919898a44600b6d9c9- Authentihash SHA1
bd9bc87c0aaeaeef6c4b8b6fa5752a6998aaccaa- Authentihash SHA256
46f2db2a8012348eadc02d2eff62e521326be22cab79e4ebb5fe738ff7255324- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- GameDriver
GameDriverX64.sysSample 4 · HVCI unknown
- MD5
1f06e06a9e64bad05ba9cccfffa92421- SHA1
edf005b78104c208d05d2ea01fe747a8b8999bb9- SHA256
ca22e593362a8fa4f728e83f6861f983373f61480d0384e26ed149e507706d6a- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
833347fb0f9b505f92c1bf01e3d5d006- Authentihash SHA1
bc38c092b2478d5b67bc51fefd18705401af9bef- Authentihash SHA256
a9c149018c802d3f982d3b3857495e29fd231df7ed030588f163b329024a6865- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- GameDriver
GameDriverX64.sysSample 5 · HVCI unknown
- MD5
3b1c40c32b92696d192d846ab4ca2b45- SHA1
6fa02c7d563be45d0f615c3c170ce2b425629d6c- SHA256
c0db95a62e50f3a2c757ac264534ef17340bf8b8aa94b98fcb7663c493b2d569- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
f032db974bc4fa06e5fd4117e8e381b8- Authentihash SHA1
ae691f567a67998e921f13d697c79f89eb6584b7- Authentihash SHA256
6fa8262990fbc2a1370a94c5c6e700183a5619a0d8de4b6e783215907c4b2d68- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- GameDriver
GameDriverX64.sysSample 6 · HVCI unknown
- MD5
3d2a9d56b16831b18de4b4dfd26603c9- SHA1
0d4f0196e0ed8c5c346f9c612ea2847215483a66- SHA256
e55bfbb979143c6d1bc97129c9b5663639b895f1db605cef578b7f06633c08f6- Imphash
3ce472198cabef134ebbd7e847218cf4- Authentihash MD5
f3886a8a82e22830ec255c496854e78d- Authentihash SHA1
95efb5085aca242d892324c3a1a87ed7634f7d85- Authentihash SHA256
80ddb4d95feb9a00a880d578171f8bb9eff1c49446d54eadc700d140e961a121- Machine
- AMD64
- Version
- 7.23.11.15
- Publisher
- GameDriver
KSophon_x64.sysSample 7 · HVCI unknown
- MD5
9a1cd3071888ba68fb131f36bcc000e9- SHA1
debcc23345afe4ffe858749b3f7e287c00a185bc- SHA256
4ea893c2da9f60590c6223b3c71b13e071d5f700cc3b93f4508b90187ef6091a- Imphash
2a4da7c8a269c324f92513f358167269- Authentihash MD5
d39a5092bbc648aec900f0a89875983b- Authentihash SHA1
bd5aec1c70da08f3f351bcc425eddaed06697658- Authentihash SHA256
d579aa7b6da91da07b281f2b8be478e390ea42ccd3987d115735e8908db6a257- Machine
- AMD64
- Version
- 0, 0, 0, 174
- Publisher
- PROXIMA BETE
GameDriverX64.sysSample 8 · HVCI unknown
- MD5
af036499a90e70e9ec4121ac4da9f5e2- SHA1
30f08056ec1228cb78a4e1f267566919bae6b269- SHA256
f90cab0c3b8159162be3103fcca5bafc27fbf4ec24620900acedaf84b7c0cf30- Imphash
3ce472198cabef134ebbd7e847218cf4- Authentihash MD5
51aa38c14291766887183e839f03df91- Authentihash SHA1
c61c3a8df58fb7834524c7ccf72cd18357418a4e- Authentihash SHA256
a002fde686315a7410eaab863f51fb3fe85961e79221b0dbbb4f71d6fe68ce96- Machine
- AMD64
- Version
- 7.23.11.15
- Publisher
- GameDriver
GameDriverX64.sysSample 9 · HVCI unknown
- MD5
e1787057703c662e07f022f1bd67d008- SHA1
de6da17f92c669f1466f2a5947a054aa4c6ec04c- SHA256
fd08ac95226585436c03b01745c608035bfb15a3a832135589a049cb243cefd9- Imphash
b615e95f5fb9f4b26a7d238fcdd00e79- Authentihash MD5
f032db974bc4fa06e5fd4117e8e381b8- Authentihash SHA1
ae691f567a67998e921f13d697c79f89eb6584b7- Authentihash SHA256
6fa8262990fbc2a1370a94c5c6e700183a5619a0d8de4b6e783215907c4b2d68- Machine
- AMD64
- Version
- 7.23.04.07
- Publisher
- GameDriver
KSophon_x64.sysSample 10 · HVCI unknown
- MD5
ff3351f67270b2021937cb8a54af3d25- SHA1
6bdfd00b7bdb8e24f413bd369058b49a84a98f20- SHA256
2005e9afa51b7918dd1d0143d181641529c488e945fc6bfe1db48805aabdedb3- Imphash
2a4da7c8a269c324f92513f358167269- Authentihash MD5
506591db57a8fff3c784d847fa3c1158- Authentihash SHA1
8f283e17f09891e9b646cdbc96e1b9d3696a82e3- Authentihash SHA256
92d63f2677a536c84c032f04239baf32cde372e9717134138cab290957cf1140- Machine
- AMD64
- Version
- 0, 0, 0, 168
- Publisher
- PROXIMA BETE
Recorded command
sc.exe create GameDriverX64 binPath=C:\windows\temp\GameDriverX64.sys type=kernel && sc.exe start GameDriverX64Terminate security processes and protect a caller-controlled process from existing or future handle access. · Privileges: User · OS: Windows 7, Windows 10, Windows 11
Research & references
- https://www.security.com/blog-post/dragonforce-msteams-backdoor
- https://github.com/magicsword-io/LOLDrivers/issues/360
- https://github.com/magicsword-io/LOLDrivers/issues/362
- https://github.com/BlackSnufkin/BYOVD/tree/main/GameDriverX64-Killer
- https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor
- https://nvd.nist.gov/vuln/detail/CVE-2025-61155
- https://github.com/pollotherunner/CVE-2025-61155/blob/main/advisory.md
- https://vespalec.com/blog/tower-of-flaws/
- https://github.com/svespalec/TowerOfFlaws
Acknowledgement: Tobias Richter, Samuel (Vespalec), Gabriel Maciel Ramos, Anthony Sforzin tobias-richter323 / @svespalec / @pollotherunner / @sys0xFF