360hvm64.sys
Qihoo 360 hypervisor monitoring driver
360hvm64.sys is a kernel driver from Qihoo 360 Total Security, the consumer security suite from one of China's largest software companies. Qihoo 360 has hundreds of millions of users globally, with a particularly dominant footprint in China and across Southeast Asia, and bundles install on a wide range of OEM machines sold in those markets.
It is on the public LOLDrivers list as part of a broader Qihoo 360 driver family (which also includes DsArk64.sys and others) whose IOCTL surfaces grant kernel-level process termination and arbitrary kernel-memory read and write to local callers. Other entries in this catalog (aswArPot, viragt) describe the same pattern: an antivirus driver becoming a BYOVD primitive on a machine that has already been compromised.
Its presence on a gaming PC outside Asia is unusual; in Asia it is common as part of OEM bundles or community-popular free security suites. If you find it and do not currently run Qihoo 360 Total Security, uninstall it through Windows' Apps and features.
360hvm64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.
Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.
Vera Project. “360hvm64.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/360hvm64-sys