{"DetectionScope":"context-only","ResearchEvidence":{"Id":"d4d82af5-0ac6-4d5d-944f-cf108475aba9","Tags":["360hvm64.sys"],"Verified":"TRUE","Author":"@cyb3rh0und, @reiterjr","Created":"2026-04-30","MitreID":"T1562.001","CVE":[],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create 360hvm64 binPath=C:\\windows\\temp\\360hvm64.sys type=kernel && sc.exe start 360hvm64","Description":"360hvm64.sys is the kernel-mode hypervisor enforcement driver shipped with Qihoo 360 Total Security. IOCTL 0x22240c on \\\\.\\360Hvm issues a per-CPU DPC broadcast that executes VMXOFF/VMSKINIT on every logical processor, disabling VT-x/AMD-V hypervisor protection across all CPUs; the auth gate (sub_121f4) delegates to \\Device\\360SelfProtection and fails open when that companion device is absent (BYOVD scenario).","Usecase":"Disable 360 Total Security's VT-x/AMD-V hypervisor-based protection engine on all CPUs to enable subsequent loading of rootkits or unsigned drivers without VM-level detection","Privileges":"kernel","OperatingSystem":"Windows 7, Windows 8, Windows 10, Windows 11"},"Resources":["Internal Research"],"Acknowledgement":{"Person":"John Rodriguez, Jonathan Reiter","Handle":"@cyb3rh0und, @reiterjr"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"360Hvm64.sys","MD5":"0b5c4cd701956b332e60ae85b8c3a7ea","SHA1":"97cbe12e2538aa8a382485e6a00be9337ed72b85","SHA256":"f89d5d95b8a59e6d5e50a49217f83d080e4eaf4bb77b80d8f38cd915640ba124","Signature":["Qihoo 360 Software Co., Ltd."],"Date":"","Publisher":"360.cn Inc.","Company":"360安全中心","Description":"360Hvm64","Product":"","ProductVersion":"2.0.0.1207","FileVersion":"2.0.0.1207","MachineType":"AMD64","OriginalFilename":"360Hvm64.sys","Authentihash":{"MD5":"88cf1a06379e4fdacdb0bbfb9e662f8e","SHA1":"5ce3859ef77f4557cd87dfcce0797d1434b2bf51","SHA256":"a22cbe36242c92676cf6f905ebe5575902989c412875a6bc022f538e1c2455de"},"InternalName":"360Hvm64.sys","Copyright":"(C) 360.cn Inc. All Rights Reserved.","Imports":["ntoskrnl.exe","NETIO.SYS"],"ExportedFunctions":"","PDBPath":"","Imphash":"1ea16ac7f83dccb38a51fdcb3a69cc78","RichPEHeaderHash":{"MD5":"f2dfe7bf0d4bb7330b18de85bb71ca73","SHA1":"3188fac534b56453599268360e812ba6b684c81c","SHA256":"04316336be7b0a1e89e6990c65624380c28de160cd1f21ded21141eecb45f276"},"Sections":{".text":{"Entropy":6.352208807784793,"Virtual Size":"0x5759b"},".rdata":{"Entropy":5.0566087232063195,"Virtual Size":"0x3bf4"},".data":{"Entropy":3.485225119882687,"Virtual Size":"0x99978"},".pdata":{"Entropy":5.645268157307259,"Virtual Size":"0x1b78"},"INIT":{"Entropy":5.365037917226642,"Virtual Size":"0x12b8"},".rsrc":{"Entropy":3.34811199017735,"Virtual Size":"0x3c0"},".reloc":{"Entropy":5.010265572641341,"Virtual Size":"0x1e48"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-07-14 00:40:56","ImportedFunctions":["IoDeleteSymbolicLink","ExFreePoolWithTag","ExReleaseFastMutex","ExAcquireFastMutex","PsSetLoadImageNotifyRoutine","_wcsnicmp","ZwReadFile","RtlInitUnicodeString","IoDeleteDevice","KeSetEvent","ExGetPreviousMode","MmGetSystemRoutineAddress","IoCreateFile","KeInitializeEvent","KeInitializeDpc","ZwSetInformationFile","RtlFreeUnicodeString","MmGetPhysicalAddress","IoGetDeviceObjectPointer","ZwQueryValueKey","ExAllocatePool","KeQueryMaximumProcessorCount","InitSafeBootMode","KeInsertQueueDpc","ZwClose","IofCompleteRequest","KeWaitForSingleObject","ZwFlushBuffersFile","ExRegisterCallback","PsGetVersion","IoCreateSymbolicLink","RtlCopyUnicodeString","ObfDereferenceObject","IoCreateDevice","ZwQueryInformationFile","ExCreateCallback","ZwWriteFile","DbgPrintEx","MmAllocateContiguousMemorySpecifyCache","IofCallDriver","ZwOpenKey","_stricmp","PsGetProcessPeb","ProbeForRead","RtlAnsiStringToUnicodeString","ZwMapViewOfSection","RtlInitAnsiString","ZwQuerySystemInformation","KeReleaseSpinLock","MmFreeContiguousMemory","RtlEqualUnicodeString","RtlImageDirectoryEntryToData","KeDelayExecutionThread","ZwUnmapViewOfSection","IoGetCurrentProcess","RtlAppendUnicodeStringToString","MmIsAddressValid","ZwCreateSection","ZwOpenFile","RtlImageNtHeader","PsGetCurrentThreadTeb","KeAcquireSpinLockRaiseToDpc","KeLeaveCriticalRegion","ExInitializePushLock","ExfAcquirePushLockExclusive","PsSetCreateProcessNotifyRoutine","IoBuildDeviceIoControlRequest","MmUserProbeAddress","ExfReleasePushLock","KeInvalidateRangeAllCaches","ExfAcquirePushLockShared","RtlLookupFunctionEntry","ObfReferenceObject","_strnicmp","PsGetProcessImageFileName","PsLookupProcessByProcessId","PsReleaseProcessExitSynchronization","KeUnstackDetachProcess","MmIsDriverVerifying","PsAcquireProcessExitSynchronization","KeStackAttachProcess","PsGetProcessWin32Process","MmSystemRangeStart","MmUnmapIoSpace","ZwOpenDirectoryObject","MmMapIoSpace","ObReferenceObjectByHandle","RtlCompareUnicodeString","ExAcquireResourceExclusiveLite","PsProcessType","ProbeForWrite","ExpInterlockedPushEntrySList","ExIsResourceAcquiredExclusiveLite","LpcPortObjectType","ExpInterlockedPopEntrySList","ObQueryNameString","IoFileObjectType","ZwWaitForSingleObject","PsCreateSystemThread","PsTerminateSystemThread","ExAcquireResourceSharedLite","ExReleaseResourceLite","RtlPrefixUnicodeString","ExQueryDepthSList","ObQueryObjectAuditingByHandle","ExDeleteResourceLite","PsGetCurrentProcessId","ExInitializePagedLookasideList","ObReferenceObjectByName","ExInitializeResourceLite","PsGetCurrentProcessSessionId","PsGetProcessId","PsGetCurrentProcessWow64Process","ExRaiseStatus","IoDriverObjectType","ExEventObjectType","IoEnumerateDeviceObjectList","RtlCompareMemory","RtlEqualString","PsGetProcessWow64Process","KeBugCheckEx","KeQueryActiveProcessorCount","KeSetTargetProcessorDpc","MmGetPhysicalMemoryRanges","ZwCreateEvent","ZwFsControlFile","MmMapLockedPagesSpecifyCache","MmSizeOfMdl","RtlIpv6StringToAddressExW","MmProbeAndLockPages","MmUnlockPages","RtlIpv4StringToAddressExW","ObOpenObjectByPointer","KeSetImportanceDpc","KeClearEvent","ExAllocatePoolWithTag","ExUnregisterCallback","KeEnterCriticalRegion","ExQueueWorkItem","__C_specific_handler","NsiAllocateAndGetTable","NsiDeregisterChangeNotification","NsiRegisterChangeNotification","NsiFreeTable","NsiGetAllParameters"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-02-20 20:08:08","ValidTo":"2026-02-18 20:08:08","Signature":"3a915ff496468e86d34a86bc4951e3d12d88d33fdd9826b98e674328eb433cad2113c9b57ceef54448eff7b018068dd2dcdab1daadf0536e5840a50e8adfd9da55a6094444c2b2222c402518668f8b610fde25de085d0097ff8e1548d3f15214de67bc40ec593546a1d2996ac74a9667ad8a05872c13ea1f68febffa660d691ff628a2240586db6fb6e26c5df277774231f7cb85e07d2c9918693e23e31b55b10dcb8fc7a1c588aa9089a96f4cd119fa76a370a9abcf4d43a2ceefb1c8adfbd13c76ccecc99c11f6bb8a56f4ea2bf19a6183feb46852de6b673c9bdaf830ffa07ac365efaf5184e21e5c3f32b308342fd07f2e3e2eccc753057aa3688984a183","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000124e76f6ca813a27c35000000000124","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"cfe40b64f31750e7a57db8c4ad451bff","SHA1":"4031068d5106d7b364c9b99daf963a00fce3c1fb","SHA256":"11dfc1860474603fc5821f01931eb0e945a652e9e5d48b5042472941109b1932","SHA384":"fafef1d7376886b2895becf586b67dbb317d6ad4398625b0eed2725280d6b29ea072dc4ec32fbc5e041996f8708351f9"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"3300000124e76f6ca813a27c35000000000124","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}]}]}}