60ada17e1371efeff3a16a56bf33979d8278013f3550b501dc082bbbd47961eb

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
Size 1.6MB
Sample260922-c5k2dadh69
SHA256 60ada17e1371efeff3a16a56bf33979d8278013f3550b501dc082bbbd47961eb
MD5 76cae34ebfb7cd5a56a09888f4132748
SHA1 1c2f611d193a53b0f27ff1f9c1f215bcdfe943a7
SHA512 04a883435877337cb8e79ac8bd45d59ecc41376b7523dd7c05bf3ef4dddc10144c1c0646cb6a493df1d19f5c5b44cb1c329be96eea0ed9c50a9f1064be9091d8
SSDEEP 24576:YfMvGbO+IGoP/ENWuDZ28y/BiEF9hLHDSZ/WJ65bJ7mcx:eM4O5LP/EEL5JiUNJAV7mcx
TLSH
T165759C1A77A404F9E0779179C9938946E7F278061B71CBDF07A0436B2F277A18E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe

C:\Users\Admin\AppData\Local\Temp\The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe
"C:\Users\Admin\AppData\Local\Temp\The Last Spell Early Access Plus 22 Trainer Updated 2021.06.15.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-1-0x00007FFD763EF000-0x00007FFD763F0000-memory.dmp

Download

memory/3400-0-0x0000021D8F2C0000-0x0000021D8F2FE000-memory.dmp

Download

memory/3400-2-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-3-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-4-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-5-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-6-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-7-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-8-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-9-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-10-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-13-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-15-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-16-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-17-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-27-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-31-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-32-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-33-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-34-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download

memory/3400-35-0x00007FFD76260000-0x00007FFD76C04000-memory.dmp

Download