f9f020ea4525d6f05b27c183b6f0900acb7c03f1ad8c7013135f24a4d0e76f2c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe
Size 8.0MB
Sample260709-sbm7mscv6n
SHA256 f9f020ea4525d6f05b27c183b6f0900acb7c03f1ad8c7013135f24a4d0e76f2c
MD5 2d594ac17f3c29db7c9230290c849bd8
SHA1 40e2111ac34036e9329648f348f589c4c04e7871
SHA512 eb2e3b0f165124de48a8cd640bd09ce766e76118b7bd57edd51c8f8d10bc242253ac473f77de0a638dd92a961cc161b6b51297fd028f39121afcc37b5596adba
SSDEEP 196608:U4Dq00t3CXuB4659cLegVsEW8lPF+Slyzhr:vD03/59IegVNW8lPF+NzR
TLSH
T140860241FECB42F6C88F0C71602EB33F9B356D064528C797EBE47E15E87535058AA26A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Executes dropped EXE 7 IoCs

pid	Process
3656	Hybrid-Talk.exe
5632	Hybrid-Talk.exe
2552	Update.exe
5464	Update.exe
5764	Hybrid-Talk.exe
3788	Hybrid-Talk.exe
4420	Hybrid-Talk.exe

Loads dropped DLL 5 IoCs

pid	Process
3656	Hybrid-Talk.exe
5632	Hybrid-Talk.exe
5764	Hybrid-Talk.exe
3788	Hybrid-Talk.exe
4420	Hybrid-Talk.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Hybrid-Talk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5348	2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe
5348	2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe
5464	Update.exe
5464	Update.exe
5464	Update.exe
5464	Update.exe
5464	Update.exe
5464	Update.exe
760	msedgewebview2.exe
760	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4856	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4420	Hybrid-Talk.exe
4420	Hybrid-Talk.exe
4420	Hybrid-Talk.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4420	Hybrid-Talk.exe
4420	Hybrid-Talk.exe
4420	Hybrid-Talk.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3656	Hybrid-Talk.exe
5632	Hybrid-Talk.exe
5764	Hybrid-Talk.exe
3788	Hybrid-Talk.exe
4420	Hybrid-Talk.exe
4420	Hybrid-Talk.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 3656	5348	2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe	88
PID 5348 wrote to memory of 5632	5348	2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe	90
PID 5632 wrote to memory of 2552	5632	Hybrid-Talk.exe	91
PID 5632 wrote to memory of 5464	5632	Hybrid-Talk.exe	92
PID 5464 wrote to memory of 5764	5464	Update.exe	93
PID 5464 wrote to memory of 3788	5464	Update.exe	94
PID 5464 wrote to memory of 4420	5464	Update.exe	95
PID 4420 wrote to memory of 4856	4420	Hybrid-Talk.exe	97
PID 4856 wrote to memory of 4136	4856	msedgewebview2.exe	98
PID 4856 wrote to memory of 5760	4856	msedgewebview2.exe	99
PID 4856 wrote to memory of 5760	4856	msedgewebview2.exe	99
PID 4856 wrote to memory of 5760	4856	msedgewebview2.exe	99
PID 4856 wrote to memory of 5760	4856	msedgewebview2.exe	99
PID 4856 wrote to memory of 1640	4856	msedgewebview2.exe	100
PID 4856 wrote to memory of 5396	4856	msedgewebview2.exe	101
PID 4856 wrote to memory of 5396	4856	msedgewebview2.exe	101
PID 4856 wrote to memory of 5396	4856	msedgewebview2.exe	101
PID 4856 wrote to memory of 2424	4856	msedgewebview2.exe	102
PID 4856 wrote to memory of 2424	4856	msedgewebview2.exe	102
PID 4856 wrote to memory of 2424	4856	msedgewebview2.exe	102
PID 4856 wrote to memory of 2424	4856	msedgewebview2.exe	102
PID 4856 wrote to memory of 2424	4856	msedgewebview2.exe	102
PID 4856 wrote to memory of 760	4856	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2d594ac17f3c29db7c9230290c849bd8_akira_amadey_blankgrabber_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
  "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe" --veloapp-install 1.0.0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3656
- C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
  "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Users\Admin\AppData\Local\HybridTalk\Update.exe
    "C:\Users\Admin\AppData\Local\HybridTalk\Update.exe" patch --old C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.0-full.nupkg --output C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.1-full.partial --delta C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.1-delta.nupkg
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2552
- - C:\Users\Admin\AppData\Local\HybridTalk\Update.exe
    "C:\Users\Admin\AppData\Local\HybridTalk\Update.exe" apply --package C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.1-full.nupkg --waitPid 5632 --silent --root C:\Users\Admin\AppData\Local\HybridTalk
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
      "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe" --veloapp-obsolete 1.0.0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:5764
  - - C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
      "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe" --veloapp-updated 1.0.1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3788
  - - C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
      "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-background-networking --disable-component-update --disable-default-apps --disable-extensions --disable-features=msSmartScreenProtection,msEdgeOnRampFRE --disable-sync --enable-features=MojoIpcz --no-first-run --mojo-named-platform-channel-pipe=4420.2748.14652751183535323910 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4856
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView /prefetch:4 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb9c495fd8,0x7ffb9c495fe4,0x7ffb9c495ff0
        6⤵
        
        PID:4136
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,11935818987196751392,18231827670240778393,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b
        6⤵
        
        PID:5760
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1752,i,11935818987196751392,18231827670240778393,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b
        6⤵
        
        PID:1640
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1752,i,11935818987196751392,18231827670240778393,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b
        6⤵
        
        PID:5396
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1752,i,11935818987196751392,18231827670240778393,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b /prefetch:1
        6⤵
        
        PID:2424
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4436 --field-trial-handle=1752,i,11935818987196751392,18231827670240778393,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:c6fd078f439fe14db155caa47a6c98ec3afb360b
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\HybridTalk\Update.exe
Size 2.8MB
SHA256 c6e869968d0313f1a8452a47e3f90643a42f29b04c34edc9caa57343a36768d2
MD5 93141c2724541b0f22b1a6c65bed12d6
SHA1 1320e5cb0d00106bc5d284ea5691a7493be6d0ba
SHA512 4e8ebd678d1fba88352cfa7b7eead36d42ae3bd5d29cf1cf7d16fa275e4c64a99a8b32c89043b7d3ffd292984049f008c3786b3c2bab8eb2879f416d00b19f99
SSDEEP 49152:0l4gaDleSQ4edhOQpz31sv7ti7CBIQ/ixlQwT4X1v1Y2Sx4q/:0WDoSwHFOtwsoCwT+v1Y2Sx
TLSH
T1D0D59D41FEC782FAD48F0CB1602EB33B9F396D064528C7A7DBE47E01E87535059AA15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e2cb23a1ce744efd227c3e26307f2a26d72f00286106d5f8ad9a51d097766de7
MD5 7239e18ab8b9daccc4cf24fe86607322
SHA1 276617efc178fd7990f3c80c686815734c1fa3c6
SHA512 faaffc18f235859b2bf12bdf9ecbb984b39cf17792f94bba2286d28737ddb27c78a2fcc9d295fe7af15c0338f31d2f30c2edd90370f90a2642f9c523de7f3524
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5ce2732e5d18cf7d322ce6d79863b10f19f7a4992e5ea97f56c413454607e831
MD5 d3bdcf0b70811c50153221b39d13627a
SHA1 a2d5cc2b8c0c04b17076ec351d8cfcdf65eabab1
SHA512 8cf6e02125e46e7eaf4ef30ae795960532630f64b61ae4e6e5a7d096343a1000e1ac08b656564e5775d2ec345c4f8b286f773d85cf438dfce78f62e2745ce1da
TLSH
T12FD0122A76021A74C0102473116262980400F11B41164180942C855D2E140603A02891
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

044b0509-b10c-4be4-ad3d-66ee6085b269.tmp

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\044b0509-b10c-4be4-ad3d-66ee6085b269.tmp
Size 6KB
SHA256 10542d9b1dbbbef16dba8cf96de4bbb4d21cb1312780435836da4ebfde5b1968
MD5 8e8edb7382b95089d680f79b151ff113
SHA1 dd580410646ba13a0f8e25a913dbd324f33a7b24
SHA512 2b96642c27ab94c743089745c6ac53a280bcaa4a58eb0991af9daf8ced600039da0d6c72eb14bcd4e5171362f01e0abcc3bcc012a03cbae51337744b91fc8070
SSDEEP 96:stbT/dUZT6b9ljkLo5h16ZJks7/x+6Mhmuec7rI1ejeFK+g028XM1C7K:stfiAjioKksV+FfrIQj3iG6K
TLSH
T1FDD1B6025E28AD7B4CC7F119BB39BA42E2F5607276D12E58E7F8461C14DB6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 5fe7da56eb3688139bfc95507c881cae167a95a904b2b3d497138ef5fd71e25f
MD5 7d07ebcdcf07f3a5789b04b111a8c50a
SHA1 81b436f2d2dc6d6284aa335d1b5ce6607df6eb86
SHA512 66176656583437c60e39eb67a30c819f435b87361aade8c545b6fa25bd2cff992b78937a1fc069b62112c5a229f93baf04d44e78b663f2e54b69a0416eac65a1
TLSH
T1B2D0CA58030088E9C354027BA2C920CD3AFC88A8104B1F8B894D0C798F53F648EC2ABB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e6eb.TMP

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e6eb.TMP
Size 48B
SHA256 8f72ad2dcd0ec5087af8eec5e2eca8ad68781589e194afd014c4d005e2cd7608
MD5 7efe8f4e21a13a7924d22fa2b8ad1b4f
SHA1 31a497dccaa4470031238ae72ba8ba3c67ab4ef2
SHA512 fca2795e59bcbd7681119833fa28bd1c65c026d3193c42309353029474dc437820dd8fb0fe843ef7489e7fc5ff0bd3c65090077323663c1a08ac78bc37ac4435
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\Network Persistent State
Size 225B
SHA256 58c189c178367cadc55f57f000163cdca7aa9583e641d60b1d7ba5917d097d2c
MD5 c0e7488194be858affe47f6df90e13ed
SHA1 8b052f42f9c54a63afee17ee7738c2cb44175c24
SHA512 8d28aa32c68a4221b722b0095b736830600226e71df735481c602ee0e0e8748fce1d7860c5be8fd575b245fc24642594d5c04c6ffe533089ad9abec566027913
TLSH
T119D0A7BAA33059FF578583B414246917DEAD0412831C5A69D5A4377683B20A89028D57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9fac.TMP

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a9fac.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 49190021a79b4630222820e25b1b760600d4cd728186c4ef734f80d216d29d5f
MD5 73e9623a7516b473b22e81e4b3669fb2
SHA1 83e5d321663807e0a29425bffe8fdbec64b73357
SHA512 f1a72d294b2bd443a4dddd1995533850941693c76472225548233b8d1ca357775b25263aa93160c300b181c2d7f914a6b973a39857d4a11c1682578207120808
SSDEEP 96:stbT/dUZSG6b9ljkLo5h16ZJks7/x+6Mhmuec7rI1ejeFK+gb28XM1C7K:stfiujioKksV+FfrIQj3JG6K
TLSH
T106D1A5025E286D7B4CC7E119BA29BB52E2F5607276D02E58E7F84A1C14DB6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 60a887157bc49dffeb5439ef078e5454f409ea5c0f1383279fd2ca1a38999943
MD5 a0d400712568967f52727165190b9571
SHA1 1f281004e814bf981ec5006b54423a693ffa529a
SHA512 653a82a1ffbc27a0c679efb2ce438d83e37d631689255c3ad40913bd4b632cffeedf798da82bf8d4595c4e21d074d142f2f97068c06d738c376bd350a0e0fb26
TLSH
T11C81A737A474A9774DF3990579822B52AB754077EAC57F95DBEC0F0C01DB2881753823
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 2KB
SHA256 dd3f0c86945ae16858f4bb43b3ab4308fca5386cd5e201e6577aa8d34230def8
MD5 6532df09b8b67d889c9a873836377f5d
SHA1 0f49a45b5c359b3007a75093335d92d8bdcb8c87
SHA512 c4ee0ae29ab81b1a5b64d4910cfec8ef7093caaef5c47300b5e7aea4eefdf5a919c28a07c7117666b3e5817521dff98e72de56cb4ad5a0d7e0176980dbd0284d
TLSH
T1D651A633A8146A7799F346097A867F62CE3A40A1AFD16F10ABDC1B0C01DB50C6B57C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 d749ee76afa7ef6c87df98d0fbeb5a331cff471a2b8fa78a3b7a794f5f836086
MD5 edf5b591b40ed5292b2244cf6c463aa7
SHA1 7fff8a37fb27ea23f3425533f8ba97156482935c
SHA512 98a26dbd4c7d7dddf375df044c9261871bebf86560ad2c8bbb4607ee2c51f295615cb6b4a44b202b001d048a03ca135a7829dc657d0b40ce65abd18314ef87a4
TLSH
T17771A637A864A97B4DF38A097A862B56EBB54067EAD17F54DAEC0F0C01D724C1753C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 c404987a6e977b677db48e35fefddfed208eec9bebf6c94b37487df3bb8ee503
MD5 7f45454d86e5e27f0db72308cf42401c
SHA1 16d412cdea4192b3360f5ea3ea781682dc95b6ad
SHA512 7bd7b36e544823b567485306b8001993e6f3f51a2753a4dce6c21cb73afa326fb42d1cc1f2815f338768239eb84299e4bede8d02f939219c9f221d3da17bf479
TLSH
T11D819537A464A9774DF399057A822B52ABB54077EAC57F95DBEC0F0C01CB28C2793823
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597eea.TMP

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State~RFe597eea.TMP
Size 1KB
SHA256 62380dd7f16ae2420bfedad8fd1a8e232701adc25bab6f8e14b717af6d120641
MD5 664ce32f04e285b6b14d02d196374a2b
SHA1 c8b4869df6003ae8aad7b1e8a809aeda316a37cc
SHA512 93d88deba25cfeedaa4d7ee1c48ab6203afc35326217ba3638304802331cd6887baaccab02b6b59816eb96d4395ea287420037e45226891b6b7f79237ab97400
TLSH
T128317273D4A45B766CA656473342AAA78E3200AA87909F0077CC4B0C16EB04CAE7B832
MD5 SHA1 SHA512 TLSH

Submit Download

Hybrid-Talk.exe

Path C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
Size 7.0MB
SHA256 b9bd2ee3280bc316221b95cf3704fc155a17698ede4c83aaa607c5ca76ba7550
MD5 3c5986827c270af3b5904d07af2ba34b
SHA1 cc3ea8406fdff8867c41534d07a0572bac758c75
SHA512 0361c3b1901f747f3645252464aeba42677cd3eb238cada3a0a3b82b930961a75bcc4029864888ba266f96319e0864a6bb8842576e0e484a9ca7935c23191c91
SSDEEP 49152:Uho6InSWoEVh+zDg4Z5Db6hpiC2L5UpJjlGo55gVnUBDZFZN/3GhNt4WoCIVmtfn:0X9WoEVh5pqW5edZFmn+/UXeg20v1Y2s
TLSH
T12A760907EBAA50E0C0BAC438C657A63BFD7138A6533463EB56915A171F36BE0E93D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hybrid-Talk.exe

Path C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
Size 7.1MB
SHA256 0903ff1a75cc2faa79b3a93069d8c64742d7eb848f03b1e95016879957020fe2
MD5 b3975c2d671ba92e973d30b948c919dc
SHA1 4385c4c10dc5a434e8ab29baf66ffcfeb6ba0ed6
SHA512 92814fe18b0776f78bf57c4c1e31cb80a151a0a0c8c101c723070cba82352eef5af8e2d79acdfc7066941c7092e3992fb657da3208439d89626f847d52bdf100
SSDEEP 98304:2xKFyoZjIvj0qXM4+GHwaDUn+fE9nxGtv1Y2g:6KFng+Ba26axgg
TLSH
T18A76090BEBAA50E4D0BAC438C657A63BFD7138E6533063E756819A171F267E0E93D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\WebView2Loader.dll
Size 157KB
SHA256 86545b66cdb0603bc26b626fb9ad610cb6e71f28d468f5ea66df23b03dda96d5
MD5 ff3ab627947e2c1c58f13694a8651c7f
SHA1 280e4cb1c735b3ee7cfedc82a5bfe7c134a89d90
SHA512 45a167e90716a08abf79f76fba42681cc8bc76f0087f62d028350c5d28e79b922dc1bc799b0dd0a086e7add20c17b9bd6a355674d7f1b0854f217432e4c7d555
SSDEEP 3072:lKpb6T599mlMpgeMiqa5agdTl0RflJGhaTcZYEtJomT+JJg7yl:uGf9m9XkagdTlMvEtJKJg8
TLSH
T10BF35C57B3E510B7E07BC27485A34A42E772B81157609AEF0364467A1F23BD0EE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ini

Path C:\Users\Admin\AppData\Local\HybridTalk\current\app.ini
Size 300B
SHA256 827755d46b93dccdc9b10176880b814229703cfa70c63a379ce2345bec8ad3d0
MD5 a2c2ca1d5a09d323de44cab65864bcbb
SHA1 c08d5e070b87df8948bd4a140444f222ce6fddea
SHA512 7e0b2978fec024ed1375d79c984237b707adbb762698baa89ab236da966715ff8939b052b01481522cf49c87c5791c23eeff987cae4959714011d7a0c4b145a9
TLSH
T1B4E0125027F60018B4726F9AFDF55097672976112D11D85D11C2130E00F9B41E5B3A3A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.png

Path C:\Users\Admin\AppData\Local\HybridTalk\current\launcher.png
Size 31KB
SHA256 27d017c8b22aedeba93ed3ea4d8a587db15e64028ae7305e79a9f96ecfbd6b22
MD5 1a26e7ca90585570dc21ccb5f6dc990d
SHA1 d79c98a4861283c3fc921754e3267a75c61335ee
SHA512 5e26f7b70ca6da5c2b4a52780f504cf6bdbcc06ed62ab367df014394ff4a5eb4306233847dd5da788a012e4053ebbeb4fd436f93b7f610a7a8b86158c0e78041
SSDEEP 768:exFg9SRFMn8eZcWrtZ39MIgrrzlevurSn+KbUVfU7f:eHg9AVByL39MIg0urG7f
TLSH
T17DE2E10C38BBB90E1373E15592356C142E71BCE676F39265AE1948F0874DEDD806B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\HybridTalk\current\sq.version
Size 596B
SHA256 8d1f3fc97b7a4fe0042e505b157f69341e2af53d25d464c9fbc1b9ecfeb55ad6
MD5 cd677d2e217ae64cd06515a577794a1d
SHA1 20d9d64b85358a3ebc3fde28fa623d2f0ae51606
SHA512 584e602c0bc1e80d7969b7fc944b1a52b209cde3381f486c2d5a021670d8f7158708b8170de9fb196ebf181e7a47855199bf302cdd8ee4ba8b8a101ddb994b1d
TLSH
T1DBF0E1C6F540DA079743674AA8C80310D3FB7BAD24C28505EDE4DCAD26893DACE7E6E5
MD5 SHA1 SHA512 TLSH

Submit Download

update.json

Path C:\Users\Admin\AppData\Local\HybridTalk\current\update.json
Size 138B
SHA256 eddf78bd06c89f9048d8e5c8eddb02063fda44b26855b316bcb3cbb34de520f8
MD5 cdef1080719f29c206b2ffac5139701d
SHA1 6ff9592254f7e45f96b64698df546a1c0edd5344
SHA512 882729853ab6bd177ec9a0765e97b3e52b7218e03cdb4e57fabf9532d381f6abbf29d5a0a5861489518c789533eda7a73d9ae85609b63bc09628dbe684f85d03
TLSH
T131C04C9AA948C8B61DEC9DC94182E768F7834E39ECF0166581930A94515C171565C58D
MD5 SHA1 SHA512 TLSH

Submit Download

HybridTalk-1.0.0-full.nupkg

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.0-full.nupkg
Size 5.3MB
SHA256 c62f7cb4332f7aa24577b3305fdb47b31e211ac993057f050a228327bd7ac3e7
MD5 18bdf5c04df88ccd9108b1af839438a5
SHA1 27ca41d99e53c4152b7dc9d951ae14448c23acc2
SHA512 dbb263521417ec4c650beb9ab667de860ef51f987e26755a6ddadba28ef713fcb3ba645d75943818b51fc840af7afbdd560fcc99a3cd11a93e3fe97a28a9d1bc
SSDEEP 98304:atjoFF5s09G5fh9cL9WqzkAPv8z7gkZosqnO+DQoVJlylXEDvFFNSdSA2yutiDho:aB4659cLegVsEW8lPF+Slyzho
TLSH
T1B04633658C3271D9241A9372F89C7879F022E2BD9E77024E0812B75DB93C5E8FE95F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HybridTalk-1.0.1-delta.nupkg

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.1-delta.nupkg
Size 1.1MB
SHA256 40f775d02ff3daa35aa3d8541f2fe225fc96a55b719e5e6fdeebe10fc81f541f
MD5 5752bf651cd41cf781490ed264332663
SHA1 556043fc361bb0e24928f45ec0ebd283c7efeaf3
SHA512 41eb4902588eab3b8e1ce31e7f98af63a60d0f90c6f41b0f5d6f46a58cffb9acae22f6720a12bd1b20b075310e53beefa70461e56e4cb5a285457226262608b8
SSDEEP 24576:XyGjmx3p4imA6uc+iB8jIDmqd8STbaTcnM+okEbNn:XtjC4if1cfOfST+TcM+ebNn
TLSH
T1333523F5E5AC713DD8B9107EA2689E96601322F930BBC7DDB0C250552680A3EF548D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HybridTalk-1.0.1-full.partial

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.1-full.partial
Size 5.3MB
SHA256 a565d55e6d71bd9d1119d7269413ed3bc6f0a1a93c648b5ff9ca10bbf5157fbf
MD5 3b63004d67085683c09982f77f0f5804
SHA1 d0c87c842cc7e8c7bf9a96f4170b876c860f189d
SHA512 fceff39d2b7d78302ec89fae5ffd7a62149245952d5207fa4e44cdd3759ec134f90b617938d2cd8401bee592ea5ffd3a32f77f86b74b96392952feb2dbb6fa6e
SSDEEP 98304:XtjzFFHTzJsqkw9f+5q8+u9vTuXK3gnUdx0rIfGTDxE+EDvFFNSdSA2yutiDh0:XBvzJjtB+57+u9vTuXK3gOx0rMBF+Sl5
TLSH
T1FF4633E299A166FA012AC2B0B11DAC70F47182FC7D6B114B0469791FBB2F6B4DC1EC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\VelopackTemp\tmp_hJ5Vvk0Z8Qh6OxI4\sq.version
Size 596B
SHA256 dee06de2c68979823b0d4f476708a65a2e34fd999d5f0a6103aa7fbde14f4dc6
MD5 6b8386c2b23a57744b36a136d09ff599
SHA1 7dafc95b1112f4ac13e89f01b1d16996f543f799
SHA512 12020ebd29aa557a2fdb490cd68debfe46f2c5f60a2bc589e68c3f6fc4b3d910ac3e97b1d520d56ec244bb5098fd04f00a93949bdf9cca8867bd7935d6751cb8
TLSH
T1AAF00C86F540DA079742230A98C8030093BB7BAD20C18100EDE4DCA922883DA8E3E6E5
MD5 SHA1 SHA512 TLSH

Submit Download

.gitkeep

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\VelopackTemp\tmp_oLz7pzMY9wXNvzIz\.gitkeep
Size 423B
SHA256 425e70382dc724de7aec454749ac690d00e1531de84c281394f853ebb812368d
MD5 5d2e2858a7f67f215906a924632076d8
SHA1 58bf8955a5c6a2a16c75fcde4bccbf218f826990
SHA512 a919d2a5615dcde83ec1959f6d590b4fcc137f5fe849c196505acfa5eccd63052174cccf7d472aa829b13d16dd32cdee76276ad2c46dbd6b5590d96cf43607e7
TLSH
T1DDE0AB26A5C4A210CFA11A97EB1BF73EE30EB13C9F4059EA2CE4496831A281012A90A5
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\VelopackTemp\tmp_oLz7pzMY9wXNvzIz\sqlite3.dll
Size 1.1MB
SHA256 d2490740bfc6b2bb40a964fe0ac061c7ab0ca0f00dc4c4f704651b907d68b859
MD5 8fcd4881106303541238769d339d203a
SHA1 5267d5aaffacc564e49f1780f087e67ec0104257
SHA512 5eb89e9039d7c62c4b0ec8238a485efcbe1bbf23b6193612e28722f74671255a40dd536fe8c423c2e543ee3094ce96bc5644cd5fe255073736c7b4888e70b853
SSDEEP 12288:Q9pUsVyNUWSEKmtDOXSZbF4zkCya1UHYhkP2evfN+sGqCwazC7LHp09+47oNuWZ7:Q9pUsIMEROiZbF4zkCya2HbzNIqqaTH7
TLSH
T156458C4BB3B901A9D057C178C6174717EBB1B4051364ABEB9690CA6E7F23FE2167E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack.log

Path C:\Users\Admin\AppData\Local\HybridTalk\velopack.log
Size 3KB
SHA256 3c9a2a4cbb5febe37e72070ca9dd7f61edf2780854c8b942abeb07535cf27366
MD5 0056674d62b843c570743df4a5946465
SHA1 998eb5a4ec372462e238927c27c851bf15887011
SHA512 d835e22c70bc7e02ec2201f9aa6a89d315e1628dd65b778f38ad8e9bf38a727b4c65c7664fd7baa25b7c7ab9e00c0b8c3d2ab77089cca59fe2d7eb654c20eb36
TLSH
T14061C3F27F49F23EC62FAB8AA6D1B70AC545793495C7050E13A04984578FC28A4BF19D
MD5 SHA1 SHA512 TLSH

Submit Download

velopack.log

Path C:\Users\Admin\AppData\Local\HybridTalk\velopack.log
Size 4KB
SHA256 35a5c25324df851e3265985b6952369908ee7bb63a6e154935434bb3874a88d0
MD5 3a0a0da8d0530f9d3cdf044b70a56e39
SHA1 57f9043036d8df235127b85f01018febb1885e78
SHA512 efb620d3e7eb6e7d12ef0e0c5977122739fd59129f2947798db47e4ad08814c58bd30bf817ecefed987d26d58fdc7414f6e31afbfb417db581db13e27ec9e0b9
SSDEEP 96:qIHGarTo55YHZSJGAHLoiZGMbsKHZ049HZ04q9za:r85UAn0e0jJa
TLSH
T180A113F2AF88F23DC5369A4AA6D5B60A86417E34D6C7050D13E04944638FC29B8FF1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_HybridTalk.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_HybridTalk.log
Size 6KB
SHA256 35a589b8107329203733bbaf8fadc6b0c9eee6607803f4b18f8f87c9de2883f1
MD5 8fccd19f6a0a89e7e9bede4594b83a54
SHA1 8f729ffc9bcc0d0b12b8b720e7ec5ab5441a3f4d
SHA512 9d74d32b61d81f2596fa8d598cdbf1556f167c03d0b63cd00e37a83f0f55afb7bc26bb36a58da3beda5535e37fd05ff29100800c1ba9483d54ffe21e29f467e0
SSDEEP 96:+TvWHGfmh1YTvWHGfB1NCMWHTg3CMWHTgTgAgTgTm7VagFMxXRox6o40ocowoyGz:+TvgQTvLCMfCMMApSI+MmssG3
TLSH
T148D17C047649BE6CF90D3AE9BB343D0E80842C766FDF165B935086446ADAB1994FE03E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_HybridTalk.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_HybridTalk.log
Size 7KB
SHA256 7a5366219c8be28a2aed0c008434a2d60643f5a6dc7d6e87ae0191056e91510f
MD5 5ba520d142eab5bc4571ce6a66b739a2
SHA1 a6351d1994a13379a87a7f7eef59af9d46f9a978
SHA512 3028145af24eb5b755a0c767bd67c0bf0808d3fb44059ef1cd908906e0e3af0351c56e93e4f7481524d8761f003b5d3dc5bc80b9af1c64f09e0cdb55c6e01e23
SSDEEP 96:+TvWHGfmh1YTvWHGfB1NCMWHTg3CMWHTgTgAgTgTm7VagFMxXRox6o40ocowoyGf:+TvgQTvLCMfCMMApSI+MmssGXCMJXCMl
TLSH
T10FF18E047249BE6CF90D7EA9BB343D0D80442D772FDF165B835086442ADBB19A5FE02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_HybridTalk.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_HybridTalk.log
Size 1KB
SHA256 d3c12c4001f666407135116865c1ab8cf00c32939d6f711f81784dc28ec478bb
MD5 25f56b5f8f3afb6e2eb03fed34ea26f7
SHA1 ef8dd24c0a16f973d9a2ed30cfa227ae04e7962d
SHA512 411e1e07160f888cedf450b24c4ad1a9ab633fde02f828e6a3944af8ed3ff635458c936f0c5d8ca6b4ebcb328a574fc1101e1b385fe6280e45f39ac74bc82064
TLSH
T1833163047245BDACEA0D7AB9BB343D0E40441C772F9F565B535147442BDAE1C94FE02E
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_HybridTalk.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_HybridTalk.log
Size 6KB
SHA256 3f1aa651f50335e9d89839a7d46567a0d7c7656c0fa7d419d2fc68319fbefc70
MD5 16f52378b1e301684825b383f442e8d0
SHA1 988bc118232f5b88386166bb7c8a56851245adfc
SHA512 a0c6baf5220cd84c24117da65760f67834affbac299ebea06ea2f4b5b38fc61cdc4894e5099b2c4e6ee02759fca8a2637aa92ae5dd021671897786cca29ccafb
SSDEEP 96:+TvWHGfmh1YTvWHGfB1NCMWHTg3CMWHTgTgAgTgTm7VagFMxXRox6o40ocowoyG/:+TvgQTvLCMfCMMApSI+MmssM
TLSH
T111D17C147649BE6CE90D3AE9BB343C0E40842C766FDF165B935086446ADAB1994FE02F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ONEST 메신저.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ONEST 메신저.lnk
Size 2KB
SHA256 ecc2fc9f084b7e801a443569ce308487078778cf488b25f3c390f8eec2ecf56a
MD5 d0db9be654a9f45592c417e1a24b56ac
SHA1 e370c07b80236f5b10d1152901b164470c7657b5
SHA512 db56e98a8a8b0afe9e4e781325c4f4d5bd6bb8b93da5075cbbf1b71f6eed1e9c1288706b66cd7d0b4a5a9e7033019f3279c9e6fa5fe69351721c76555494347f
TLSH
T16F41AC01DEC16B21E7B7A2B969FA126C96B7F8A676554E4D008082081C32F51EE44E5B
MD5 SHA1 SHA512 TLSH

Submit Download

ONEST 메신저.lnk

Path C:\Users\Admin\Desktop\ONEST 메신저.lnk
Size 2KB
SHA256 9e103cfe1e74fbe593d06defae40080380e81084e1b9858312d021b8bec24e19
MD5 ab25780443d64799e012c2a1dda860dc
SHA1 39de3801a6b4c81142f7d735e2a5c0aa915eb9b1
SHA512 f17750dbd212f71ffad99150a4b29f6f19485f21e4f653ee2df9898275f5132d287a674e1aac813cacd2c1b321a4364ea31faebf11f75cd44f45bb7498169b5b
TLSH
T16A41C001DEC15621E7F7A2F96DFF125CD6B7F8A636064E4D008082081C32F51FE44A5B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-421-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-411-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-413-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-418-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-422-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-419-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-417-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/760-420-0x0000027547200000-0x0000027547201000-memory.dmp

Download

memory/2424-219-0x00007FFBBE650000-0x00007FFBBE651000-memory.dmp

Download

memory/5760-236-0x00007FFBBE650000-0x00007FFBBE651000-memory.dmp

Download

memory/5760-355-0x00000186AC8E0000-0x00000186AC988000-memory.dmp

Download