plugx | d05255f0fa586e5eca2e7d5c15451843e20810139596dc5695a8deaa4c3d7882

Resubmissions

23/01/2026, 17:57

260123-wj35lscz8g10

23/01/2026, 17:50

260123-wevyfacx7f10

Analysis

max time kernel
52s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
23/01/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HPSmart.exe
Size 1.9MB
Sample260123-wevyfacx7f
SHA256 b30239064a8ff5ede80b2a97508fb58ad8c39d6bbe27b3ce5d6dc9564dcf766b
MD5 5475767bdb89f712cd6272797857af04
SHA1 3508fc2ba5a3508f88cfcffdbb0808b498a04b03
SHA512 316caf60955a3b7b3ac5beca07e48d941cb9ab27d8a697ae90e98a59e955adee686b415f38d1276cc181c68d80ead4f5d7bd239a37352cdf2d048866d96ed849
SSDEEP 49152:cCqBiiacEvl6ooqyE+DGgW0fQi6WKsGMCrPqrKxRkfUzavFg9SirFDGIiCGgPLZj:mMiaXliqy3GgWyF6WKsGDrPq2LkLFtiP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware discovery execution plugx persistence spyware trojan

Malware Config

Signatures

Detects PlugX of Earth Preta campaign 12 IoCs

resource	yara_rule
behavioral4/memory/4916-10-0x0000000003A80000-0x0000000003AF6000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4916-2-0x0000000003B00000-0x0000000007784000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4224-20-0x0000000003220000-0x0000000003296000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4724-19-0x00000000035A0000-0x0000000007224000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4724-21-0x00000000035A0000-0x0000000007224000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4724-22-0x00000000035A0000-0x0000000007224000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4224-24-0x00000000032A0000-0x0000000006F24000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4724-23-0x00000000035A0000-0x0000000007224000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4724-32-0x0000000002C80000-0x0000000002CF6000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/1036-28-0x00000000038D0000-0x0000000007554000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/4564-37-0x0000000002F30000-0x0000000006BB4000-memory.dmp	family_plugx_earth_preta
behavioral4/memory/5384-38-0x0000000003A10000-0x0000000007694000-memory.dmp	family_plugx_earth_preta

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Executes dropped EXE 5 IoCs

pid	Process
4724	HPSmart.exe
4224	HPSmart.exe
1036	HPSmart.exe
4564	HPSmart.exe
5384	HPSmart.exe

Loads dropped DLL 5 IoCs

pid	Process
4724	HPSmart.exe
4224	HPSmart.exe
1036	HPSmart.exe
4564	HPSmart.exe
5384	HPSmart.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3622034013-663316015-3001627260-1000\Software\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 132"	HPSmart.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 380"	HPSmart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3622034013-663316015-3001627260-1000\Software\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 380"	HPSmart.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 132"	HPSmart.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	HPSmart.exe
File opened (read-only)	\??\F:	HPSmart.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Version Vector	HPSmart.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\USER\S-1-5-21-3622034013-663316015-3001627260-1000_Classes\ms-pu	HPSmart.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 35004600320031003300340032003900380044003600380041004200410035000000	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe
4724	HPSmart.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	HPSmart.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4724	4916	HPSmart.exe	77
PID 4724 wrote to memory of 3904	4724	HPSmart.exe	80
PID 4724 wrote to memory of 5032	4724	HPSmart.exe	81
PID 4724 wrote to memory of 5060	4724	HPSmart.exe	82
PID 4724 wrote to memory of 1252	4724	HPSmart.exe	86
PID 4724 wrote to memory of 4152	4724	HPSmart.exe	88
PID 4724 wrote to memory of 924	4724	HPSmart.exe	90
PID 4724 wrote to memory of 4080	4724	HPSmart.exe	92
PID 4724 wrote to memory of 4780	4724	HPSmart.exe	94
PID 4724 wrote to memory of 1824	4724	HPSmart.exe	96
PID 4724 wrote to memory of 2932	4724	HPSmart.exe	97
PID 4724 wrote to memory of 5648	4724	HPSmart.exe	100
PID 4724 wrote to memory of 2132	4724	HPSmart.exe	102
PID 4724 wrote to memory of 1536	4724	HPSmart.exe	104
PID 5060 wrote to memory of 5552	5060	cmd.exe	106
PID 5032 wrote to memory of 4308	5032	cmd.exe	107
PID 1252 wrote to memory of 6076	1252	cmd.exe	108
PID 4152 wrote to memory of 2152	4152	cmd.exe	109
PID 924 wrote to memory of 3500	924	cmd.exe	110
PID 4780 wrote to memory of 3128	4780	cmd.exe	111
PID 4080 wrote to memory of 3056	4080	cmd.exe	112
PID 1536 wrote to memory of 5272	1536	cmd.exe	113
PID 2132 wrote to memory of 5492	2132	cmd.exe	114
PID 1824 wrote to memory of 5640	1824	cmd.exe	115
PID 5648 wrote to memory of 5620	5648	cmd.exe	116
PID 2932 wrote to memory of 5416	2932	cmd.exe	117
PID 1036 wrote to memory of 4564	1036	HPSmart.exe	120

C:\Users\Admin\AppData\Local\Temp\HPSmart.exe
"C:\Users\Admin\AppData\Local\Temp\HPSmart.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Public\HPSmartclbl\HPSmart.exe
  C:\Users\Public\HPSmartclbl\HPSmart.exe 132
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exedel %0 /tn "HPSmart Update" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exe /create /sc minute /mo 30 /tn "HPSmart Update" /tr """"C:\Users\Public\HPSmartclbl\HPSmart.exe""" 128" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /create /sc minute /mo 30 /tn "HPSmart Update" /tr """"C:\Users\Public\HPSmartclbl\HPSmart.exe""" 128" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exe /run /tn "HPSmart Update"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /run /tn "HPSmart Update"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "AdobeDesktop" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "AdobeDesktop" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_2" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "ZBT_0.1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "ZBT_0.1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "LKUFORYOU_1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "LKUFORYOU_1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "AcroRd32" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "AcroRd32" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.00" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.00" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "LKUFORYOU_2" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "LKUFORYOU_2" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.03" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.03" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.02" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.02" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe" 132
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4224

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Public\HPSmartclbl\HPSmart.exe
  C:\Users\Public\HPSmartclbl\HPSmart.exe 380
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4564

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe" 380
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HPReport.exe

Path C:\Users\Public\HPSmartclbl\HPReport.exe
Size 3.3MB
SHA256 492df82529abe6cb8e927fb1513a4e250c293ec86d802a313515d944d6ea7018
MD5 5ccecdd7a28ebb0401cc98e7fd89ba71
SHA1 b5bafbe629650150c87f4b0fe0c7ddaf1eb7751e
SHA512 0ebb40aadcd8da7bb5de423417026d01ac64dbe882737cf58a98807ca2105f0a8cb7547c9b8d8138d0a4cbd609e8fc0ce0988973d0e25b18d5eeeb168c730e74
SSDEEP 98304:R/Fuk7b1n4vJfqvK+MiKibCh2VhFLOAkGkzdnEVomFHKnPtPv:RbbJKibCh2LFLOyomFHKnPtn
TLSH
T1D4F5BE513E88B86AD4530E31BE99F67FF1EEBCB41A3B03471191B6197A326414B1DC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPSmart.exe

Path C:\Users\Public\HPSmartclbl\HPSmart.exe
Size 1.9MB
SHA256 b30239064a8ff5ede80b2a97508fb58ad8c39d6bbe27b3ce5d6dc9564dcf766b
MD5 5475767bdb89f712cd6272797857af04
SHA1 3508fc2ba5a3508f88cfcffdbb0808b498a04b03
SHA512 316caf60955a3b7b3ac5beca07e48d941cb9ab27d8a697ae90e98a59e955adee686b415f38d1276cc181c68d80ead4f5d7bd239a37352cdf2d048866d96ed849
SSDEEP 49152:cCqBiiacEvl6ooqyE+DGgW0fQi6WKsGMCrPqrKxRkfUzavFg9SirFDGIiCGgPLZj:mMiaXliqy3GgWyF6WKsGDrPq2LkLFtiP
TLSH
T173958E3177F2D077D2733A30952EE379A6B9B6700E39434B52904E3D2EB15C2992876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstanceFinderDlg.dat

Path C:\Users\Public\HPSmartclbl\InstanceFinderDlg.dat
Size 469KB
SHA256 2d53ae31c6df51173129d12a90f11b0412e12bb4d9901042d162d66a18880eac
MD5 3d96797cc297b8cdf4c9f4a52c035c48
SHA1 c1b53f3b1e02fd5be70d94cc944ba1f1eebdd252
SHA512 50a786f3de022b0c8328e2a560df1d23137b8c68aa2ead6b9b714af07591558656d715239fda72d262a6f43457260d1489b730e6ca6d2e8c7ab7f6d685648144
SSDEEP 6144:eD8noYrAH1TrR+orPFmJo1YD50XZyP/I7Y+hEeBY/oi2IQU4NEKb0+zDcLx:eDyUrRtw9D5I4/IjEeawitB8Ex
TLSH
T1BAA41A212851CAFA58F7556F05AF431963B1E52DC4DAFDC8A6D28BCFDAB2148C1B7B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstanceFinderDlgUI.dll

Path C:\Users\Public\HPSmartclbl\InstanceFinderDlgUI.dll
Size 754KB
SHA256 4a0dfe9a33ce169986ffef8d40a44f2ae868b15976443b5b87756c8146d27478
MD5 dd0a9a725528bbf363ee7ad0a4fabdea
SHA1 150fd577f5017d590cfdeb93b2160d21816b59c4
SHA512 fbf277a37fe8a214b4fde6ce5d9994f55f7c42cc59eb0f855ae540c6317163a7a729b8326ff2125a9241244658a3a4d853b8c4ea9cd315dacbd6ec67bf62ed09
SSDEEP 12288:hvhS4iOAZRC3E+L6IR+KVDh4WKpUHg5XuuZKlEGq8H9WN/4r2fi7OBzDp:hZS4nAZRMUKJhEpSg5XlhGq8HQNQifio
TLSH
T1F0F45C5149CE40E2F5C51AB328FBF75A25B2377295708EDBC2A8AD4DD3643E242C391E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-28-0x00000000038D0000-0x0000000007554000-memory.dmp

Download

memory/1036-27-0x0000000003850000-0x00000000038C6000-memory.dmp

Download

memory/4224-24-0x00000000032A0000-0x0000000006F24000-memory.dmp

Download

memory/4224-17-0x0000000003220000-0x0000000003296000-memory.dmp

Download

memory/4224-20-0x0000000003220000-0x0000000003296000-memory.dmp

Download

memory/4564-37-0x0000000002F30000-0x0000000006BB4000-memory.dmp

Download

memory/4564-35-0x0000000002630000-0x00000000026A6000-memory.dmp

Download

memory/4724-21-0x00000000035A0000-0x0000000007224000-memory.dmp

Download

memory/4724-22-0x00000000035A0000-0x0000000007224000-memory.dmp

Download

memory/4724-19-0x00000000035A0000-0x0000000007224000-memory.dmp

Download

memory/4724-23-0x00000000035A0000-0x0000000007224000-memory.dmp

Download

memory/4724-18-0x0000000002C80000-0x0000000002CF6000-memory.dmp

Download

memory/4724-16-0x0000000002C80000-0x0000000002CF6000-memory.dmp

Download

memory/4724-32-0x0000000002C80000-0x0000000002CF6000-memory.dmp

Download

memory/4916-0-0x0000000003A80000-0x0000000003AF6000-memory.dmp

Download

memory/4916-2-0x0000000003B00000-0x0000000007784000-memory.dmp

Download

memory/4916-10-0x0000000003A80000-0x0000000003AF6000-memory.dmp

Download

memory/4916-1-0x0000000003A80000-0x0000000003AF6000-memory.dmp

Download

memory/5384-36-0x0000000003990000-0x0000000003A06000-memory.dmp

Download

memory/5384-38-0x0000000003A10000-0x0000000007694000-memory.dmp

Download