Malwagon
file icon
d7508c0022d959e4566d2cc1742cc0b7752… File Analysis · first seen Oct 1, 2026 13:35 · 232.3 KB
4proc 5reg 4IOCs
No threats detected0 Completed Public
Get sample Report Sign in

d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3PE analysis report - No threats detected

Submitted asPrestige Launcher.exePrestige Launcher (6).exe

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

35.8sto launch
92telemetry events
65observed
77agent notes

No threats detected

0/100

Nothing scored against this sample. A run reads as suspicious from 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+0
Model review
  • findings review (advisory, not scored): suspicious - policy registry writes, dns lookup to .vip domain, self-respawning processes, high-entropy resources

Model reading

Measured CLEAN0 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran no points
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution140s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

4 detected · 7 withheld as common
Severity Detection Evidence Layer
MED
Anti-analysis strings present
MITRE T1497
string isdebuggerpresent matched string
static
MED
Network activity via WinHTTP
MITRE T1071.001
import winhttp.dll!WinHttpOpen
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Network communication capability
MITRE T1071
seen in 6% of benign software
capability winhttpconnect capability: network
capability winhttpopen capability: network
capability winhttpsendrequest capability: network
static
Withheld: 7 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Anti-debugging capability fires on 65% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Anti-debug: checks for a debugger fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsthe capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Anti-analysis / evasion checksnone above the reporting threshold - the anti-analysis calls this run did make are listed with their counts

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The file carries a code signature (Prestige Software Development).
  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence measured Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads measured Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Microsoft Visual C/C++(19.36.35228)[C++]
Not packed Trusted signature
CompilerMicrosoft Visual C/C++(19.36.35228)[C++]
LinkerMicrosoft Linker(14.36.35228)
Identity
File
typeexecutable
size232.3 KB
file arch64-bit (x64)
subsystemGUI
entropy7.1242
date2026-09-08 05:07:40 UTC
version1.2.3.0
descriptionPrestige Launcher
productPrestige Launcher
original namePrestige Launcher.exe
languageEN

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28162
Signatures in the set3,642,894
Set published23 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

27.7 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 27.7 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
countersigned at When a timestamp authority countersigned the signature (1788844288) towards benign -1.8519
image flag dll Image flag: a library rather than a program towards malicious +0.9593
certificate chain length How many certificates the chain holds (2) towards benign -0.6643
security directory size Size of the security table (10520) towards benign -0.6160
parser warning: Suspicious flags set for section... Header defect reported by the parse: Suspicious flags set for section... (0) towards benign -0.5090
resource directory size Size of the resource table (89464) towards benign -0.2825
optional.minor_linker_version Version of the linker that produced the file (minor) (44) towards malicious +0.2805
import kernel32.dll:VirtualProtect Calls VirtualProtect from kernel32.dll towards malicious +0.2604

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
12/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 3 signals
  • High-entropy overlay (7.61, 10520 bytes)
  • High-entropy resource (possible packed payload)
  • High-entropy resource (possible packed payload)

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available69
Returned a result1
Failed to decode1

Secrets & malicious strings

1 flagged string

Flagged string categories

anti-analysis / evasion med 1 hit
IndicatorFound inEvidence from the sample
isdebuggerpresent import table KERNEL32.dll!IsDebuggerPresent

Capabilities

5 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Anti-debugging
Detects or obstructs a debugger
 T1622 isdebuggerpresent
med Network / C2
Opens sockets, HTTP or downloads payloads
 T1071.001 winhttpconnect, winhttpopen, winhttpsendrequest
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibrarya
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497, T1497.003 getsystemtimeasfiletime, queryperformancecounter
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findnextfilew

Security mitigations

strong posture
ON ASLR (DynamicBase)
ON High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
ON Control Flow Guard
OFF SafeSEH
ON Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Rich header (toolchain)

richhash 6d2a637ad90971da
ToolBuildUses
Export 14.1033145142
Cvtres 14.103314512
Utc1900 (VS2017)331458
Utc1900 (VS2017)352079
Cvtres 14.103520716
Utc1900 (VS2017)331457
Import (linker)0107
Export 14.103520743
Export 14.10352281
Implib352281
AliasObj 14.10352281

Sections

7 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.textEP
Executable code
 0x1000
78.0 KB
77.8 KB
EXECUTEREAD
6.4742
.rdata
Read-only data
 0x15000
45.0 KB
44.9 KB
READ
4.9572
.data
Initialised data
 0x21000
3.0 KB
7.3 KB
expands
READWRITE
2.1991
.pdata
Exception unwind data
 0x23000
5.0 KB
4.7 KB
READ
4.838
.fptable
Non-standard section
 0x25000
512.0 B
256.0 B
READWRITE
0.0
.rsrc
Resources
 0x26000
87.5 KB
87.4 KB
READ
7.9659
.reloc
Base relocations
 0x3c000
2.0 KB
1.7 KB
READ
5.0086
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

88 funcs / 3 DLLs · 8 suspicious
▸WINHTTP.dll10 funcs 1 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
WinHttpCloseHandle 0x00015280 - -
WinHttpQueryHeaders 0x00015288 - -
WinHttpReceiveResponse 0x00015290 - -
WinHttpSendRequest 0x00015298 - -
WinHttpOpenRequest 0x000152a0 - -
WinHttpSetOption 0x000152a8 - -
WinHttpQueryDataAvailable 0x000152b0 - -
WinHttpReadData 0x000152b8 - -
WinHttpConnect 0x000152c0 - -
WinHttpOpen 0x000152c8 - T1071
▸USER32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
MessageBoxA 0x00015270 - -
▸KERNEL32.dll77 funcs 7 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetStdHandle 0x00015000 - -
WriteConsoleW 0x00015008 - -
CreateFileW 0x00015010 - -
CloseHandle 0x00015018 - -
GetConsoleMode 0x00015020 - -
GetConsoleOutputCP 0x00015028 - -
FlushFileBuffers 0x00015030 - -
HeapReAlloc 0x00015038 - -
HeapSize 0x00015040 - -
SetFilePointerEx 0x00015048 - -
RtlAddFunctionTable 0x00015050 yes -
GetLastError 0x00015058 - -
GetCurrentProcess 0x00015060 - -
ExitProcess 0x00015068 - -
FlushInstructionCache 0x00015070 - -
VirtualAlloc 0x00015078 - T1055
VirtualProtect 0x00015080 - T1055
GetProcAddress 0x00015088 - T1129
LoadLibraryA 0x00015090 - T1129
QueryPerformanceCounter 0x00015098 - T1497
GetCurrentProcessId 0x000150a0 - -
GetCurrentThreadId 0x000150a8 - -
GetSystemTimeAsFileTime 0x000150b0 - -
InitializeSListHead 0x000150b8 - -
RtlCaptureContext 0x000150c0 yes -
RtlLookupFunctionEntry 0x000150c8 yes -
RtlVirtualUnwind 0x000150d0 yes -
IsDebuggerPresent 0x000150d8 - T1622
UnhandledExceptionFilter 0x000150e0 - -
SetUnhandledExceptionFilter 0x000150e8 - -
GetStartupInfoW 0x000150f0 - -
IsProcessorFeaturePresent 0x000150f8 - -
GetModuleHandleW 0x00015100 - -
TerminateProcess 0x00015108 - -
RtlPcToFileHeader 0x00015110 yes -
RaiseException 0x00015118 - -
RtlUnwindEx 0x00015120 yes -
SetLastError 0x00015128 - -
EnterCriticalSection 0x00015130 - -
LeaveCriticalSection 0x00015138 - -
DeleteCriticalSection 0x00015140 - -
InitializeCriticalSectionAndSpinCount 0x00015148 - -
TlsAlloc 0x00015150 - -
TlsGetValue 0x00015158 - -
TlsSetValue 0x00015160 - -
TlsFree 0x00015168 - -
FreeLibrary 0x00015170 - -
LoadLibraryExW 0x00015178 - -
EncodePointer 0x00015180 - -
WriteFile 0x00015188 - -
GetModuleFileNameW 0x00015190 - -
GetModuleHandleExW 0x00015198 - -
HeapFree 0x000151a0 - -
HeapAlloc 0x000151a8 - -
GetFileType 0x000151b0 - -
FindClose 0x000151b8 - -
FindFirstFileExW 0x000151c0 - -
FindNextFileW 0x000151c8 - T1083
IsValidCodePage 0x000151d0 - -
GetACP 0x000151d8 - -
GetOEMCP 0x000151e0 - -
GetCPInfo 0x000151e8 - -
GetCommandLineA 0x000151f0 - -
GetCommandLineW 0x000151f8 - -
MultiByteToWideChar 0x00015200 - -
WideCharToMultiByte 0x00015208 - -
GetEnvironmentStringsW 0x00015210 - -
FreeEnvironmentStringsW 0x00015218 - -
SetStdHandle 0x00015220 - -
GetStringTypeW 0x00015228 - -
FlsAlloc 0x00015230 - -
FlsGetValue 0x00015238 - -
FlsSetValue 0x00015240 - -
FlsFree 0x00015248 - -
InitializeCriticalSectionEx 0x00015250 - -
LCMapStringW 0x00015258 - -
GetProcessHeap 0x00015260 - -

Binary metadata

what the headers declare about this build
Resource langsEN
Debug infoyes
TLS callbacksno

Code signing

Trusted signature
Prestige Software Development
issued by Sectigo Public Code Signing CA R36
Signed byPrestige Software Development
Issuer (CA)Sectigo Public Code Signing CA R36
Valid2026-08-18 → 2027-08-18
Serial64b9692518a71e22975bcb85520f1f20
AlgorithmSHA384-RSA
Verification
Embedded signature: OK
Chain verification: verified
Provenance
The chain verifies as of now, so these bytes are attributable to the publisher above.
Signed at 2026-09-08T05:11:41+00:00 proven
Countersigned by Sectigo Public Time Stamping Signer R37 under Sectigo Public Time Stamping Root R46
Countersignature form RFC3161 token a signed structure issued by the timestamp authority, which is the stronger of the two forms and the one preferred here when a file carries both
Authority revocation good this authority's own certificate was not revoked, so the proof above does not rest on a withdrawn identity
Dated by This platform's own verification of the countersignature - the same reading that proves it, so the moment the chain is judged at and the proof of that moment are one thing.
Second reading 2026-09-08T05:11:41+00:00 agrees with ours
Second opinion verified an independent verifier's separate answer about the same countersignature, kept so the two can be compared
Certificate chain (2)
SubjectIssuerValid toAlgo
Prestige Software Development Sectigo Public Code Signing CA R36 2027-08-18 SHA384-RSA
Sectigo Public Code Signing CA R36 Sectigo Public Code Signing Root … 2036-03-21 SHA384-RSA

Capability detection

18 capabilities
CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
allocate memory -
allocate or change RW memory -
change memory protection -
PEB access -
contain loop -
prepare HTTP request communication/http/client
initialize WinHTTP library communication/http
read HTTP header communication/http
receive HTTP response communication/http/client
check HTTP status code communication/http/client
terminate process host-interaction/process/terminate
parse PE header load-code/pe
resolve function by parsing PE exports load-code/pe
enumerate files on Windows host-interaction/file-system/files/list
query environment variable host-interaction/environment-variable
write file on Windows host-interaction/file-system/write
reference analysis tools strings anti-analysis
ATT&CK techniques
Discovery::File and Directory Discovery [T1083]Discovery::System Information Discovery [T1082]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockCommunication::HTTP Communication::Create RequestCommunication::HTTP Communication::Get ResponseCommunication::HTTP Communication::Read HeaderCommunication::HTTP Communication::WinHTTPDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionProcess::Terminate Process

Signature matches

0 findings · 6 file properties · 0 scored
File properties
IsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

No signature rule identified a threat in this file.

Extracted strings

showing 200 of 456
  • !This program cannot be run in DOS mode.
  • Rich
  • .text
  • `.rdata
  • @.data
  • .pdata
  • @.fptable
  • .rsrc
  • @.reloc
  • @SUATH
  • ntel
  • ineI
  • Genu
  • @USVWATAUAVAWH
  • G0Hch
  • UWATAVAWH
  • @USVWATAVAWH
  • p AWL
  • x ATAVAWH
  • l$ VWATAVAWH
  • USVWATAVAWH
  • ATAUAVAWH
  • VWATAVAW
  • Unknown exception
  • bad array new length
  • Prestige Launcher
  • Download corrupted (truncated).
  • Download corrupted (bad MZ).
  • Download corrupted (bad PE offset).
  • Download corrupted (bad PE signature).
  • Download corrupted (not a 64-bit DLL).
  • Out of memory.
  • Missing dependency for the Prestige module: %s (error %lu).
  • Please report this exact message to support.
  • Unresolved import in the Prestige module.
  • The Prestige module refused to initialize.
  • Could not download Prestige.
  • Two common causes:
  • 1. Your antivirus is blocking requests to the Prestige API.
  • Temporarily disable it and try again.
  • 2. Your internet provider is blocking requests to the Prestige API.
  • Try enabling a VPN and try again.
  • JNI_OnLoad
  • The Prestige module is missing its entry point.
  • The Prestige module reported an initialization failure.
  • vector too long
  • bad allocation
  • __cdecl
  • __stdcall
  • __thiscall
  • __fastcall
  • __vectorcall
  • __preserve_none
  • __clrcall
  • __eabi
  • __restrict
  • __unaligned
  • restrict(
  • delete
  • operator
  • `vftable'
  • `vbtable'
  • `vcall'
  • `typeof'
  • `local static guard'
  • `string'
  • `vbase destructor'
  • `vector deleting destructor'
  • `default constructor closure'
  • `scalar deleting destructor'
  • `vector constructor iterator'
  • `vector destructor iterator'
  • `vector vbase constructor iterator'
  • `virtual displacement map'
  • `eh vector constructor iterator'
  • `eh vector destructor iterator'
  • `eh vector vbase constructor iterator'
  • `copy constructor closure'
  • `udt returning'
  • `RTTI
  • `local vftable'
  • `local vftable constructor closure'
  • delete[]
  • `omni callsig'
  • `placement delete closure'
  • `placement delete[] closure'
  • `managed vector constructor iterator'
  • `managed vector destructor iterator'
  • `eh vector copy constructor iterator'
  • `eh vector vbase copy constructor iterator'
  • `dynamic initializer for '
  • `dynamic atexit destructor for '
  • `vector copy constructor iterator'
  • `vector vbase copy constructor iterator'
  • `managed vector copy constructor iterator'
  • `local static thread guard'
  • operator ""
  • operator co_await
  • operator<=>
  • Type Descriptor'
  • Base Class Descriptor at (
  • Base Class Array'
  • Class Hierarchy Descriptor'
  • Complete Object Locator'
  • `anonymous namespace'
  • FlsAlloc
  • FlsGetValue
  • FlsSetValue
  • InitializeCriticalSectionEx
  • bad exception
  • (null)
  • CorExitProcess
  • Monday
  • Wednesday
  • Thursday
  • Friday
  • Saturday
  • January
  • March
  • April
  • June
  • July
  • August
  • September
  • October
  • November
  • December
  • NAN(SNAN)
  • nan(snan)
  • NAN(IND)
  • nan(ind)
  • FlsGetValue2
  • LCMapStringEx
  • LocaleNameToLCID
  • AppPolicyGetProcessTerminationMethod
  • 1#QNAN
  • 1#SNAN
  • =imb;D
  • K&>.yC
  • .xJ>Hf
  • .text$mn
  • .text$mn$00
  • .text$mn$21
  • .text$x
  • .idata$5
  • .CRT$XCA
  • .CRT$XCAA
  • .CRT$XCZ
  • .CRT$XIA
  • .CRT$XIAA
  • .CRT$XIAC
  • .CRT$XIC
  • .CRT$XIZ
  • .CRT$XPA
  • .CRT$XPX
  • .CRT$XPXA
  • .CRT$XPZ
  • .CRT$XTA
  • .CRT$XTZ
  • .gfids
  • .rdata
  • .rdata$00
  • .rdata$r
  • .rdata$voltmd
  • .rtc$IAA
  • .rtc$IZZ
  • .rtc$TAA
  • .rtc$TZZ
  • .xdata
  • .xdata$x
  • .idata$2
  • .idata$3
  • .idata$4
  • .idata$6
  • .data
  • .data$r
  • .data$rs
  • .bss
  • .fptable
  • .rsrc$01
  • .rsrc$02
  • WinHttpOpen
  • WinHttpCloseHandle
  • WinHttpConnect
  • WinHttpReadData
  • WinHttpQueryDataAvailable
  • WinHttpSetOption
  • WinHttpOpenRequest
  • WinHttpSendRequest
  • WinHttpReceiveResponse
  • WinHttpQueryHeaders
  • WINHTTP.dll
  • MessageBoxA
  • USER32.dll
  • RtlAddFunctionTable
  • GetLastError
  • GetCurrentProcess
  • ExitProcess
  • FlushInstructionCache
  • VirtualAlloc

Stack and decoded strings were not recovered: no reason was recorded. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x1400020604883ec28subrsp, 0x28
0x140002064e883030000call0x1400023ec
0x1400020694883c428addrsp, 0x28
0x14000206de97afeffffjmp0x140001eec
0x140002072ccint3
0x140002073ccint3
0x140002074ccint3
0x140002075ccint3
0x140002076ccint3
0x140002077ccint3
0x140002078ccint3
0x140002079ccint3
0x14000207accint3
0x14000207bccint3
0x14000207cccint3
0x14000207dccint3
0x14000207eccint3
0x14000207fccint3
0x1400020804053pushrbx
0x1400020824883ec20subrsp, 0x20
0x140002086488bd9movrbx, rcx
0x140002089eb0fjmp0x14000209a
0x14000208b488bcbmovrcx, rbx
0x14000208ee80d640000call0x1400084a0
0x14000209385c0testeax, eax
0x1400020957413je0x1400020aa
0x140002097488bcbmovrcx, rbx
0x14000209ae801650000call0x1400085a0
0x14000209f4885c0testrax, rax
0x1400020a274e7je0x14000208b
0x1400020a44883c420addrsp, 0x20
0x1400020a85bpoprbx
0x1400020a9c3ret
0x1400020aa4883fbffcmprbx, -1
0x1400020ae7406je0x1400020b6
0x1400020b0e857070000call0x14000280c
0x1400020b5ccint3
0x1400020b6e895f8ffffcall0x140001950
0x1400020bbccint3
0x1400020bcccint3
0x1400020bdccint3
0x1400020beccint3
0x1400020bfccint3
0x1400020c0e967070000jmp0x14000282c
0x1400020c5ccint3
0x1400020c6ccint3
0x1400020c7ccint3
0x1400020c84883ec28subrsp, 0x28
0x1400020cc4d8b4138movr8, qword ptr [r9 + 0x38]
0x1400020d0488bcamovrcx, rdx
0x1400020d3498bd1movrdx, r9
0x1400020d6e80d000000call0x1400020e8
0x1400020dbb801000000moveax, 1
0x1400020e04883c428addrsp, 0x28
0x1400020e4c3ret
0x1400020e5ccint3
0x1400020e6ccint3
0x1400020e7ccint3
0x1400020e84053pushrbx
0x1400020ea458b18movr11d, dword ptr [r8]
callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample
Fingerprint24:ZRzrfRGjAjKLFhyRDB1twAMUpvgcDoJS1o0qtIgGUJnc+pl39/puhvRSOovbO9ZB:HchhOZCfS1YtIgGEc+ppIj3eq
Imports read88 functions from 3 libraries (88 distinct)
Comparableyes
Compared against98 stored samples
Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

81 frames · screen recording · 141s
Screen recording frame
1 / 81
0:00 · 1/81
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 140s

4 process(es) observed

LaunchedC:\Users\user\Desktop\Prestige_Launcher.exe
Privilegestandard
Telemetry sources: Kernel ETW (125 of 637 events) agent poll: 4Process audit: 5keydiff: 1In-process monitor: 23Autostart diff: 42

Evasion / anti-analysis checks

5 checks
MED
Anti-debug API imports static-api
MITRE T1622 · isdebuggerpresent
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-analysis strings (VM/debugger/tool names) strings
MITRE T1497 · isdebuggerpresent
LOW
CPUID hypervisor/feature probe static-instruction
MITRE T1497.001 · 8x cpuid - no timing or descriptor-table instruction beside it

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Anti-analysis API trace

2 APIs · 4 processes hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

APISignalCallsSleepScored
GetTickCount timing 3 - no corroborates, never convicts on its own - ordinary software calls this
GetTickCount64 timing 19 - no corroborates, never convicts on its own - ordinary software calls this
Call order 14 events sampled
GetTickCount64GetTickCount64GetTickCountGetTickCount64GetTickCountGetTickCount64GetTickCount64GetTickCountGetTickCountGetTickCount64GetTickCountGetTickCount64GetTickCountGetTickCount64

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

No module load worth listing. In-process hooks were placed in 4 processes and recorded 6 module loads, all of them from system or installed-program directories, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 915 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

2 read

2 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

4processes
4registry operations

Prestige Launcher.exe

4 processes
4 processes

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations43
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 5 registry · sample scope
OperationTargetProcess
create
SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
kernel trace
 Prestige_Launcher.exe pid 1020
create
TenantRestrictions\Payload
kernel trace
 Prestige_Launcher.exe pid 1020
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
kernel trace
 Prestige_Launcher.exe pid 1020
create
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
kernel trace
 Prestige_Launcher.exe pid 800
setvalue
System\CurrentControlSet\Services\PptpMiniport
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
Start = 2
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
DriverMajorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
DriverMinorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
NdisMinorVersion = 84
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndiswanlegacy
NdisMajorVersion = 5
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndiswanlegacy
NdisMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
DriverMajorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
NdisMinorVersion = 84
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan\Parameters
MiniportsInstalled = 65535
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan
Start = 2
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan
DelayedAutostart = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
TrapPollTimeMilliSecs = 15000
read backread back
 -

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

2 earlier runs

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

RunAnalysedModuleVerdictScore
#2716 2026-10-09 21:26 File Analysis No threats detected0 0/100
#2600 2026-10-01 13:42 File Analysis No threats detected0 0/100
17 answered no 1 could not answer 5 had nothing to check
0Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
52 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
4 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
52 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
52 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer
SourceChecksResultDetailFeed
URLhaus IP / domain / URL feed unavailable 13 observed indicators, none listed no records ingested
blocklist.de IP / domain / URL clean 13 observed indicators, none listed 27.6k records
52 minutes ago
CINS Army IP / domain / URL clean 13 observed indicators, none listed 15k records
52 minutes ago
Emerging Threats IP / domain / URL clean 13 observed indicators, none listed 482 records
52 minutes ago
Feodo Tracker IP / domain / URL clean 13 observed indicators, none listed 5 records
52 minutes ago
IPsum IP / domain / URL clean 13 observed indicators, none listed 19.7k records
52 minutes ago
Phishing.Database IP / domain / URL clean 13 observed indicators, none listed 391.5k records
4 hours ago
ThreatFox IP / domain / URL clean 13 observed indicators, none listed 1,153 records
52 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
10 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

2 clear
SourceChecksResultDetailFeed
Sigma rules Behavior log clean - 2,275 records
5 hours ago
Signature rules Sample content clean 6 structural rules matched (file properties, not findings) 110 records
52 minutes ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 4 process image paths, none masqueraded 245 records
52 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
51 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
52 minutes ago
LOLRMM Names and domains clean 7 name/domain indicators checked, no remote-management tooling 360 records
51 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 1 suspicious 3 info

File indicators

3
SeverityTypeIndicatorDescription
info sample_sha256 d7508c0022d959e4566d2cc1742cc0b7752b6fd1e692ecab7cef7ac6b9d8eec3 Submitted sample (SHA256)
info sample_md5 a802560cc00c14f811f003991a717e8c Submitted sample (MD5)
info imphash 431e56cb8fa4b2daff0aadf7e5259544 Import table hash (imphash)

Registry indicators

1
SeverityTypeIndicatorDescription
suspicious registry_key \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Autostart / persistence key

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2919

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

3 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

SubmittedEnvironmentVerdictScore
2026-10-23 15:46 Shown below Windows 10 22H2 No threats detected 0/100
2026-10-09 21:23 Windows 10 22H2 No threats detected 0/100
2026-10-01 13:39 Windows 10 22H2 No threats detected 0/100