5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260420-jph1eact2k
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  $LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
- Size 80KB
- SHA256 1c0e8105bdfb3c6a7f3a2ebd2f25e38e7c23dd66619364a3fe620e6603a0ba2d
- MD5 573ad7658e2f461bf11d5d1b61eaebd4
- SHA1 9730ed057bab427176eedbee8f583ff196e08d79
- SHA512 a3a1bd2cfdb71473e720cafbccac5df21db7e81af7ba67900ab041dd7d96d058ea60453bc1fc08b85350ab3a8825dcc8a2340ab5f8a62dabc593017a0a197941
- SSDEEP 1536:8aa8DgRl8sOQ0tolEGrhsEg+QOphmZgW0GNLd/IohnR91fIgUB:8aa8Dgz8t9tAW0GDIBgy
- TLSH
  T1EE837D499B24EB77DD424F3194E78312AE39C2530FC209AB9D6686705F933E98F5370A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 15KB
- SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
- MD5 d74bb4447af48da081c7d9b499f3a023
- SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
- SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
- SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
- TLSH
  T1B362A6124FF90BFEF1F16B352AB5553303A2B50124B1C21D5B91CE9A2831B9B5D74327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Compiler/include/wil/windowing.h
- Size 5KB
- SHA256 1a998285702f7fe94c5c4173d469a209b04555dbae3c5bec7162d68b8a7a138c
- MD5 af05d6d951339159040c6e90b4baeeed
- SHA1 cf0222d8e1225c1d65351cd9e55d11383f0e6ae3
- SHA512 1ceedf7a24fd29e86c9799de89841fcf0b6736cc03257fb70ff8589ca62f29a682cc48da1286d4e78f45bf91c73563fa99c3736eaecedf22f403398859270799
- SSDEEP 48:0C8QHFs0L7PBCilMHoBnkwE6HObkRTzMfUMXoJnUwQ/5PBFjxZ4Ux5+PBad49mBd:0C8QH9PBFooBbxBz4oJLQhz/Uce6noBG
- TLSH
  T151C10D4420376FA60DB1DFBA8605A3D1E62F64430F6F0612709DB3A16FFE5228399DC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Compiler/x86_64-w64-mingw32/bin/libc++.dll
- Size 2.0MB
- SHA256 74c541f76732d738642072e90f26343e44d66d97bb258db76f2f3bee7e30060c
- MD5 c8c00080c39825ffa74538fa15ff8000
- SHA1 f64e9091821a92d88c67f890d2b2a4311b066d7e
- SHA512 015c41ad8012255169772a21c629d8b7872f3b5ae3a318b54d879e4e078ebc349db85b38b636e0d44b63461e48916927d9956eff13bb2f038f8846d501f063e4
- SSDEEP 24576:tCVr3dvcA1YczEni9PzCaLrrAUpshSMXl2hTdR7l5SLujr+w4gCxSJBpKcKF5itY:41YczEniJCarrtfJBpKc2
- TLSH
  T11AA56C03A3E6CE5AC89EBB7491C7271AB334BD5117F75ADB521053206E837C99A3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Compiler/x86_64-w64-mingw32/bin/libunwind.dll
- Size 211KB
- SHA256 6e6d1e74d17ee361b3f3661faa3d07fa7597257df1cd3dd360719222e54aa36c
- MD5 30a2d4c1be541c3e7b15f25b07f710b3
- SHA1 6039918e2df8935ba3e8c8811d39855ef7824cb3
- SHA512 05e5e1926052000138bf87dc76020fc6a868da102b9978c9ba75766fed764f5b490b09d4195f8234778c82c7ae0c91ac43723c00af6cc60991252656087d8aae
- SSDEEP 1536:B/OQPJIbKEP1Qs7WdfVf/HrJW5hsfhmMHU3jXvLmbAY2j8SCmQ2FIeXi2MIL80Yl:B/OQPJIbj1lydtXavKwBl3FvXitIAJz
- TLSH
  T1C7244B4A97D1DE7BC91182328CA70718BB35E4911B439FCB2F0811797F637D8AE76A09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Engine/$R1/32/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 d9c4fd69f7bc0bf1f9066df0502a57de5f6d73dfff99c9fe5c75b491aecee86b
- MD5 81dfefdd5a24792d13f3096601a9b4a0
- SHA1 c994d24f553bc0c2376f0ef2142817699bc69272
- SHA512 6cd665b52d32eb1438bf48b5bb75c5ca8a6004b61633cfb7c888a42875c222041f5360501acc33962b059ba44e85f0e4807370b63554ce15f6191930d66c1c17
- SSDEEP 49152:0bQhj1xxRKpH9srFVSvI38QvLQ3ZdtrgDQtpYyB:00hj1olcFVCY8QS
- TLSH
  T1CAA53931E61ECA35DA8C1070AC39BB5F026DBA6E0B2555C7B3A41E3D6E325C27B34947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Engine/$R1/32/symsrv_windhawk.dll
- Size 320KB
- SHA256 7a9fadded044916c645789a1e7185b0bc83f226052dc93015d59826541dcfa4a
- MD5 7c424c4ca79cf880a0ee31888036dd58
- SHA1 2e6debed8fa94c91dd483311fbcb09d70b2d9df3
- SHA512 ae06e52a7bb0111b1d566079cb907b2437e9f99ca07b3dffae76e149f41ca375cb0e5eca6f4bdf939e98d9506c93817b98f365842691567ac038545aa5d74c58
- SSDEEP 6144:Iyd17qp3JfUkAa/Bvk3j7DndpaXPSUh/4+LRA:Iy37W3dhGXdEKUhAIRA
- TLSH
  T1A9643A2366D89175F9FB36B47AFCA669867D79A04B72C1CF1240968F0865AC09F30373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  Engine/$R1/32/windhawk.dll
- Size 905KB
- SHA256 67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f
- MD5 f7bb000645c99f89ff38c6f7616c205f
- SHA1 4f76a9b030ecb1b9b9861e5be2787f63e78c0723
- SHA512 33623281a35d29ee18d59fc9d286b9c83903d781b5634d4d9fc7918cc5b74027cb2d9f6fd8ecf35391c201549068d1898cada742c6947c00bfc9cbb91c1ee6e7
- SSDEEP 12288:vPtFKXRL67yB1dEQ3d6GHBKLP+M+sWe1NUtcpNd+5w6uZNZcLpixp:3tRI1dvBOWM+sWeDww6uXZcLpixp
- TLSH
  T132153A72EE41B433ED3419345DA6076B663E91A0976281C7278C293E5DD1BD02F32FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Engine/$R1/64/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 6465aca7b9a162726ca98c6e633fc70b8cb2a8c0a4f90c2b32e0ca99fb5f9cf8
- MD5 8851e33bd5380f05720d25139d6f84cd
- SHA1 481577bdebd28ed0d6db90f181dbb09998f26c89
- SHA512 98e785d61ea14be511f27d9c865780f237ab0f5276f8a0feb921ac102c81ab6076e4a03ca088f2609c3cdedba040140ce258359c8479c2cd3d877c7bcafbed16
- SSDEEP 24576:i4xB9eY1DnidGfmPPUmSyankyA7IJ7cPBNWOWtY/YmBpoMXyOkr0ZZ+1E:+kZmHZSywAIJUBNYtYAmL6Okr04E
- TLSH
  T10DA57C67F3A841ACD1BAC07CC56B9606EBB278460320A7DF12A0567E7F13BE159BD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral12
- Target
  Engine/$R1/64/symsrv_windhawk.dll
- Size 422KB
- SHA256 67bdff85d161888f2c6a8a385f9b35aa1c1c231ed3b59c01fa54f598ac37d374
- MD5 2148e12ba31e49c815b83d52af8d2a61
- SHA1 abb520caf7133df5f61b787367d84859de375d31
- SHA512 26aec2331fc040ec13f6e81555a05d1d9f41e5e74ce23375a1d4f0a4aa1cb4e3a5d82259ba4f2e8ffafcfe3252cef7b60b5aee4a2745d0a04d7ccd8765876f33
- SSDEEP 6144:0Y7jrEtTBlB+HqbtYnwbnt7aSjAGqx0lcdEzlDy21qar2bXQY:0YgJ64Yct7a+AG8zi1yUqc2T
- TLSH
  T13A94192DE7E80465F1B2B5388AB78605D7B278A91775D2CF1194C13E0E27FE4AA34B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Engine/$R1/64/windhawk.dll
- Size 956KB
- SHA256 0aad074caf156200be7a77e4615f9171cea884cde96baf90397366c28c4f10a1
- MD5 5e377e811ac2772eb6ecaaf04063ac3d
- SHA1 6d1f24c87be48ef93ffd6773957f73eda7652192
- SHA512 3b5686eb8501015edf228d9552f55c89450934f69f2553069018188b5483b1f9ced43010a9a105cdc29dbf012f300a6652e60662f4c1a76b198b8ceb019d5af2
- SSDEEP 12288:LuItYj/l9fjIoAQ2BAM7UtcpNj+5goVuQxrDY:L8j/zUoArAKu7Vu+4
- TLSH
  T105253BB3EF502476E831953489B30727A27BB4909761C6CB2748252E1ED2BE02F36F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Engine/$R1/arm64/msdia140_windhawk.dll
- Size 4.8MB
- SHA256 385ce9aae0dc0cdcbfa21e86abca5a9ea4a7fbf891d43b51852fa7d023a629cf
- MD5 134053ab9dc9f855bc0bad52a05e3abc
- SHA1 4bd552ab8f7f21c370aec808363b358c9140d71c
- SHA512 9ffc60ab29e8e6fdddbd58e775b9efad4c8fb438a4f63b92ffae2004b7814d7abefb107eb79998f3f549f1743ee2da131fa3e6e8a64546710b07edbdbc7ed1ab
- SSDEEP 98304:EzqS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0KB7cFLDiXEpYk23pnaV2sd2xF6tjRxy:RS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0e
- TLSH
  T1AF365C11AE8CA835D2DAD33CEFA34F60213BF574C0688D87F25A035CED96FC19596296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Engine/$R1/arm64/symsrv_windhawk.dll
- Size 708KB
- SHA256 97610e918b8f33fa5ce3b337512534d817057f1bcbed257241aca0c7f30c65ea
- MD5 0f965e8d97122f7ecbc01dca6ee16a61
- SHA1 4a9c724c922b57220858004861511b67b7bfeda9
- SHA512 1bc1fc5a6615e82f4709a4662b136a57ab211cf123dc796d7eb07d67e869cee62f2a2e82a125336d54d81fbf902f212fa448ef33985ceabddd563690ced79af4
- SSDEEP 12288:fyJ+9eO2zqg7XRueQEYpOfUQuj6VhHaYk+nyo3M9NdaknHX:xLjYkzo3Mdakn3
- TLSH
  T167F42A826ECC9845D2D6F73EDC678A24633BB8BD4438D24B6142220FDE9D7C4D9A1763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Engine/$R1/arm64/windhawk.dll
- Size 1.7MB
- SHA256 60c72a84289f333704c8e35d21e7b1362d0481c426041daac0e5eb7af7d13c1c
- MD5 6b285136c41ed5d042ac4d7c153e933a
- SHA1 fefe4bcd935eb2f33502c9d96ed5366b6c575e4c
- SHA512 477ed9ff44d10284d83c7616966397e57f3bed4356ac0a29f62ebc8cd6f76a3b410e832eb6e9b531f59ee61d552eb642aab878170357d7809f90c0f31c2fb663
- SSDEEP 12288:CeQuh4pjNWiwruly0WkVYuLYIL1IBR7KzlWStymDyUEdOZvvATM30ZwRrlDuhsy:rubWiwrul/YJVmDyUEdO1vjrJgsy
- TLSH
  T1C285C5F85F0844EBE1E5E73CBE614D39603D2C76D6A919C600229F07D85AE9872E1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  UI/resources/app/extensions/clangd/out/bundle.js
- Size 797KB
- SHA256 4537d7e62ce3fd248775b44a8df926d183417767d83510f3ec96193d2bdc8400
- MD5 2a1e30271097955b02d3d2e68f0a16b0
- SHA1 5620916ca1cfb36e23bbd9ffa91f7fae0a13993f
- SHA512 0398c9be10070deedec92572241b7687293c865262970734bc0b8e17d63100e727ec28231afab89a2a5bc4de7c4012d1fc13c9c68ce6ed5f610290ebba78fd9e
- SSDEEP 6144:rZGO52dyh05f+g5jw1oMoZdjduXI5WzzRCy0tCL5qSyUQ5/usqY03XEI4elgPyef:dGO5sgWVTIUTnBhLOo7P6K
- TLSH
  T18C05E6D5F2A122AE229E938CDCA6006EA5B710F8600DB434F5C4ECDD149DECD5267A7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
- Size 1KB
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH
  T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral19
- Target
  UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
- Size 5.4MB
- SHA256 a772f98f408cc230e29d6dbebfadffac92310fe4d7220752262c09d6776dba2d
- MD5 a394cbda564c74d5404b7175d915efa4
- SHA1 7f7eb44f90767875a35884d8313e00328ae50ecd
- SHA512 5cae4ab95059926311df1ea40973a722b2069d3e040f3d1698d9c5eac2bc7e0cc9322189ecc4762b2287ae2afeb2db29ae5a225cc7c876dce49514e985931c2b
- SSDEEP 49152:JkwOSFftdAnCpIPOlFj7wMawIPvfUhrqstlsN4n1wauYPkQEQrEf2C9PrSjaFX3/:Snfdazz8uC
- TLSH
  T1FB4639963245706643DB51E660BB0103B3392459B809846CF77CECDE29AFE8672B7F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20
- Target
  UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
- Size 169KB
- SHA256 cff2446e6c40f4151ba3b7a568c0a361a5da31423f242085cb10fe938e5a4281
- MD5 e37fa198f2ba94998952d5773556a6cf
- SHA1 af8b924c85d3925a6d5b917629efc877140f275b
- SHA512 ac83d6586470324b407440248ce8fafbc990f215a01cc6ae6c103c1249d438d1c3aadbf710cdeb8d7d376b85641a2d2d345fdd216f851c12ae39afc055da2da5
- SSDEEP 1536:EX9EL2TLM+H1+TNReVZ4KYJTmqS/n6DrU4aRus+LynbQgStd93ZoJin:EtEq8UUNReYKYJT+6vNkkLynbQgSD9p7
- TLSH
  T1E304E784F291B0E202A76414606F4447F27B1B46A80D99A0F707F9E1787FD4AB1B7EBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21
- Target
  UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
- Size 3KB
- SHA256 856bec59e1cea6b7e36d128de2e393eec8548aa8d75b5a389a72195373865bb7
- MD5 a5bb6d4a3db136fd6200785c7dcca349
- SHA1 9519a03d7eca7a3443d3b312cd4e9edc284d0eaf
- SHA512 dcce525424dc27206633c877dfa32469343f38ae54f2f13703bfc80cb56bc2c5e4818e1ea92b57507e2ec9906299e9f62f6037a7929776740f34775824d3340d
- TLSH
  T14961B6A62664F4B727A158D1042FC592F716243705AFF8F0A717DCB5B878CC54862FB1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral22
- Target
  UI/resources/app/out/vs/code/electron-main/main.js
- Size 931KB
- SHA256 28a11360c6381cdbda5d6110d45d48e080f57ef831c958d928b3fe7fe9745c03
- MD5 8b684c7f178c24b56288ed7bbe352799
- SHA1 454f2a8f36f7434d453a646a3935bdb3b3102dbe
- SHA512 ef8e25342906559d1b2676b25321631b29de73cda9b0f39275fa8ac884787b5246161fad33ccc03ab62570adecb67309860174444a367bc6828de84179368933
- SSDEEP 12288:f5pIK+I2kApZ4HG1CV7PXB0V3dqJoS4nZ28X9Kir/xK+wx:DI02kA/4mW7PXB0FdqSS4nZ28X9Kirg7
- TLSH
  T11B154AC272E66DB203E191E9D87B0102E1796658301C107CF7ACADCF7DEA94A527AF74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
- Size 2KB
- SHA256 469bee8975d893e4085d00d9a59fbc09c14b0c1bcb47f3292b611a24ee703193
- MD5 cfa2cf830cfb2bca8f8eeaa7bcfd99a9
- SHA1 952266e3e56079bb4f47c85fb1b2fb56a550618b
- SHA512 bd5c4edc9e52fcb8cee133cacdbfa248983427919e03c33bfceabdd4dec5f05cda8142b835b73dd990c2e1ab97b6691b05185cb93bc4f5a71d4f7a29e2abc147
- TLSH
  T121419728830803F4F11E574CC4C529AA36D978EBB148F79C91597C95E5DAD640C171EF
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral24
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
- Size 2KB
- SHA256 3d88dc275cd053bb28435aff34bc98a5bae0ae755d2bbb7f4dc09c324a40c63c
- MD5 aab566666eda5d5a771b84aac35e65e4
- SHA1 4d75b6e976f4de25d6a1da9abd928e058934db8e
- SHA512 79132149729d35e391ba08b39249e5df21fff580e193327850fd3420515ed4b550b74411fc841ff3f6d9ccae2c22f73300f9b6d50805a970e7b5ed8b38e0629f
- TLSH
  T1DE4161CC5FA8588080DC8BC53F53D8981D97F69989C78D50C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
- Size 2KB
- SHA256 c26bdd09e6c461fff0b553777c4515bdda9befd69cff7b1530b102dbdd85a48c
- MD5 f7c08269b188d70be6be9ab4120ffd07
- SHA1 175d94e7e29fe652a71e4b1ca105744fa22e58d6
- SHA512 78603032225c92816bed0e8589a372c45630a30cc8f6a778752ccafeed52ab489984f4ae30344d4c0e616e43b3298ce801a8b230d845d3cb50e1fa0c69313472
- TLSH
  T1214163CC5FA45880419C87C53F53D89C1D57F69945C78D40C08DAF7A419783DBD83996
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral26
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
- Size 2KB
- SHA256 fe3f5dcfe0c6220932918777540fdbe2acb3f8229a56129fab2e0b4d08977c09
- MD5 95429443e1d822c98c49940588e44f89
- SHA1 d95c099fdf3cdfa9818bc98f04858888c8767994
- SHA512 eee65444613c51a082525102d637157fb3ac9726b6d1257ba11f22b7313ef87b387ffeab78019312bba0edb8d7cce3254a81586e02f835ba6a6b01d6f054cbe8
- TLSH
  T1164161CC5FA85880819C8BC53F93D89D1D97F69985C78D40C08DAFBA41A783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27
- Target
  UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
- Size 2KB
- SHA256 c46688c88a6e90f0b48043dbb42e533097fac1a62d3b73b60083c3a2a492f589
- MD5 ae4c77285cdf81dc69ceb29d949d33cd
- SHA1 7801a805ea7bc3c4037a6843697c7050ab36b972
- SHA512 e9e6c7c78bfd96118468cc9f48d111ddd5562760b05ee0dd9377c6bc4ba1cef89bd512ade5bfaaf2363d6931e1bd024f7fdb4a64b7fa22e781006c0a39a9e28a
- TLSH
  T10A4161CC5FA8588080DC8BC53F53D8981D97F69949C78D51C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral28
- Target
  UI/resources/app/out/vs/workbench/workbench.desktop.main.js
- Size 11.0MB
- SHA256 6bea55d21c1a94193a811941c59db4370fb875e90e11b1955c087f1d046f693e
- MD5 18bbd1e7a61bff5470285d607b92e6be
- SHA1 d7dd1fd0f58b5d35f0ce71537f73a722cae5354f
- SHA512 67f18277ac3dc1d4813ba686ece8d2b9a6117e29c62eae1642e344a5388bfe690c55feb9311b435e8cd93583eaf642aa9173e7e77d36895106078f010ce1aa6e
- SSDEEP 49152:rriuOMnm6s38Vg+fvzG18UpBzxe0O0QAgvNo+5pY9ILsj93/uzTEev+Baj9oSoKX:DNXRBs92BNmypZ
- TLSH
  T108C64C97329A247346DA90EAEC760003A2395155B40DA06CFBFC5CCE16DFE897276F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  uninstall.exe
- Size 432KB
- SHA256 ec6cba90113312562fe5b91bfd13b32b8d34d143c7e284403c2326574c244e6b
- MD5 8c26d80875b69590b2d086a495e0cde0
- SHA1 e1b8ed7bcb12979684323f643a4557f3f6748830
- SHA512 41d5dc1e1c7019f08c0f89fecd846d1c9d607e2a9a2655f3387bccc2118d1372a52c4d3d49cd96e894e44218dbd80abbf44f430f312acfe3388850bcb41a390b
- SSDEEP 12288:7X4pMJ0gLuX+NjAG/Bk02Iqukbs08rZ818b7BPQ1:z4pMJXaX4jl/SIqHs0uZ81qU
- TLSH
  T15994016533E5C807E03409315BADC7B36B69B9D0FA29DE0B33D0167F6D516C2BA1A24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral30
- Target
  windhawk-x64-helper.exe
- Size 18KB
- SHA256 d8f771ca3bf96dadb24767603acf01255c2b3bc509c9d7faf463edc388dbcd99
- MD5 a11128109315ed9c31b397cdcd411392
- SHA1 2ef9d4f3518acb95a67f17e5fd0c6bc6acea6cf3
- SHA512 dcf3539a68a1a359ac5c11d33842be6d48493bda2ed37b5f17352f4db82b0e25c2e17ae52d7b5202e20c3b13970105bf1860610c1f81a1e13ec7698e4ccf3837
- SSDEEP 384:BImrj8kK8KkK8pvZYLX2Ip4Q0Q/qjdAA1m5wMr5DRuV6Nlm+d:y3J8RYT2Ip4Q0Eqxf1mlr5AUNlR
- TLSH
  T12A824CCA4A784103EF83BE70E3D8D983BA7C97E3A862865774A9D18509473D1F74513E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  windhawk.exe
- Size 815KB
- SHA256 52db87dee0160a13cf51e31bee6320da09767582f1f359f8cf9a787d1228bf44
- MD5 fee446a7a51556046a5979ef2e983182
- SHA1 b13a3e2e666cbfee618a13025fb81759fbf41320
- SHA512 2d767fff8c67418af355ba4766d3cd37b5672726276b82cb6474cd6083e43110f46921881b847f32e09a15a052d04fa03f1f8fe10a3c8a98db1790570c5bad23
- SSDEEP 24576:YJPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0x:YAoUkI4ujKeT/ZvTDrHjBqmu2x
- TLSH
  T1F9054911779AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32