Analysis date (UTC): 15 May 2026, 07:28Analysis environment: Windows 10 Pro, build 19044, x64

https://sb.proview.io/prod/Talview-Secure-Browser-Upgraded.exe

MD5:AAA2F04B28969737AB397D6D9FD276BA

SHA1:08319ED4DFEBE7ADF09E97A6139B8B1E51F6300F

SHA256:74E15B77A94C9EA45F46F43797338C617990B6089D1BC3C278743EA7B185F496

Analysis result

Threat level:Malicious activity

Tags:

evasion

Full analysis:Analysis https://sb.proview.io/prod/Talview-Secure-Browser-Upgraded.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes powershell execution policy (Unrestricted)

Talview Secure Browser.exe (PID: 8860)

SUSPICIOUS

Malware-specific behavior (creating "System.dll" in Temp)

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

The process creates files with name similar to system file names

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

Executable content was dropped or overwritten

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

Starts CMD.EXE for commands execution

cmd.exe (PID: 8532)
cmd.exe (PID: 9000)
cmd.exe (PID: 9120)
cmd.exe (PID: 8396)
cmd.exe (PID: 9376)
cmd.exe (PID: 9992)
cmd.exe (PID: 9972)
cmd.exe (PID: 9984)
cmd.exe (PID: 7868)
cmd.exe (PID: 992)
cmd.exe (PID: 8504)
cmd.exe (PID: 10188)
cmd.exe (PID: 10228)
cmd.exe (PID: 7960)
cmd.exe (PID: 7080)
cmd.exe (PID: 9128)
cmd.exe (PID: 8328)
cmd.exe (PID: 6092)
cmd.exe (PID: 9700)
cmd.exe (PID: 9876)
cmd.exe (PID: 10940)
cmd.exe (PID: 9904)
cmd.exe (PID: 8036)
cmd.exe (PID: 10128)
cmd.exe (PID: 10616)
cmd.exe (PID: 8396)
cmd.exe (PID: 9620)
cmd.exe (PID: 10548)
cmd.exe (PID: 8256)
cmd.exe (PID: 9952)
cmd.exe (PID: 2040)

Get information on the list of running processes

Talview-Secure-Browser-Upgraded.exe (PID: 8412)
cmd.exe (PID: 8532)

Drops 7-zip archiver for unpacking

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

Application launched itself

Talview Secure Browser.exe (PID: 8860)

Starts CMD.EXE with special quote handling

cmd.exe (PID: 9000)
cmd.exe (PID: 9120)
cmd.exe (PID: 9376)
cmd.exe (PID: 8396)
cmd.exe (PID: 9972)
cmd.exe (PID: 9984)
cmd.exe (PID: 9992)
cmd.exe (PID: 7868)
cmd.exe (PID: 992)
cmd.exe (PID: 8504)
cmd.exe (PID: 10188)
cmd.exe (PID: 10228)
cmd.exe (PID: 7960)
cmd.exe (PID: 7080)
cmd.exe (PID: 9128)
cmd.exe (PID: 8328)
cmd.exe (PID: 9876)
cmd.exe (PID: 10940)
cmd.exe (PID: 9700)
cmd.exe (PID: 6092)
cmd.exe (PID: 9904)
cmd.exe (PID: 10128)
cmd.exe (PID: 8036)
cmd.exe (PID: 8256)
cmd.exe (PID: 10616)
cmd.exe (PID: 9620)
cmd.exe (PID: 8396)
cmd.exe (PID: 10548)
cmd.exe (PID: 9952)
cmd.exe (PID: 2040)

Starts CMD.EXE with AutoRun commands disabled

cmd.exe (PID: 9000)
cmd.exe (PID: 9120)
cmd.exe (PID: 8396)
cmd.exe (PID: 9376)
cmd.exe (PID: 9984)
cmd.exe (PID: 9972)
cmd.exe (PID: 9992)
cmd.exe (PID: 7868)
cmd.exe (PID: 992)
cmd.exe (PID: 8504)
cmd.exe (PID: 10188)
cmd.exe (PID: 10228)
cmd.exe (PID: 7960)
cmd.exe (PID: 7080)
cmd.exe (PID: 9128)
cmd.exe (PID: 8328)
cmd.exe (PID: 6092)
cmd.exe (PID: 10940)
cmd.exe (PID: 9700)
cmd.exe (PID: 10616)
cmd.exe (PID: 9876)
cmd.exe (PID: 9904)
cmd.exe (PID: 10128)
cmd.exe (PID: 8036)
cmd.exe (PID: 8256)
cmd.exe (PID: 8396)
cmd.exe (PID: 9620)
cmd.exe (PID: 10548)
cmd.exe (PID: 9952)
cmd.exe (PID: 2040)

Starts application with an unusual extension

cmd.exe (PID: 9000)

The process bypasses the loading of PowerShell profile settings

Talview Secure Browser.exe (PID: 8860)

The process hides Powershell's copyright startup banner

Talview Secure Browser.exe (PID: 8860)

Starts POWERSHELL.EXE for commands execution

Talview Secure Browser.exe (PID: 8860)

Uses NETSH.EXE to obtain data on the network

Talview Secure Browser.exe (PID: 8860)

Uses TASKKILL.EXE to kill process

cmd.exe (PID: 9992)
cmd.exe (PID: 9984)
cmd.exe (PID: 9972)
cmd.exe (PID: 9904)
cmd.exe (PID: 10940)
cmd.exe (PID: 9700)
cmd.exe (PID: 10616)
cmd.exe (PID: 8036)
cmd.exe (PID: 10128)
cmd.exe (PID: 8396)
cmd.exe (PID: 9620)
cmd.exe (PID: 10548)

Bypass execution policy to execute commands

powershell.exe (PID: 5008)

Uses WMIC.EXE

Talview Secure Browser.exe (PID: 10092)

Checks for a battery sensor (probably for evasion)

Talview Secure Browser.exe (PID: 10092)

The executable file from the user directory is run by the CMD process

VirtualDesktop.exe (PID: 3380)
VirtualDesktop.exe (PID: 7128)
VirtualDesktop.exe (PID: 8592)
VirtualDesktop.exe (PID: 11072)
VirtualDesktop.exe (PID: 9196)
VirtualDesktop.exe (PID: 10596)
VirtualDesktop.exe (PID: 7316)
VirtualDesktop.exe (PID: 9528)

INFO

Application launched itself

msedge.exe (PID: 7776)

Executable content was dropped or overwritten

msedge.exe (PID: 7776)

Reads Environment values

identity_helper.exe (PID: 7944)
Talview Secure Browser.exe (PID: 8860)
Talview Secure Browser.exe (PID: 10092)

Reads the computer name

identity_helper.exe (PID: 7944)
Talview-Secure-Browser-Upgraded.exe (PID: 8412)
Talview Secure Browser.exe (PID: 8860)
adjust_get_current_system_volume_vista_plus.exe (PID: 9080)
Talview Secure Browser.exe (PID: 9124)
VMDetect.exe (PID: 10592)
SessionMonitor.exe (PID: 10916)
VirtualDesktop.exe (PID: 3380)
VirtualDesktop.exe (PID: 7128)
VirtualDesktop.exe (PID: 8592)
VirtualDesktop.exe (PID: 11072)
VirtualDesktop.exe (PID: 9196)
VirtualDesktop.exe (PID: 10596)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8520)
VirtualDesktop.exe (PID: 7316)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8308)
VirtualDesktop.exe (PID: 9528)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 7504)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 9508)

Checks supported languages

identity_helper.exe (PID: 7944)
Talview-Secure-Browser-Upgraded.exe (PID: 8412)
Talview Secure Browser.exe (PID: 8860)
Talview Secure Browser.exe (PID: 8952)
adjust_get_current_system_volume_vista_plus.exe (PID: 9080)
chcp.com (PID: 9052)
Talview Secure Browser.exe (PID: 9124)
Talview Secure Browser.exe (PID: 9000)
Restrictions-DiableWinKey-WinFormsApp.exe (PID: 9356)
Talview Secure Browser.exe (PID: 10092)
Talview Secure Browser.exe (PID: 10672)
VMDetect.exe (PID: 10592)
SessionMonitor.exe (PID: 10916)
VirtualDesktop.exe (PID: 3380)
VirtualDesktop.exe (PID: 7128)
VirtualDesktop.exe (PID: 8592)
VirtualDesktop.exe (PID: 11072)
VirtualDesktop.exe (PID: 9196)
fastlist-0.3.0-x64.exe (PID: 9668)
VirtualDesktop.exe (PID: 10596)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8520)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8308)
fastlist-0.3.0-x64.exe (PID: 8712)
VirtualDesktop.exe (PID: 7316)
VirtualDesktop.exe (PID: 9528)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 7504)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 9508)

The sample compiled with english language support

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

Create files in a temporary directory

Talview-Secure-Browser-Upgraded.exe (PID: 8412)
Talview Secure Browser.exe (PID: 8860)

Reads security settings of Internet Explorer

Talview-Secure-Browser-Upgraded.exe (PID: 8412)
WMIC.exe (PID: 10660)

Creates files or folders in the user directory

Talview-Secure-Browser-Upgraded.exe (PID: 8412)
Talview Secure Browser.exe (PID: 8952)
Talview Secure Browser.exe (PID: 8860)
Talview Secure Browser.exe (PID: 9124)

Creates a software uninstall entry

Talview-Secure-Browser-Upgraded.exe (PID: 8412)

Manual execution by a user

Talview Secure Browser.exe (PID: 8860)

Reads product name

Talview Secure Browser.exe (PID: 8860)
Talview Secure Browser.exe (PID: 10092)

Process checks computer location settings

Talview Secure Browser.exe (PID: 8860)
Talview Secure Browser.exe (PID: 10092)
Talview Secure Browser.exe (PID: 10672)

Changes the display of characters in the console

cmd.exe (PID: 9000)

Search a value from a registry key

cmd.exe (PID: 8396)
reg.exe (PID: 8796)
cmd.exe (PID: 9376)
reg.exe (PID: 9912)
cmd.exe (PID: 992)
reg.exe (PID: 8592)
cmd.exe (PID: 7080)
reg.exe (PID: 9004)
cmd.exe (PID: 6092)
reg.exe (PID: 10164)
reg.exe (PID: 9296)
cmd.exe (PID: 2040)

Reads CPU info

Talview Secure Browser.exe (PID: 8860)

Reads the machine GUID from the registry

Talview Secure Browser.exe (PID: 8860)
Restrictions-DiableWinKey-WinFormsApp.exe (PID: 9356)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8520)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 8308)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 7504)
DiableWinKey-WinFormsApp-DisableRestrictions.exe (PID: 9508)

Drops encrypted JS script (Microsoft Script Encoder)

Talview Secure Browser.exe (PID: 10092)

Threats

PID	Process	Class	Message
2232	svchost.exe	Misc activity	ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net)
8860	Talview Secure Browser.exe	Misc activity	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI
9124	Talview Secure Browser.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
9124	Talview Secure Browser.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)