Driver intelligenceVulnerableVerified

360hvm64.sys

360hvm64.sys is the kernel-mode hypervisor enforcement driver shipped with Qihoo 360 Total Security. IOCTL 0x22240c on \\.\360Hvm issues a per-CPU DPC broadcast that executes VMXOFF/VMSKINIT on every logical processor, disabling VT-x/AMD-V hypervisor protection across all CPUs; the auth gate (sub_121f4) delegates to \Device\360SelfProtection and fails open when that companion device is absent (BYOVD scenario).

UUID / d4d82af5-0ac6-4d5d-944f-cf108475aba9ADDED / 2026-04-30AUTHOR / @cyb3rh0und, @reiterjr

Known samples 1

0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.

360Hvm64.sysSample 1 · HVCI unknown

MD5: 0b5c4cd701956b332e60ae85b8c3a7ea
SHA1: 97cbe12e2538aa8a382485e6a00be9337ed72b85
SHA256: f89d5d95b8a59e6d5e50a49217f83d080e4eaf4bb77b80d8f38cd915640ba124
Imphash: 1ea16ac7f83dccb38a51fdcb3a69cc78
Authentihash MD5: 88cf1a06379e4fdacdb0bbfb9e662f8e
Authentihash SHA1: 5ce3859ef77f4557cd87dfcce0797d1434b2bf51
Authentihash SHA256: a22cbe36242c92676cf6f905ebe5575902989c412875a6bc022f538e1c2455de
Machine: AMD64
Version: 2.0.0.1207
Publisher: 360.cn Inc.

Download vulnerable sample View on VirusTotal

Recorded command

sc.exe create 360hvm64 binPath=C:\windows\temp\360hvm64.sys type=kernel && sc.exe start 360hvm64

Disable 360 Total Security's VT-x/AMD-V hypervisor-based protection engine on all CPUs to enable subsequent loading of rootkits or unsigned drivers without VM-level detection · Privileges: kernel · OS: Windows 7, Windows 8, Windows 10, Windows 11

Acknowledgement: John Rodriguez, Jonathan Reiter @cyb3rh0und, @reiterjr