64189a3cf965c80d7d492bfb1e978c6126813dc64710faa8eb91feaf2127888c

Analysis

user interaction
yes
max time kernel
12s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 11:54

Target
VG-Bypass.exe
Size 43.8MB
Sample260522-n3acmscx2w
SHA256 64189a3cf965c80d7d492bfb1e978c6126813dc64710faa8eb91feaf2127888c
MD5 2dc6e9989ff40b11469cea3572739857
SHA1 c3d520d6d7bf25c9ec5d311dadf9530d046e03aa
SHA512 e6480df3d6d2080c1e7143ce580382c6fb95cd526128c730b991866c65647d49a7b2ddc88174591a8169a7a41acdf3e85a8fa066338aedb889994de34d335074
SSDEEP 786432:dEvNQ8tkpmSP1OSr0HXvORK6Bseh8vEzmArl+g3ehWTYR:dEvNYxMSr0kao6Arl+g3ehWTY
TLSH
T138A7239395D9B2E8C4C34674A28B42DB21C1648EC1DEB91E27CB2C02F615DFB454EEB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4328	VG-Bypass.exe
4328	VG-Bypass.exe

C:\Users\Admin\AppData\Local\Temp\VG-Bypass.exe
"C:\Users\Admin\AppData\Local\Temp\VG-Bypass.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4328