Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 06:57

General

  • Target
    probabilistic-m5d67bbe7/prezi-windows.exe
  • Size 32.8MB
  • Sample261110-hrdm2ahs3w
  • SHA256 b6201b35cfaa05996558173c4df1a801d2fd9b1aae495ee8c409c4ab50cefe4f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\probabilistic-m5d67bbe7\prezi-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\probabilistic-m5d67bbe7\prezi-windows.exe"
    1⤵
    • Checks computer location settings
    • Writes a Windows system DLL name to a user directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\prezi.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\prezi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BugSplat.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BugSplat.dll
        • Size 296KB
        • SHA256 4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CONCRT140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CONCRT140.dll
        • Size 237KB
        • SHA256 3ecc9370317000a13ef3f60c14ec36538b725034b819805e25e0d1da45cc55b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef.pak

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cef.pak
        • Size 1.4MB
        • SHA256 6d56e187ba5f1aeda8d79318329b1ea6fa17295692860f6a14fc3bca80616fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cef_100_percent.pak
        • Size 146KB
        • SHA256 7b1b1aea2ce508f5651974cf6bb34290ed15cc23b697d233d061ceb331735a67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cef_200_percent.pak
        • Size 236KB
        • SHA256 4abcc62dd92e3ba0d19d843f973b2ad5c17f9d51001807ecef411cb472cd9d69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FromWhereYouAre-Regular.keg

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\fonts\FromWhereYouAre-Regular.keg
        • Size 147KB
        • SHA256 c62b4a9dce70616119823fd0b88ea10459d45aba73432fd00b9233e5f06baa75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KGEmpireofDirt-Regular.keg

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\fonts\KGEmpireofDirt-Regular.keg
        • Size 70KB
        • SHA256 96f006a509a0e816c502a07f2d6416f5455f58e13ab407539591234c1342c837
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PlayfairDisplay-Regular.keg

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\fonts\PlayfairDisplay-Regular.keg
        • Size 139KB
        • SHA256 7ed489b8a4b6449fab4ced25e9690129bf334fa66e7a369ad208529ed8fc8836
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5001986543.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5001986543.png
        • Size 6KB
        • SHA256 9ec1e8a1c5c004831d88b403d3810a27da9554c8a7f24e18345563c8d9c58da4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5001987638.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5001987638.png
        • Size 75KB
        • SHA256 60c43d89afafa53879c1f4133ea3fb4dcd0b94f9766f3e93235a27f7ba0e2f40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5189185492.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5189185492.png
        • Size 50KB
        • SHA256 aefcfe64793e16f9fe2572db63176892a3cd0ad60f869a74f65da2ccf86b3dad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5189186591.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5189186591.png
        • Size 49KB
        • SHA256 440d118cff73669ff122306975a81dc8a9b4a60e49643315b85097717ffea28f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5189816263.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5189816263.png
        • Size 40KB
        • SHA256 6cbfa55a517ceb302bfbcb07d35684847884efe86929c954c05e7fd965664f84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5189818789.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5189818789.png
        • Size 41KB
        • SHA256 1574e0bc4c86c3e8415aaa8a3efa1056977cf41aca05be85cbe44632dda5afb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190268880.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190268880.png
        • Size 40KB
        • SHA256 4ac44ec7ed404780032efe5af303286887ec6248f9a29fe67eb8db6d2a5e9a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190270676.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190270676.png
        • Size 40KB
        • SHA256 2472ab6bbbd3279720e3a39fd810ce3adb9dad158e673d585a770247a3c30e66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190271097.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190271097.png
        • Size 41KB
        • SHA256 6f4846e7fbe3cb2783c293143c343ebfa9579449da207146fc915445c9e88949
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190271443.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190271443.png
        • Size 40KB
        • SHA256 1239e0150edc48d228b226510632a1acb9b7b58fd684d9385c43db1560a84f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190526037.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190526037.png
        • Size 37KB
        • SHA256 4f162c9df3cc13b5ec40b853a5e796ef899b84a19bad937b64c611673ba276da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190531656.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190531656.png
        • Size 39KB
        • SHA256 6db1a18768b1f40e1cd79e845f3a85cce8ac01c8f952a503174a12b45715cd49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190531837.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190531837.png
        • Size 40KB
        • SHA256 4f366508cf0da3f2dd4f98f82bc2795cecb394a132eee653f8371e2c73f2ada7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190736880.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190736880.png
        • Size 40KB
        • SHA256 5652bc08be999b7f4e8c8abcaec384f7632432648cb9d07b4f149856f96215d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190737182.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190737182.png
        • Size 40KB
        • SHA256 f9c21bcf0449776d897b150449ba4fc81ea95bce48a7657464afd55c20ed730c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190751181.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190751181.png
        • Size 41KB
        • SHA256 f70a8c7a7e7455d0359c2bd409299820c04a71250024896dd0bdcb9ee9112e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190751290.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190751290.png
        • Size 41KB
        • SHA256 e83e357348ff10b4d91c2b646059f5bdb89081d9e5fd1dbb80f277e1e987a173
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190752032.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190752032.png
        • Size 53KB
        • SHA256 837757b78b73a81c330a2cf6cd17b2117aad33b88745f79848baee66c3c9ee64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190754820.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5190754820.png
        • Size 38KB
        • SHA256 f3ec4e7babd7b81e14ec798de3435d24caa7926468592a552c0ec53b346be401
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5192306246.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5192306246.png
        • Size 64KB
        • SHA256 f707521af63649f9edfa5434181ee52e0d000a6939cfddec744ff1c0470ea567
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5192309951.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5192309951.png
        • Size 23KB
        • SHA256 5f1fe61b2b4cb54d7e089dc55fd7d413c780a931ce663a37f42765268ad9181e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5193297631.png

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\images\5193297631.png
        • Size 39KB
        • SHA256 9d91577c019e75e7cc773be56c71633fe8c00ed6fd0988eec9a896cd17861026
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prezi.json

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\prezi.json
        • Size 191B
        • SHA256 21f9c89651ac0a0170c29ae30e74931f079c6461c46af8af5197c5c2c8687684
        • MD5 SHA1 SHA512 TLSH

        prezi.xml

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\prezi.xml
        • Size 98KB
        • SHA256 9924883d3f33062f4b34bbb4008fa927fb38f3955610e5f6bce7c7cab32e06a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2818943500.swf

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\swf\2818943500.swf
        • Size 761B
        • SHA256 8fe414f25bf001da05b1ba6d9588f92dc870042ab415e407d505d6947413defc
        • MD5 SHA1 SHA512 TLSH

        606423451.swf

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\contents.portable\swf\606423451.swf
        • Size 377B
        • SHA256 c8e9526acdb2cee3829c80b98ef7bfb882a43466ba2ac5a37b02fb900fcdcc47
        • MD5 SHA1 SHA512 TLSH

        cpprest140_2_6.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cpprest140_2_6.dll
        • Size 4.5MB
        • SHA256 f70c897c1fc2569e3445dc21d22152d43598a72db0531d4a827deb58ccbe92d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\d3dcompiler_47.dll
        • Size 3.3MB
        • SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\icudtl.dat
        • Size 9.7MB
        • SHA256 22b4b162fa9c1a35d086df4b2532485c0ddfee4649de8519cfc52a09f749b8ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\libEGL.dll
        • Size 279KB
        • SHA256 151757f7aa3f4f16ff99c7796eefddc324294890a1fb19b046ec04ae1f6df8dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\libGLESv2.dll
        • Size 2.8MB
        • SHA256 e88b009f1c76da5762c64eadd9b88715c2bf274acf369755ff190bb731223353
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\msvcp140.dll
        • Size 427KB
        • SHA256 7b71100189a6bcdf3e4cf4b75283081b132e6855543bbbf112be774fb73ae089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        natives_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\natives_blob.bin
        • Size 358KB
        • SHA256 35d85320e2908240da1dc8a577da3aad702936999336a3dcc0576b00c13e9756
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prezi-viewer.json

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\prezi-viewer.json
        • Size 491B
        • SHA256 48441ef78eb09803cac6697eea787bd37414550bf28dc1795d6deb0b2956a360
        • MD5 SHA1 SHA512 TLSH

        prezi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\prezi.exe
        • Size 15.8MB
        • SHA256 1a4d93df23129ee1d26fcae3e18d5c0eaa589b031dfd7f5b079cdbd9d4e7201e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\snapshot_blob.bin
        • Size 633KB
        • SHA256 b4ee1ceb6771bf43590a6bfb34c5b7c7c77d1476a831529e61703ca64e1a1626
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vcruntime140.dll
        • Size 81KB
        • SHA256 1676bffca4b8f024e5f1896f9f26612028cc46fcc0a2fe408098846929f9b200
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190526037_0_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190526037\5190526037_0_0.png
        • Size 36KB
        • SHA256 cd28c6b1680b843a6f122358a382805bf032eef554696da9ccce95da3f900ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190526037_1_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190526037\5190526037_1_0.png
        • Size 15KB
        • SHA256 d3452dea86f685240606b2af45e4356bd3aad8bef9450a356575a36233aa45d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190526037_2_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190526037\5190526037_2_0.png
        • Size 6KB
        • SHA256 346d596d27651ec47ae209c3bddd08c4a6081fedc40f567c1ec18aec5b3b5da4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190530840_0_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190530840\5190530840_0_0.png
        • Size 36KB
        • SHA256 01fdfa42de4b27f6b1f03baf26550a7325b7efd3f4df8740d396a2423bc7f918
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190530840_1_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190530840\5190530840_1_0.png
        • Size 15KB
        • SHA256 67496c2ef55da491fd1e2b3b832ba55fffb25c260d7406f0e3552c0320e95717
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190530840_2_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190530840\5190530840_2_0.png
        • Size 6KB
        • SHA256 df1636d69cd914b2e58b4d8cb6138222cea0bc6c62ce06f11666262d08561920
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190750942_0_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190750942\5190750942_0_0.png
        • Size 36KB
        • SHA256 5ef7473a1d84141d6609959bd3f74cf4b1401dfa88a80c8af9d5525d37c177db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190750942_1_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190750942\5190750942_1_0.png
        • Size 15KB
        • SHA256 5c5565983046a36dea63757634d140626534d59f90d2c19f059aec5bf4389d11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190750942_2_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190750942\5190750942_2_0.png
        • Size 6KB
        • SHA256 caaf70fe0455760134d48ffcf720a03c3d6f2120c13795a0ef53cfde2862bf96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190751121_0_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190751121\5190751121_0_0.png
        • Size 36KB
        • SHA256 a9530d771bc357114b67956ff05242ae2c53f65e500c6f3fe4e92623e98898e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190751121_1_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190751121\5190751121_1_0.png
        • Size 15KB
        • SHA256 82f8779db6341c094058b27c9e2cf9e2231d1616cb957201d5970e78daa5a37f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5190751121_2_0.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\images\5190751121\5190751121_2_0.png
        • Size 6KB
        • SHA256 cbee16d4e83eea144ba99122b725993cbfcd8f6ac6fcaba9dc4c7f53f38321e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2818943500.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\swf\xvg_9\2818943500.png
        • Size 2KB
        • SHA256 d931b3ff8abe945ddf857ae03b4f090aa5b798c3db2d722efcda2dcf59749bf2
        • MD5 SHA1 SHA512 TLSH

        606423451.png

        • Path C:\Users\Admin\AppData\Local\Temp\prezi-cache\a97f7519-a6ed-4b05-926b-6353739b40ed\contents.portable\swf\xvg_9\606423451.png
        • Size 2KB
        • SHA256 8781c2392f6af54c5c584f125d061cebcb5c730e5747b8a97df60ff0a0f265f7
        • MD5 SHA1 SHA512 TLSH