360FsFlt_win10.sys

360 Total Security 11.0.0.1314 is reported to permit a Bring Your Own Trusted Caller (BYOTC) chain involving 360FsFlt_win10.sys 6.9.1.2719 and 360Box64_win10.sys 2.1.0.1463. Static analysis confirms that 360Box64 registers the Safe360BoxPort filter communication port: command 0x13 updates internal sandbox-group membership, and command 0x31 can select group members for ZwTerminateProcess. The submitter reports reaching this interface from a modified genuine QHSafeMain.exe under the trust relationship involving 360FsFlt, with Virtual Sandbox enabled, and terminating a self-created ordinary child. The group-termination primitive is statically confirmed; the cross-driver trust relationship and runtime bypass are externally reported. These samples are tracked together as components of that chain, not as two independent arbitrary-PID termination drivers. No protected-process or EDR termination is established.