3e8cf1c05d1461580f5ea09341cf6a4ac2cd87389b7ae952cef5419a51f1d162

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Size 11.9MB
Sample260905-afmskasgqa
SHA256 3e8cf1c05d1461580f5ea09341cf6a4ac2cd87389b7ae952cef5419a51f1d162
MD5 b0456bdae72919ef85f1532ae95dc436
SHA1 45bfaacc84ad3a3a278aba9c5e4971c72c970f80
SHA512 0df6864f62d60ae92acfcfaa6c9415c969c3d3142cb1c19edc9477b38cbb834812af1120c6443aa073ae4432af7917079754043dd071f316852c8970dbae71c5
SSDEEP 196608:1rF4Dq00X3CHcBdKBq5h47094yvBBSzkYkZji5mW0x2slH0CGKRsMXzFNGYsF4yW:1yD23uBq52709xyBk9/W0x22HlGKRnXH
TLSH
T126C61241FECB82FAD84B0C71941EB33B9B396D064524C7E7DBD47E11A8717904CAB1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
4796	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe
780	Hybrid-Talk.exe
1032	Hybrid-Talk.exe

Loads dropped DLL 13 IoCs

pid	Process
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
780	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Hybrid-Talk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330406024659898"	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\ = "URL:onesttalk Protocol"	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\shell	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\HybridTalk\\current\\Hybrid-Talk.exe\" \"%1\""	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\URL Protocol	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\DefaultIcon	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\HybridTalk\\current\\Hybrid-Talk.exe,0"	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\shell\open\command	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\onesttalk\shell\open	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4796	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe
4796	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe
3856	msedgewebview2.exe
3856	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1416	msedgewebview2.exe
1416	msedgewebview2.exe
1416	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
780	Hybrid-Talk.exe
1032	Hybrid-Talk.exe
1032	Hybrid-Talk.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4796	2204	2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe	85
PID 4796 wrote to memory of 780	4796	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe	87
PID 4796 wrote to memory of 1032	4796	HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe	88
PID 1032 wrote to memory of 1416	1032	Hybrid-Talk.exe	91
PID 1416 wrote to memory of 3212	1416	msedgewebview2.exe	92
PID 1416 wrote to memory of 3556	1416	msedgewebview2.exe	93
PID 1416 wrote to memory of 3556	1416	msedgewebview2.exe	93
PID 1416 wrote to memory of 3556	1416	msedgewebview2.exe	93
PID 1416 wrote to memory of 4760	1416	msedgewebview2.exe	94
PID 1416 wrote to memory of 2300	1416	msedgewebview2.exe	95
PID 1416 wrote to memory of 2300	1416	msedgewebview2.exe	95
PID 1416 wrote to memory of 3328	1416	msedgewebview2.exe	96
PID 1416 wrote to memory of 3328	1416	msedgewebview2.exe	96
PID 1416 wrote to memory of 3328	1416	msedgewebview2.exe	96
PID 1416 wrote to memory of 2516	1416	msedgewebview2.exe	99
PID 1416 wrote to memory of 2516	1416	msedgewebview2.exe	99
PID 1416 wrote to memory of 2516	1416	msedgewebview2.exe	99
PID 1416 wrote to memory of 3288	1416	msedgewebview2.exe	100
PID 1416 wrote to memory of 3288	1416	msedgewebview2.exe	100
PID 1416 wrote to memory of 3288	1416	msedgewebview2.exe	100
PID 1416 wrote to memory of 3856	1416	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_b0456bdae72919ef85f1532ae95dc436_akira_amadey_blankgrabber_cobalt-strike_glassworm_icedid.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe
  "C:\Users\Admin\AppData\Local\Temp\HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
    "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe" --veloapp-install 1.0.10
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:780
- - C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
    "C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-background-networking --disable-component-update --disable-default-apps --disable-extensions --disable-features=msSmartScreenProtection,msEdgeOnRampFRE --disable-sync --no-first-run --mojo-named-platform-channel-pipe=1032.3960.18427938781260856859
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffe6d36b078,0x7ffe6d36b084,0x7ffe6d36b090
        5⤵
        
        PID:3212
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1752,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2060,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2392,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        5⤵
        
        PID:2300
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        5⤵
        
        PID:3328
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4052,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
        5⤵
        
        PID:2516
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4352,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
        5⤵
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView" --webview-exe-name=Hybrid-Talk.exe --webview-exe-version=1.0.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2500,i,6056441092582436170,5106538790798812645,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\HybridTalk\Update.exe
Size 2.8MB
SHA256 3c4ac1f4e3e46163a839ef81c38148693ea5604c2462e08a01266dade2e8ae01
MD5 f319c0902d7ed2a5ac51a5a85ad16ded
SHA1 72298254aaf2fdc1b536c6d559b51f497ceaddee
SHA512 9be8c968faac1c9738178fb39cfa36f694fccc25d62d129f141c605d139bd5f8656683c0ce948e52cff8ee5d5834c9ad6c3de4e9ad72557121ed43ebaba6a225
SSDEEP 49152:Gl4gaDleSQ4edhOQpz31sv7ti7CBIQ/ixlQwT4X1v1Y2Sx4q/b:GWDoSwHFOtwsoCwT+v1Y2SxV
TLSH
T128D59D41FEC782FAD48F0CB1602EB33B9F396D064528C7A7DBE47E01E87535059AA15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 17974ddc9412f5f6b0bc6f07df86ad27b63a953df024fd88bbbb526ebdd82e06
MD5 055d8501d0f335e1257076fabe5f02de
SHA1 740bfe744812c6545c801b33e30d08fb75bb8c78
SHA512 50d0805717b5994fc4fa25763cf8582e47548d6e6525de25f4612b2cd1789cc2eb7a05b177ec08c3987c309ae5bf78e3dc4e6615b4b59e4bd176f9c242e5df02
TLSH
T192D01122B302023CC02030338082AA880800CA0BC2AA8000B82ECBAE2F088B00A0B882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 918369c3e42b1c7b7658bf32adfb9b8b6d9d25764da7082dd47ff9699f0dca8e
MD5 27fb39944c4328e0f55ee11d83e007a3
SHA1 8b5371b34701c752e1e9087c27c792037d5a0977
SHA512 844cbc058e16877610b1d26eb069c779bddb607900a1419f9c50b5cc8c240df0a2fb93354275cdd4fa063f863876cacf0c06d804ce6d3f37d518f1aa3abf1f84
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 88b63e4a9fe23536d8f7dcc7d79bed00aaa572e07c7bade1280b025d2dee3035
MD5 c3649173770781f7650989add7331ebe
SHA1 b212d06d2e417bbafc0690758621e59418e804b9
SHA512 4b3bd0ce79d639cfcdda5244d580fe61b3f814726fbbbc69a9beeacbd5a05d718229a8db9cadbdf15dae5a6129fe330119d7271a3465d969aa4d472b780edb51
SSDEEP 3:LstlNllkll/lkwtl:LsX3lEtkwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe598488.TMP

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\Network Persistent State~RFe598488.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 349895e6ef81075536f6d6043b816d6aa99aa1a7e08badde1477b91e0e4810f9
MD5 53e2dbba0725a711383416774d5bb0dc
SHA1 58c72904dabc7860172cff2007df418c46865c12
SHA512 030a191f27f5205e11cda1cc2509c021619e8cdc938ce1ec23bca4d3ebf16c2a8ec61971611de768444b2f8803946d3d819b558d023dc8910e37ed3f38f1ab27
SSDEEP 96:ste05O1lvXb9iffTGdZ8i0oEAklm/7qx+WVHMSm+uecadQjv+geG8CDMEB:ste0MH8fcZ8pFy/S+Wi8daYAM8
TLSH
T12DC1A7435F2869774CC7F619BA35BF02D2FA106265D50E98EBFC861C09EA5CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ce75a7f3322cc6b3dab43f228cf9ba5ae7991ff1b158a726f9e0ff0d8c530f28
MD5 535b779dd536ec7ab5b880056b90540e
SHA1 25b68a2f28ac7e085de031aee36a47ce74ae00f3
SHA512 a153d6014cc6fbe3037f74cba35513b1e363a3f5a669485fa1fcbe1a3752ec0c39609197aa471d7e6ff125e2a853fe4aa360aa042c9bde221fc4fb8810101613
SSDEEP 96:ste05O1lvXb9sffgEZ8i0vhEAk6Ywm/7qx+WVHMSm+uecjTv1idQjv+gew8CDMOB:ste0MHGf3Z8paUYJ/S+WihTvwdaGAMC
TLSH
T1F9E1A7435E68697B4CC7F6197A35BF16E2FA102265C50E98ABFCC61C09E66CD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 d872c95506ca624575a391d40e8c135443ad70e36696b7fbe25d8780dc6290cc
MD5 9d3f9ecebb96db62f75a7630b20245a2
SHA1 01ca659758d077c8eadb6399d081f9f8426fa36b
SHA512 f4588420d6ee2a87142ab5eb297f1dbd0af412feff73863e3a3f7115a04ff0db78598711ecb08f75819c4662320f1a8d59da00d60e37b8fdb3053b206f685c6d
SSDEEP 96:ste05O1lvXb9iffgEZ8i0vhEAk6Ywm/7qx+WVHMSm+uecjTv1idQjv+ger8CDMEB:ste0MH8f3Z8paUYJ/S+WihTvwdaDAM8
TLSH
T116D197435E68697B4CC7F2197E35BB16D2FA106265D50E98EBFC861C09EA2CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 4KB
SHA256 035993b67971cd1ca3cb58b9b89ed1da62fd6d76a298b9534f758901585ea615
MD5 5d15e8d34ad9478b1926eca78f949217
SHA1 9e560ff466da2263ef5cd60abbe0a8c6344c56ff
SHA512 bb347c77021fa9c21ffd9d9457a3503fe81dd5006d7aee986ff7d15d35e805654245ebf0030d8980c4fec95256ef297f1bc97a90812211315cbe491c078ed061
SSDEEP 96:8F3NkEIbTftcK58Frh/cInURoDotoi5sDtsNBlyHTu6pPZmQBZuTXrRa:8F3NgdMooDUDwtsTYHTaQzmU
TLSH
T17E81B563A864A9674DA3FA41B5863B2AB6A45133C4863FA4DAED0F0D01DB3DC2351D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 1KB
SHA256 a868c2503caafb5eede150129c96857697d804e519ca18669c788712121246b2
MD5 dfc80e8a185df4d3baeff60974b2738b
SHA1 bfbc96641baa497444cc2d0049eef9601e270fcb
SHA512 313e39226ad1c9d04f2345d12655deeed3653906a21080cdf197b01ba27773305fb9ca69f55e6099890a62a0f89650562f9ced64e59cdee1f714581e2f3bdce2
TLSH
T1503165B3E5946F7258427A867252EE7F2E60517281178E08B2EF4B2D06D758C9331C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 2KB
SHA256 730f3745f86972992bec39076f793be72ef5d3bbb3a28a072beefaee17bfabb4
MD5 1d8a908f1f406f382a55cb07b91fbbc7
SHA1 15d8b3fca38e960fb88274d8870488bc31b61f04
SHA512 9968d10ec97213ecec2be06fecad16187735c2f8a970eabae16b87cacc0cc3d40513bc5e255b39a5a23814886c86cdbde733d723e314b110e7a83e2f2ea8a2a3
TLSH
T19F51C873B804AA7749A3AA447A467F3BAA39517185532F50E6DE0B1C01DB59C2321C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 255e67dc929b29df9de174eb28c3c0b96d9e0d9d6f76c58d54116729bb19fcc0
MD5 192bbe6ffd45bc15cc9c274cd722b9d1
SHA1 ca2e2d5189f0c71646517a61a0614244666a17c0
SHA512 3b95bf0f5a3a016ed9c12f4b67b991d5cb194626f87f6c8db905cf22a2a52bfb1d278ced638df93ca16b8fb5939fdffdd03682c8ec5eabda8acd5cb387425876
TLSH
T1CD81C673A864A9270DA3EA45B9863B1BB6684133C4863F98DAED0F0D01DB3DC1351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 373f3b87934d2c72676a483900cabc76f790696f4b656d7347af299294a56dc9
MD5 769c2ce534bf649f350317bf6f795e1b
SHA1 01f0436f9f395c995e0e0fad18be605a492afc2f
SHA512 2649049e5a01244294cc244287a765523873323134a6ebae89291514f6b27922310cb88ae278413a56f8be0ebc283d21439a938541a5235b2a3615b68350cd97
TLSH
T12F71B773A964A9274DA3AA41B9862F2AB7A54133D4863F94D6ED0F0D01DB2DC2351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 d0cdbdecbda2951aa05673236e692c04ee7457385f6a1a434ca0584929176114
MD5 708867fb448f472f3e843dd9cb81fc3f
SHA1 0f3fc37ed5a54a8d6e6415d270477d6e21599bef
SHA512 e3bab7a24d079498dc7fef79fd3b0535ef8a59e2f3b5231213081abc2bf804a70b1186f9a9f175c61dfbd571a7ca9a6fc26e5398f8464e8780f55d3b8bb8e203
TLSH
T1EC81B573A864A9670DA3EA41B5863B2AB6A45133C4863FA4DAED0F1D01DB3DC2351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State
Size 3KB
SHA256 2885f717f38f6ae9dc9a77171da58787515edda2615e05273b81ce606c724f98
MD5 60d6ae6e0355e65c2eddb1ac9da717db
SHA1 3219fda0af82bd564704a77a273108e894e3386e
SHA512 e9c2da1ac61e0a44ea2ff9816f9ccd7d2c368cab69129c93937326c98cd07f1c108e28b202f4017b844d48f8f5064bfbfe019f50f43a9600f3888f315f615308
TLSH
T15D81B563A864A9274DA3FA41B5863B2AB6A45133C4863FA4DAED0F0D01DB3DC2351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585d7d.TMP

Path C:\Users\Admin\AppData\Local\HybridTalk\WebView2\EBWebView\Local State~RFe585d7d.TMP
Size 1KB
SHA256 345b0a25100c28052c44bbe4883d19d8cafa15fa4f4c2dc01be1fb43a257d168
MD5 2f04a1f7a0d0e03d5097b7f822b2a355
SHA1 a635cbd64fc374daafee91b78746792a18ac8a88
SHA512 e2575e57a00446065c39aaf6ccdce2eacd0f9dead4a0684588539310490a23e050e1bec853bf20499984991b5e5cc7d4f6a0911c5ce5165504a30e3c1e83efb1
TLSH
T1082165B3D8946E76594279867213FA9F2E60417241068E1CF2EF071D06DB99C8331C36
MD5 SHA1 SHA512 TLSH

Submit Download

Hybrid-Talk.exe

Path C:\Users\Admin\AppData\Local\HybridTalk\current\Hybrid-Talk.exe
Size 7.5MB
SHA256 dbfe615ea9211d7b039fc6b11326897e8f6642727cc454172f0ee75bb2dba26a
MD5 b988f5b17b6fb48195129df842e9f9f7
SHA1 eb1cdf01ac1552510573e4d2de742468a1719558
SHA512 1329b1cdab2232c5182a849820dccfa5f953fa36c9619a23ae4f61db249d2f74e5e45056960a1c04e63ec33ab17252a0d8a20b3447df83093b7e3c5f93fbecbb
SSDEEP 49152:YhtYcmjvL2oySfD64ZeLUlSRBnoQ3+H2yZMaycbYDffHmvCChYifvIJYjjp6rbL4:ISc+2oyPRq5MTcjtjn+A+Sv1Y2p
TLSH
T1DF861A0BEBAA50E4D0BAD438C657A63BFD7138A6833063E756915A071F36BE0D93D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\VCRUNTIME140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\WebView2Loader.dll
Size 157KB
SHA256 86545b66cdb0603bc26b626fb9ad610cb6e71f28d468f5ea66df23b03dda96d5
MD5 ff3ab627947e2c1c58f13694a8651c7f
SHA1 280e4cb1c735b3ee7cfedc82a5bfe7c134a89d90
SHA512 45a167e90716a08abf79f76fba42681cc8bc76f0087f62d028350c5d28e79b922dc1bc799b0dd0a086e7add20c17b9bd6a355674d7f1b0854f217432e4c7d555
SSDEEP 3072:lKpb6T599mlMpgeMiqa5agdTl0RflJGhaTcZYEtJomT+JJg7yl:uGf9m9XkagdTlMvEtJKJg8
TLSH
T10BF35C57B3E510B7E07BC27485A34A42E772B81157609AEF0364467A1F23BD0EE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ini

Path C:\Users\Admin\AppData\Local\HybridTalk\current\app.ini
Size 326B
SHA256 1d27bf4ed62ea32f775b3cc1eadfc7677550d8a190517466605da2d2aaeb1653
MD5 bd7af2de3f612e1b58839b0599741952
SHA1 3f58f9ad1bb2a57fccee42823bec7ee94aa197ef
SHA512 4e7f53c2e6ee80f5f99f73a9cff116f2477bbcb9b028c1c44f831ab75ad387f27ca79308f46ed0661b4ef6621efabdb4d257a63173b745af232037b1384f27ce
TLSH
T109E0EC5427F70018B4727F9AFDF59097672A79112D15D95D11C2130E04F9B41E9B3B3A
MD5 SHA1 SHA512 TLSH

Submit Download

offline-notice.html

Path C:\Users\Admin\AppData\Local\HybridTalk\current\html\offline-notice.html
Size 7KB
SHA256 1737281dff2b2087060837710583a131c06d23e9cff42b481f7175514d2ff17a
MD5 8af8ae318c83a631ec53f1af0f012db8
SHA1 cc2567736dc3d8fb8dd1dbbee6024f8b8aa73bbe
SHA512 713592a4cd032177b7f4744c11eb2c35fb5167ab4e30d648c95ec9d49c8bc25a49bebc43e551937d44e32be7c874483b13be0b929f70a77d3ce147f4b2fafdab
SSDEEP 96:GPQPjWYRFus7FeagjNtBL0F53QRFHfM8zLBlyQ58fHtiI5SWrBsNltHEQMrLxyYF:PjDchjNt2YJfM8zLBVOHtghqym0A
TLSH
T148F1E8A22344511D6077C3B4AB99B308B2256027E7470AB97D5D9722CF7A05188FFFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\mfc140u.dll
Size 5.4MB
SHA256 4a37ea84d748058c763c5600757d143bf5354bc466048643eda048f9b6e0c214
MD5 c9c85a6cf9cef217a56d558afae0312e
SHA1 107384e434447c5b7ba6154bfafcdd91bed3dac9
SHA512 6dcee2af27f3db1f876b5882d4e1a8a1bb12c2faaef2671c4b6f9aa873d70ab2e96fc9741b83635b8b1fe611972edf7c9e779734f99590e522de0a913872751c
SSDEEP 98304:0Uon/oeUxcmSmfdqkFLOAkGkzdnEVomFHKnPD:jon/7yBFf5FLOyomFHKnPD
TLSH
T183468D867AAD0494D569D07AC7678E5BD7B3FC50136183CF0162679EAF337D20A3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\HybridTalk\current\sq.version
Size 528B
SHA256 6dc1373bc308ace569df8515ab165602e514775a227ce4554d6c9d0a5619b654
MD5 346dad170f324fa4a4b732804c1c135f
SHA1 838b8d8a91801d4566d6829056b70c4f594c95be
SHA512 4b07f248be4bfc6a67617c80cfd7e4f23606553ab8b9d85ca85e02a982e6b87173c9c548f125a80f5c3c5aa6c1adbeb733181220ce3a9937f27178be61e4911c
TLSH
T152F0C085E500C61387425309A8C8430493FF7FAD60D18541EDE4DC2926453DA8A7F9D1
MD5 SHA1 SHA512 TLSH

Submit Download

update.json

Path C:\Users\Admin\AppData\Local\HybridTalk\current\update.json
Size 138B
SHA256 eddf78bd06c89f9048d8e5c8eddb02063fda44b26855b316bcb3cbb34de520f8
MD5 cdef1080719f29c206b2ffac5139701d
SHA1 6ff9592254f7e45f96b64698df546a1c0edd5344
SHA512 882729853ab6bd177ec9a0765e97b3e52b7218e03cdb4e57fabf9532d381f6abbf29d5a0a5861489518c789533eda7a73d9ae85609b63bc09628dbe684f85d03
TLSH
T131C04C9AA948C8B61DEC9DC94182E768F7834E39ECF0166581930A94515C171565C58D
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\HybridTalk\current\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HybridTalk-1.0.10-full.nupkg

Path C:\Users\Admin\AppData\Local\HybridTalk\packages\HybridTalk-1.0.10-full.nupkg
Size 8.8MB
SHA256 cf9bc4481741e7c14b299386f2094c7790f270397fd2ea16cd29c15ef2988c82
MD5 3718aeb81b435af52c2c75a546d60f01
SHA1 96e03c4991b1796b3ded1d0bc2ea1f330cdda281
SHA512 6c4534abc512692d71cea1511349308ed83051674d37e633c6e8f7cbf707b1ca4d10386ddbf4832fc0000bd6e8bef33162cb29ee774f2e81cde7788f2076e77d
SSDEEP 196608:8BdKBq5h47094yvBBSzkYkZji5mW0x2slH0CGKRsMXzFNGYsF4yxfFb++hA:5Bq52709xyBk9/W0x22HlGKRnXzBsFfG
TLSH
T103963392A8F1EB78C6E79F89680C4D19E69870BC0D13808204CC7F59FE651E9DF97786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe

Path C:\Users\Admin\AppData\Local\Temp\HybridTalk-Setup-{6E0F0480-7473-4F7E-AD5E-4C5ED17A585C}.exe
Size 11.5MB
SHA256 31d8c3b17a01f7ca19739df48cef479e76c7301bcac70646b1df1412e5c2af19
MD5 7b58892bf5c80ecdd3ff00b3f7081d5e
SHA1 c5c17892a824cf4a63056dc9af15ed695fbb67de
SHA512 2e1e314ebff1bccaeb7193ab313c4f1862e89270e2b232eaa894d46dd5d1b75a8993fb215a850b096d5853e265d471b9972babbb7a45f474ae3b6bb4d6c7a7ff
SSDEEP 196608:K4Dq00X3CHcBdKBq5h47094yvBBSzkYkZji5mW0x2slH0CGKRsMXzFNGYsF4yxfl:1D23uBq52709xyBk9/W0x22HlGKRnXzO
TLSH
T16CC61241FECB82F9C88B0C71602EB33B9B356D064528C797EBE47E15EC7535049AB16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_HybridTalk.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_HybridTalk.log
Size 1KB
SHA256 6d2f391adce97af42e71875e5894153f3438b2fe78c7e09c98b4b86141c01bca
MD5 7bb13047717e694489c63f756dce58b2
SHA1 69489f89b7cbcfc6c4a5b5ac6e053d1263aee765
SHA512 cecbcdf853f8b36cdce39adaf6c7813582ec0002695cfcd023a063d34b455b29935143f8ce58e51d54a18236d2f72233d1831635752eca2784ca59f6f62498ab
TLSH
T1F7311C0471467A2CB90F09196D356E4744890B2B3F6A5F665701C7483EAF90D98BF336
MD5 SHA1 SHA512 TLSH

Submit Download

setting.db

Path C:\Users\Admin\AppData\Roaming\HybridTalk\setting.db
Size 80KB
SHA256 9f6083919f7633de9b24670afb986e2da421505e59aaa976c73f5e55beb9a104
MD5 feda6f2075511185c0a4f82d382e960d
SHA1 0b7e51af2dd25800405cda5ac112b53de5f75234
SHA512 f70b0b6043e3cc5c244d957b1ce96c1d972e5dff6ff3db42e43ffd56e1a0f7cd7bb7616bb9fd72b6c44b88697a294da609f06f64ae07fc1bb7419a2818d798e5
SSDEEP 1536:OkA2PGNj/k5Mh5J913zhd0t+GttwoWtA8AHg3oKkZN89qh5qWyblkkslpxbIxlqw:ZGNj/EMdX3zhU1twot8CfMqhcBApx2F
TLSH
T126830298AFDE2941CA047460F2A2F583A9C9A18F6F1229D2CF573DA54931F433B311BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-162-0x00007FFE898E0000-0x00007FFE898E1000-memory.dmp

Download

memory/2300-166-0x00007FFE89F30000-0x00007FFE89F31000-memory.dmp

Download

memory/2516-331-0x0000023AE0950000-0x0000023AE09EB000-memory.dmp

Download

memory/3288-332-0x00000269B4410000-0x00000269B44AB000-memory.dmp

Download

memory/3328-282-0x0000021EDD5A0000-0x0000021EDD63B000-memory.dmp

Download

memory/3328-213-0x00007FFE8A080000-0x00007FFE8A081000-memory.dmp

Download

memory/3556-102-0x00007FFE8A080000-0x00007FFE8A081000-memory.dmp

Download

memory/3556-281-0x00000247C9E40000-0x00000247C9EDB000-memory.dmp

Download

memory/3856-403-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-402-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-401-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-407-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-409-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-413-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-412-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-411-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-410-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download

memory/3856-408-0x00000247B3930000-0x00000247B3931000-memory.dmp

Download