49534e847f24fdd727ada248666c5ebbbf7cefff54443df1dd56240cccb50a97

Resubmissions

02/08/2024, 15:17

240802-spa48syhnr 3

02/08/2024, 15:16

02/08/2024, 15:12

02/08/2024, 15:09

02/08/2024, 15:06

02/08/2024, 14:51

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TALKIT.exe
Size

534KB
MD5

bbc3687e84989e3f70f2179ba9a458b3
SHA1

7059147afcd22233c1180fa386414b8e9f8bc10c
SHA256

49534e847f24fdd727ada248666c5ebbbf7cefff54443df1dd56240cccb50a97
SHA512

e66f6881fb5e3f4a7911fd8edfae82f88d4c4089eab2efb180fbc5c0860edd298c85d838426e0ba4cec0d392ae76c470fcb442b9699c841d5919e008e5a5fac5
SSDEEP

12288:Hjv3p0iAiC7vbJPnZRJ49YwnX4P5g2OVs/wZfdjWPb/h9BiyLtNd:HdsNd

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Talk It_v1.0.exe

Executes dropped EXE 4 IoCs

pid	Process
5872	Talk It_v1.0.exe
5808	TalkAny.exe
5728	winrar-x64-701.exe
2400	winrar-x64-701(1).exe

Loads dropped DLL 3 IoCs

pid	Process
5808	TalkAny.exe
5808	TalkAny.exe
5808	TalkAny.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701(1).exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Talk It_v1.0.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winzip28.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Talk It_v1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TalkAny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TALKIT.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	firefox.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Talk It_v1.0.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winzip28.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701(1).exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	928	firefox.exe
Token: SeDebugPrivilege	928	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
5808	TalkAny.exe
5808	TalkAny.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
5728	winrar-x64-701.exe
5728	winrar-x64-701.exe
5728	winrar-x64-701.exe
928	firefox.exe
928	firefox.exe
928	firefox.exe
2400	winrar-x64-701(1).exe
2400	winrar-x64-701(1).exe
2400	winrar-x64-701(1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 1852 wrote to memory of 928	1852	firefox.exe	88
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 564	928	firefox.exe	89
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90
PID 928 wrote to memory of 2768	928	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TALKIT.exe
"C:\Users\Admin\AppData\Local\Temp\TALKIT.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3e77eac-da5a-4b96-bfab-19c6a6df24b5} 928 "\\.\pipe\gecko-crash-server-pipe.928" gpu
    3⤵
    PID:564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f13f7caf-4662-41ab-8c61-602699d5f353} 928 "\\.\pipe\gecko-crash-server-pipe.928" socket
    3⤵
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3168 -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2700 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8209a78f-dc17-4dee-9958-71dd64f5d861} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 2 -isForBrowser -prefsHandle 3908 -prefMapHandle 3904 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83db45b8-9fd5-44a3-8de4-2cc16628a6ca} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4588 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c2ec99e-3bfd-4991-8dcf-6b146d71e753} 928 "\\.\pipe\gecko-crash-server-pipe.928" utility
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 5444 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90204788-66e9-47d2-9de4-372a7bad14c5} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5600 -prefMapHandle 5604 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84498433-3e38-4648-ada5-d5b8bb53e0a2} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:2808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5772 -prefMapHandle 5776 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7e1a32-24fe-47b0-9567-8ab8a44d5acd} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 6 -isForBrowser -prefsHandle 5668 -prefMapHandle 5612 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa2901f-a4e2-4c10-aabf-fb59e7fa8dee} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6396 -childID 7 -isForBrowser -prefsHandle 5056 -prefMapHandle 6424 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ef8afb8-74a4-47d2-af8b-7b2daff0cd6e} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6748 -childID 8 -isForBrowser -prefsHandle 6000 -prefMapHandle 5980 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3902d3ae-968e-45f2-a844-1da9fc0925c8} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6000 -childID 9 -isForBrowser -prefsHandle 6948 -prefMapHandle 6952 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95420938-d775-43ed-b1d8-eb4b5c7ac92d} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6992 -childID 10 -isForBrowser -prefsHandle 7048 -prefMapHandle 7052 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52d579fb-e8e6-431d-93bf-25864c69f195} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:1128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7316 -childID 11 -isForBrowser -prefsHandle 7308 -prefMapHandle 7304 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54c649cc-6052-49af-b0ab-a515db771baf} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7212 -childID 12 -isForBrowser -prefsHandle 7448 -prefMapHandle 7452 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f1e28f2-4922-4821-8b2d-e92e3f695f88} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7484 -childID 13 -isForBrowser -prefsHandle 7220 -prefMapHandle 7472 -prefsLen 27130 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3277ab69-a5ba-4cf4-8efa-5de85b4473a5} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7184 -childID 14 -isForBrowser -prefsHandle 7152 -prefMapHandle 7172 -prefsLen 27170 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d11be4f-a83b-4501-8166-3e2ee7621162} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7412 -childID 15 -isForBrowser -prefsHandle 7388 -prefMapHandle 7404 -prefsLen 27908 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a493711-2f4f-49e1-baac-86aca2a71981} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4684 -childID 16 -isForBrowser -prefsHandle 7648 -prefMapHandle 4708 -prefsLen 27908 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34442e01-4beb-4327-9632-cb46d2c4d334} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6036 -childID 17 -isForBrowser -prefsHandle 7232 -prefMapHandle 7480 -prefsLen 27908 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5e88384-d0e0-4981-8262-81961d3ef0d2} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:5256
- - C:\Users\Admin\Downloads\Talk It_v1.0.exe
    "C:\Users\Admin\Downloads\Talk It_v1.0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\Temp\Ogif\TalkAny\TalkAny.exe
      "C:\Temp\Ogif\TalkAny\TalkAny.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5808
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3148 -childID 18 -isForBrowser -prefsHandle 7680 -prefMapHandle 6200 -prefsLen 27964 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b98d3fc8-1295-4cfa-ad27-f6d45aea797a} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:6020
- - C:\Users\Admin\Downloads\winrar-x64-701(1).exe
    "C:\Users\Admin\Downloads\winrar-x64-701(1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6640 -childID 19 -isForBrowser -prefsHandle 6780 -prefMapHandle 7068 -prefsLen 27964 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d802014-9f5f-47da-b981-89a29d3392a8} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7124 -childID 20 -isForBrowser -prefsHandle 7716 -prefMapHandle 6632 -prefsLen 27964 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72ff3331-234a-4c38-a302-0c0582986a78} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:2696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6064 -childID 21 -isForBrowser -prefsHandle 8916 -prefMapHandle 8920 -prefsLen 27964 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2db83b1d-004a-49fe-a639-3bbd82dc2526} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:2068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -parentBuildID 20240401114208 -prefsHandle 5628 -prefMapHandle 2664 -prefsLen 30498 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac0a280-d7b9-49f0-aed4-a4fe993aef54} 928 "\\.\pipe\gecko-crash-server-pipe.928" rdd
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2844 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5764 -prefMapHandle 5728 -prefsLen 30498 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e67eb979-12dc-45f6-8b54-8385d6420d63} 928 "\\.\pipe\gecko-crash-server-pipe.928" utility
    3⤵
    PID:1456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8648 -childID 22 -isForBrowser -prefsHandle 8104 -prefMapHandle 8116 -prefsLen 27964 -prefMapSize 244658 -jsInitHandle 1216 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31f1dd16-5ad9-42dc-9867-ffcb2f37603a} 928 "\\.\pipe\gecko-crash-server-pipe.928" tab
    3⤵
    PID:2408

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\414db2dc248546e9b8a396e97e3642d7 /t 5740 /p 5728
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\Ogif\TalkAny\TIBASE32.dll

Filesize
78KB

MD5
2cb4f99812841f5271ea9fce41dddb46

SHA1
f4cb27de41b7c4138c1438eb79a4f3468b56f57e

SHA256
9297f69236b296238096baa1e9d00567fc74409b5a7ebe2565da71b27fcdc5cb

SHA512
e256da1350e600707a961ec155d6c34bad21a08fc5b7d8b14defe70b018a1473e5dc1cebe05139b902289bc995953db86139a64e6e0ff06bd62d85cf7654346c

Download Submit
C:\Temp\Ogif\TalkAny\TIENG32.DLL

Filesize
317KB

MD5
63ebdcc2ea86671601af678535aaaf9d

SHA1
680d14d8ad355f542677c1f0ae02d2f6c7b08ba9

SHA256
4e261dcdf4eca118cf75c39b2f52d5b00888de820df9e4e868183a039f25e98b

SHA512
d105a4cb3e40bd1cbf18bf60335df54bc7b1f78a6af236bd1acbacbe2e1268b98b3331edae923a40b7db3de2393cc20e5209258b126116234dadcce1a4c203e4

Download Submit
C:\Temp\Ogif\TalkAny\TISPAN32.DLL

Filesize
65KB

MD5
1e522006e572619dabe8713ebc83c27f

SHA1
b7a574f6763c405cac18d5930d4538ccf70d3824

SHA256
ccc3c0b35b42ef40e116a8ba5e6f40c1f303e00f6d6c31c9a9eac5994b1d5294

SHA512
7451e0de0c38709e965f473e5b721ef40760955cec58659abc5d60d2b6e8bb28b0fa15bcacdc194fa412563c97b6150c5708fdf2ec198054a48a212386b47ab7

Download Submit
C:\Temp\Ogif\TalkAny\TalkAny.exe

Filesize
534KB

MD5
bbc3687e84989e3f70f2179ba9a458b3

SHA1
7059147afcd22233c1180fa386414b8e9f8bc10c

SHA256
49534e847f24fdd727ada248666c5ebbbf7cefff54443df1dd56240cccb50a97

SHA512
e66f6881fb5e3f4a7911fd8edfae82f88d4c4089eab2efb180fbc5c0860edd298c85d838426e0ba4cec0d392ae76c470fcb442b9699c841d5919e008e5a5fac5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
e0757d5041bdd015dd5737ac46c3abf0

SHA1
5277905edf24cee3ea3ae7d0b852438608fafbb9

SHA256
4ecc805ed3a49e81a79604cdb9094fb215fa7ddaa9bd1ee504c8eaabb4030b93

SHA512
82af571712767c613940a76270de6ba712895c3c71c7712c3a51747d77339738c1f28101fb296cc7871d8bf1b08c26d1c8ac3e20e5769869c59d98627a0bec33

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\31437CA209B7D6B90E5127855ACE0EE9598F4BD6

Filesize
124KB

MD5
3786c298095de1bf277224928214e4ba

SHA1
8d43e5496ce2be045da34f4a98ca4ed477bb76cd

SHA256
6f9879a5a2c2031eeb14ff5bdf73437a4335407446c575bc506ae87bd705c3ba

SHA512
a7e3ce1c0d177b37b381ea30db0db2d5426525cb82b214e39883cb73fa4345639d665050ba47579cbd7c6c266fe54ff18e5afd12ec7dac18adb3dfffc6ee46f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C

Filesize
38KB

MD5
001af0417d305f9a8bd2a1217cffd184

SHA1
a85fd01b74905493d22547d1eb58886f33347c05

SHA256
78ec8b33d3e79251b45ea35657378cc52da01e594965c48af5d5a2227d6a3a55

SHA512
8232b6918e789a3894687f0d593a632a7935d17642c9369714be2019a2a2cf684019da1c800fc6029c9d64f069d9bcc087564453739bf1220032d9f9ac2cbc82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\874F18BED7CB5132715B8A78AD866AC231B4B3F3

Filesize
17KB

MD5
f1b6cb6345acc7359990357c5f5125bd

SHA1
1d83556903dbe77718d917d8817920c47d03f135

SHA256
c5ac9d8ef916207649df9f634d0469a3827d846d315804bc34070dc6c5e4ab1f

SHA512
1fb6387ef6f88eb6981608465a86f56f10cddd981968887791b8b4a9c8cef15440da0ae751a521b09b4d9b20f1c2584af36859c11e3496c4267a33570e8fd9b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\C002EAFCD02DE6F8ED976CE9BD3C8BC6512605EE

Filesize
12KB

MD5
d0c474739fdb70a7d4e5811f68034c0c

SHA1
b1278b44b2b8a3c9786e6a7c48bf46b3b0412703

SHA256
1d09786ab3360e7fd4f9a52e5a6709d81315a421981d6a89ae172f7c36e5a2f7

SHA512
b39bbd2d3a963d7ae5ed84b7d6940718f3fd4a06689d3b9440ad69d00907b1eba4b1ca4bd40f99276e27372302f91d7312730f1d943ac797cebbc106a6580b04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\cache2\entries\E045E2D58F69E1BCA63CE2755C00433DE746F8BD

Filesize
14KB

MD5
627df2ee6016ec35fceda5317e0f7469

SHA1
7f37da638b9b193d92a57ed7a2b1dc0f6678123d

SHA256
0188d20b7aa82f3da092d44933201f012c0a54883cb7ba71fa7e107df37328d6

SHA512
b83585d41b93565b1c4943965bc7798053776ca2e13f55fc803a731632643dba58a9c0c01f7ba4033f5b1e7dd0a429b756ac9fca1161c42dd076de57349c16b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\AlternateServices.bin

Filesize
8KB

MD5
1210390d9f0a207fe845ecb4aab70a22

SHA1
871a3193e069b5550ab9699e24daf8bd1264e26d

SHA256
e69bfcab3816515f37023a34b05d313a280caae8815670881884b3e9259a1919

SHA512
f1ed09d54c58343c4fbcd5bb417e1377d27ea69570442ce02198a4ef6065063ebee2de9973e66af0592c8a216eb2f191ab0c072108b88635def31f828c100432

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
e86cb4aedddfb64b7e9fb306f292f0c3

SHA1
62805322a804ffaafea5ba5cf99536073da914e5

SHA256
5d04d1adf926ac7028aee8695b7e5dbdbb9548c6489836ab2effb64d89dfaa97

SHA512
ab0db3cb5733b6ff05b273c8dc9b2722553588821da193c8bea06137a0277e79f814fc59ae882d3102869eefe05a7bfabf14b91c91687880706536ea9a1de83a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
f801ec3805b7817b4d071f3e780bae5b

SHA1
48b58495606d17892f1b5ada8e95a1e08a9ccedd

SHA256
50eb99e0fe7ee8d33614df334925fbebd5ce197dbabcf355bf108a704a4a91d7

SHA512
f9cd259983126cc1546539415096d51161787b2beae7dadeb5e76439c2a6eb827b5f2356a9bea3b738eb884d47ff26821007b3ceb5c3b26e878cd1e46f08a9af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
ea59f062d5336705d70240e2fe160b7c

SHA1
33da62e2ac022d35a87c7f9e3d50214e9e6d9e21

SHA256
3c2546d167cb9fd12a715fad55441ade3e44455423d3b8b7ad5c4a9418d8722e

SHA512
eda2e37d99a5eb15e28bfe922e8fff1138b5376682cdb05e6239377066f2d607bda08e6f04f6a80f8157a7bda546fe9a8f629bcf3db1f8e142dbbb281c1fd431

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
9c25ab8fdc14409c9a1ccd33cae41593

SHA1
c2db665f2a63e621badddea6efd0eefbc8b0ba7d

SHA256
3c119e4362ed7210d8b1429ba4c5e23034caff1e6a366af0742bb197cfb143a0

SHA512
1f95fce2c5e45510c5db4c19bed38be205b3d00c4148d34ddf0ff9ad5e48d142b5014a21854871257b0f968ceb6bab6379149e743be99b3d7cfcc9525db8fa84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\0c47395c-2896-455d-a6d1-0602baff3db3

Filesize
982B

MD5
73f2e9cc3836747b808eea169c88b7ba

SHA1
3210b6767751fe5a58e508456feb7ec51be73e76

SHA256
0cc4a81cdbd4e6b2a887222115e43d9d71113877c4c6ea43392f4176637c03d8

SHA512
9c29ec5ce475a02c3725cb49a5960d6e310015294a3df56565c6a326dda0914ddc1bc7e9a79e45ae48798d85ec660fe4b5a69890e18f1cbd806dc2a73da297a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\datareporting\glean\pending_pings\11487456-739e-4d45-8344-3aa12bf17f82

Filesize
659B

MD5
f2cc2d26c5693d9dd41da13b3ec48539

SHA1
b367225de4b0f62470b21e24428faa2283b7a7ac

SHA256
bc44d8592bf560bfdbc47f39ab44af3cb0c04f31ae299bc6ababf9418a50c426

SHA512
5ef25b657c8867c09b54457498f8403be31af2a6f0892eb321b133493251cb802f2b770139b37852fffaf9ce08c9e2891e41dec4498f88444df4bd11e81e9490

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

Filesize
11KB

MD5
b1b1f379bb73ebe62b9144a708bb3c7c

SHA1
d7c88690d810b6f97a72f06fb4ba25c9cbd50ce2

SHA256
f4d7b8efa68bad67f798d76235f4c5714c8a3b379c9133f30d7d5e6a4caea118

SHA512
8957c2a99a9f12146162d55a03f34acfa693a7ef5824b22236dccb641af02e0f81f4efff965bf0d2537c4d00cd64b4d73f5b41bd3f35616384355fd904236721

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\prefs-1.js

Filesize
11KB

MD5
6a6aa440894b7d5e1fdc98874d0ab075

SHA1
de31abc7e57ef181f86022e8c1bd6e24e79c42ce

SHA256
0d4364e8a49552320eb7eac11709ee17250502983e45936029d1a321e2f8230d

SHA512
690608553fb6ef9cf71c5500ea41628eef9e1946b217a7094a47979bbef74c58f313cbbc7b0747b739b0b133a2016867df7b7ca15276983ace65b720c54e110f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
edfcb681ef634a3fbc82038cf35d6a0d

SHA1
031ca1d110a99c36238a94318caeabcc1412ed8d

SHA256
5bfa18b4583028edc616a4e9e693a57210be5c61c6b42d0a4d627858b276d414

SHA512
ae36ce6a4091604875e37bb72372fff576ea1d3c396bbf80ba31bac72f98ce6e97c4be4fe0c1aef269eb4fe48bf06a09fc8117fa9b1a843ac4b9d4af64476556

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
666dff1b76278f788d5009864f6f7841

SHA1
0333298abcf73c3ba7c9a6597ff61f90e3f4c93b

SHA256
29dbea5eedcd22bd177d03da0acc78cb579ba07f162e4f6dfb4934077c1d2014

SHA512
ce92ebde4d9d8b92c28dbaf70f1f592459cde0b0c300aae4e626ba26621c9bce60f8ea6cd1f0620e1c406009fec9ee815731ed41deb05e4f06b2c4da3d61553d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
cfecc69255cf68c614e19c925549eeb2

SHA1
961a45240b1e741473b10e6d3eaf791dd112c0d9

SHA256
c330c0f909c22e8c0e38f420de2e1f15f31de7c0572f6a1906e4e0daa0d1faed

SHA512
78e9ac6d4330999cc196612d0f51e1e4a612b5f92bae8741efa40e3a49f85f716a3ef690b6187ef8270ccbcbac7deca6a8c73f9da6fa078d97f2d312fbbd7c08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
fa4ea24c7a9bac2441e3486ace06e92c

SHA1
f39fb06e8c6e309f9818a5ec0ecac8a7627a0327

SHA256
bc99eb431bd042aadacab3681391c4f8da9d991032b6b36f0ac8313f63bcb722

SHA512
717759cf8ddd01e3feca12813a8fcb283893baf4edb54e9e6ee7d0869ea681db8e79d4c1eadefb36f25f7faf0a9db4433d1999fd81f7061c990ad29cf0bbc396

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
fccd49f1f7996ee165742282f323ab3a

SHA1
4ae0db08ae0ab241221b5a33093576e3498f7a0a

SHA256
8f077e46cec0e4e55b3fc3a316dfb7d07974dad081c8b18f53ea54182a595602

SHA512
01ba2d20a076079c0a24cf32e7ddc04df7a15e34aef88c78ba95e0cca7560ac778f87ddc61b36dd93f6fe54f0e3a0325b037e33ae571da55a483195e35b3e02b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
6914796335bb1d05a3640c64f0bffa82

SHA1
368e97b18b688ec3fe42d4eb63d42e02c7726987

SHA256
3bfa201bb50bce3febe40ce0dc8e6fa2f9081e859071b2b7f6b138948ca48a35

SHA512
8c2b8a2947252fc1a2ae7f8533dcc95927680af74d7dd1f79c84a5224321deb8d790901274960484ce99f187e29eb56dfea533ac7e81a596a40bcfda80b99812

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
f4e5194bb566cb7381cade91b0f8173b

SHA1
deba25cdbbd0de6766cd0ff30c1052b88c99b7c7

SHA256
52f51a7f0cbc7ff114dbdb4fee650251d861e6c168a75f0f2ef7b7d2a29cfb72

SHA512
2c6e6764f9f3cf5acb629c7fbbfcc82d339cf9a30fcf4e4aac8174b762030ea39787f5e515cd5e5047c7c25cfb77bae4e958189f0a456399d1f0c3d2b267fad0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
0d03bd76d36d7a36cd085622405d8c31

SHA1
28f058962b89e7a36adaeb63fe252a551922b015

SHA256
0d5a1e547b58a9a7c045a33bf62f8411680a54023c4a26ec9ec63e04f3d03cce

SHA512
e136746f5d6e7999019de8dd313801b0bed5f7fe2361d305b601da3aef9ff3f7f1c0e81e9f8fbaedc6dfbd2ce2f200a13c5d9eb09ed62ee9f68fa7a351e10d45

Download Submit
C:\Users\Admin\Downloads\Talk It_v1.5FMBXEo5.0.exe.part

Filesize
380KB

MD5
fdc726071430ada68e117f6f12f01322

SHA1
2daa8755f47713b00c1dbefe7d9c8e4c5690518b

SHA256
2bfc1657c918035fab5fa2da8e4e76d54cf9b65ac1e65dcdede65cc19a6771f6

SHA512
a5cb35ea0e5c6bb4553d258bcad76ea52db30370e84a065d6ca4e2924b08e6d2af85f6cde5dc99fc7c4e4396408a4fb390e2401026ae9698c1fcca3380f0aaeb

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701(1).exe:Zone.Identifier

Filesize
171B

MD5
e6556655a7d88a93605f5e6af98def56

SHA1
498d46d1d2914dfe2a50efd0aad5b964d51504da

SHA256
18f8507ecde6885b7459b08c573e3cb35c35bf700bebf4d8fa5a04606b929d03

SHA512
d1c74f4e9ad54d3b72b98cdcf0e07f73e3fb8aa7554473d112e4c9d2a00bd2e3571ff74608bb208348b8b5781629095b51a8379921a07bd20dc89343e41110c8

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\Downloads\winzip28.exe

Filesize
2.8MB

MD5
d7c6ccf487978c2eab86dae39ff98c5b

SHA1
2a045647b18fe9529952f0459b0daaea6c1f65b3

SHA256
b8d96793563a92e2f42886a43ae767280308451c435fc27838b50437676bacf4

SHA512
ddbe28d900cb989dac64add8b99f5488c702153aeeb527283d1618f905ab6b0a26c56a61a62100cb6afdee3297b69a99e83769eb3177a91df661298551042116

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads