0d1ecee15633be9942e242a251c6c8b5f1a0b32946e91bf88a2829b4aedd6806

Analysis

max time kernel
899s
max time network
480s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 09:12

Target
Donetsk Launcher.exe
Size 44.6MB
Sample260705-k6bs4aez8p
SHA256 0d1ecee15633be9942e242a251c6c8b5f1a0b32946e91bf88a2829b4aedd6806
MD5 970c946525f34f6ac91226059b3fdd6a
SHA1 3c0f991ebc55e9b785b160ecda2bc8863955de3b
SHA512 b30f78a791811cb0e59f8e96d861b7e6fa8cc5496e867c8375ec6a4829ea8731b8779eb1225fe5f730fc7085d9a8556fc506eb3af41c7144edfc5f2d134e82c1
SSDEEP 786432:OtJ29BXZJyd7xeJs6ddasInGIr0ZzWCxRcPwLQBntxYcKvECldMcP:s41KZ4bPInsTxncBnt1slOA
TLSH
T1EDA723DA94E282ADC84181B4FA4515E9F4CDB4CC8EFD092B7FCE84113671C6DC8EA976
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4948	Donetsk Launcher.exe
4948	Donetsk Launcher.exe

C:\Users\Admin\AppData\Local\Temp\Donetsk Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Donetsk Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3544

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1416