039372098e8c1c219a5284999e2f701cc041943722b638df55137b36d64ff58f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hedgehog_Client_Launcher_Setup.exe
Size 19.4MB
Sample260529-pceecaby4j
SHA256 039372098e8c1c219a5284999e2f701cc041943722b638df55137b36d64ff58f
MD5 53a9b34e46ec85aae6d23c9941c566fd
SHA1 528913090726fc376813f0402ca07da52845a4dd
SHA512 4e2d99c1004c384b67010d4a28946fa14d7f9ae320d9c14013cb4cd983b364e7e6dae6c984920b579999d71a78b6b27dd45980bbf33ec59081f20f81abd077f5
SSDEEP 393216:fZ4fwIEH0DOW3lccQhmXnXAvbPvPdILr+1nW0m:fwwJUDOW3l5XnIbCLr+Rh
TLSH
T1CD17333BB5B8653ED1AE0B3606B3C210597B7B91A90B8C1F07F4004CCF669B16E7EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/files/0x001900000002b514-161.dat	SmartAssembly
behavioral2/files/0x001900000002b513-172.dat	SmartAssembly
behavioral2/files/0x001900000002b515-203.dat	SmartAssembly

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-I98HR.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-01ACH.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Pdf.v25.1.Drawing.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\log4net.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-JT8BM.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-68A0A.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-GTFJN.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-HQ2R4.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-KO43V.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-VGHH0.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Diagnostics.DiagnosticSource.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Pdf.v25.1.Core.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-5K43S.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-00B4Q.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\fr-CA\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-G3HLG.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.IO.FileSystem.AccessControl.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Newtonsoft.Json.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Runtime.CompilerServices.Unsafe.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-LPH1R.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-S3RJD.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-4OGMI.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-CJGBE.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Newtonsoft.Json.Bson.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Threading.Tasks.Extensions.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Core.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Security.Principal.Windows.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-NPV7G.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-6NC9O.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-FMF0L.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-US\is-CFMIQ.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-7QB5P.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-E81VO.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-1VL60.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-N2EAG.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Numerics.Vectors.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Themes.Office2016White.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Microsoft.Identity.Client.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-US\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-MG8JD.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-61O9M.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-3112C.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-M9K0A.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Editors.Wpf.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Web.Http.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.UI.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Security.AccessControl.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-BHLAA.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-CT4FK.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-ETHR6.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-UKP4L.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Themes.Metro.Wpf.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-LA4L3.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-LUL8B.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-9CQE6.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-7O7PN.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-CA\is-3PK1U.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.Desktop.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Microsoft.WindowsAPICodePack.Shell.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Security.Cryptography.ProtectedData.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-0CJ7E.tmp	Hedgehog_Client_Launcher_Setup.tmp

Executes dropped EXE 2 IoCs

pid	Process
4836	Hedgehog_Client_Launcher_Setup.tmp
5200	HedgehogClientLauncher.exe

Loads dropped DLL 36 IoCs

pid	Process
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe
5200	HedgehogClientLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedgehog_Client_Launcher_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedgehog_Client_Launcher_Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HedgehogClientLauncher.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5124-1-0x0000000000400000-0x00000000004D4000-memory.dmp	innosetup
behavioral2/memory/5124-11-0x0000000000400000-0x00000000004D4000-memory.dmp	innosetup

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4836	Hedgehog_Client_Launcher_Setup.tmp
4836	Hedgehog_Client_Launcher_Setup.tmp
5200	HedgehogClientLauncher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	HedgehogClientLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4836	Hedgehog_Client_Launcher_Setup.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 4836	5124	Hedgehog_Client_Launcher_Setup.exe	81
PID 4836 wrote to memory of 5200	4836	Hedgehog_Client_Launcher_Setup.tmp	83

C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Users\Admin\AppData\Local\Temp\is-PRRT9.tmp\Hedgehog_Client_Launcher_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PRRT9.tmp\Hedgehog_Client_Launcher_Setup.tmp" /SL5="$7029E,19459048,814080,C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe
    "C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActiproSoftware.Editors.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Editors.Wpf.dll
Size 918KB
SHA256 ccea16b08c1f9f867d9ae546d721ab4fb7ff08c8ee194963ef7ee069ac8d94f3
MD5 4ff277674e9879593fa047dd1807b1bc
SHA1 32cd070fa7fc8bf3c0a26255400b941917be7e5f
SHA512 e94043c82baf8069560cc3f730587391fcae73daf7d9464390cb1e4e63a0175edf89f45e270a09baf6353f551616fbb68d9ad6b857347e01e16bdcf22de9f45e
SSDEEP 24576:3a2fEbUoHWHtsD8dNqgVtxmNa8mPp7aiiwJEE4mhB:4bUoHWHtsD8dNqgVtxmNzm
TLSH
T166157C9173204DA6C18F0E779C8015089734D652AEEEDB7B6CC17E6C6D6F7830E6A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Shared.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Shared.Wpf.dll
Size 2.1MB
SHA256 0f99a631a586d4c106415487d352263ce26d49c7c56cbe00653751884a957c1f
MD5 fe67b59c021f4c5dbfeb8d3dd679401f
SHA1 99ab864919f3b730aecdafdeccc9374f0ebdef45
SHA512 724e88fbac8758a6af9dae6d83704e86c06657e149e2850f9f27fe742ba46239afc7b541a121253a769c9170959f21bb0800a98a7766b5e7eae3e58ce94be92a
SSDEEP 49152:nIjwtRliwUY4NxFngHsVHpfrYx9Dv7R79Ngys6SyTpjj8wYHmyPQoH:I3
TLSH
T15FA5D801F04A8037DB3B6DF758B81884190972F5E644EDB5875527ACFAF632C04ABEB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Themes.Metro.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Themes.Metro.Wpf.dll
Size 278KB
SHA256 9ef43dc0ea5b6f405129a5f192266c094b4a6452bff27fb9c7479de86eb93628
MD5 9fa0749a3f1e4c482d2fe028a0b3de06
SHA1 7d77c957c948c500589238cd06c2264d0d0024fe
SHA512 31ca0153d1b52fa171f9cfb86e9275d25a1738b47abe3bdaf59fac98e1b3934a11a4d77a52b8b4014e5a9e0494930231c1c7e9aba6231f244151d0927eb9b7c8
SSDEEP 6144:sY9X3g2x4w4/N/AUh6QwNHaA234XpfBdBDp8GQElKoojoj36UW0okYaf:r3gg4w4/N/AUh6QwwA/XpfBdBDp8GQEl
TLSH
T10054CA06E10A8133EB3B7CF348BC5898054873FAE555DD758B56532CE6E2B3808DBA36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Data.Desktop.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.Desktop.v25.1.dll
Size 1.2MB
SHA256 d49d4bb08fd860e26ac6561ab6577120408a34b4377397b117e4127359af7cde
MD5 1a23fcf6d059c29f7bbebcf5f642ce5c
SHA1 9c222d422bce17c150693db9be7bbda1d02dfab6
SHA512 c3de3f4120a77bf1681f777b32a187881fd2150055d2d0a0befb820a1aa10fac8ef4979efb8a10b12aab9059f3b296fb48f02e84777cf151e3bf193f4dc499b2
SSDEEP 24576:rmnkYkPkXkFkhkhbJtd2S0PSRcGtaAcHsb7qmRRTADrTgRRK1+BYt/Cm9B9eJ7wO:SnkYkPkXkFkhkhbJtd2S0PSRcGtaAcHQ
TLSH
T124454C22F3BC6A9BE89F0A326463130417F1D579972FAFAE5514B9FD3E123018B54263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Data.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.v25.1.dll
Size 5.6MB
SHA256 00ba3c2838361d7f300255938b6f94a4da192105e9afea7c3010d1767a02ccdc
MD5 2358fb8cbdbf7fb8492312627678abb0
SHA1 f81b416e6271cd388399cdf2ec0f328bbe3d8de7
SHA512 0019b28c336e9eac75ff665913fb696877e66bf38398b1f745d50cceb80bdceab77c89e3887d82de4cac993d038441629e8d0fd75f093b90568360538d1dc55f
SSDEEP 49152:BRJb6LIAECyO65XVLE8HVzt9jd9Q5u+46hNGEqHCN6cygNkp1h1Kw1qBXX2BhfT2:BRgIAEH3XVLE8HVzt9PQ4gGEDDygH
TLSH
T188565B01EBEC8F3AE4BF0277A972012503B5F9999763D75B2500A4F93C53780AB917A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Mvvm.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Mvvm.v25.1.dll
Size 1.5MB
SHA256 597345eb971e57e88739f68d094aad72485a40633914b523a5c9f35ac7274f1c
MD5 1e3011e9b2b6947fbccb8b3d6d930026
SHA1 604dc757861e6cb113f245e009eb65094fd38d9f
SHA512 43a41c6cfaf965acc8782e278d3b3b2b85a013f21ab3b01ed53eb931c79f6d6cff96c02ea3f2b2052e2d16d269670d5942ef65e766a3d5a703b8c0f70dab6140
SSDEEP 12288:LPBprv/xzpXE5ASrZTDaATHR10wUF6SFh3EB2KSfXnJyZhMQZhKZq4qoLq:dTtSdHH5bShUB2vnu1l4Dm
TLSH
T1487580CDB744E63AFD2B4432EC613036BAB0ED91F335E3650368D5292F463660E8D5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Xpf.Core.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Core.v25.1.dll
Size 11.3MB
SHA256 59b8ffb21e1ebbbb299e46a08cae834da2a73c2be3f0020ebc27334871afa904
MD5 3c480d632b44c238a00ec13d138979cc
SHA1 564ac783b4f666a17a924d007699a5ddaf30bf8e
SHA512 96bfc5ce6416c1e4faf2cc6603fe53581ca4ea33027544ebf3787e4fe81c8869e94d22e4743f0abf2da79154c116765074de9596fe92853c43c76a53cd84672a
SSDEEP 196608:v7OxFJotWZApAVJART+/Ybzg6WAOfraPN:agq3ml+/Ybc6WAOfraPN
TLSH
T1F4C65C115BBC8F3AC56E1379E411121052F1FC846FE4D6A92245BBBE3DA3B024D927BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Xpf.Themes.Office2019Colorful.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Themes.Office2019Colorful.v25.1.dll
Size 9.2MB
SHA256 05ddb549109504d9d63646a2425bc0f778c5de73a83f4b27b7f0b3715a4b2da6
MD5 0022b2e10890aaf2928f0ee2150abcbf
SHA1 d13f32cd2f488db4a126d56e65ee0bcd68ba4652
SHA512 47921465018dd1516bb59a7a598a1d7769e50ecac42eaf97aab95817c0c07b6a288c347d23a6f67a7762188365ca95254b0b7b85a9739c4e228525e8d53b2190
SSDEEP 49152:wODXCRExwEIbLpiQ3AArhuKJdB+85eesX8uzLGc:+bLpikdbeesX8uzf
TLSH
T14BA65A7965329A7486120F3E3440F644AA3672C2AFD0491FB2195EFE78978534F22F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Core.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Core.dll
Size 375KB
SHA256 b35fbfca683fe4a611c232da6b63ea4959a2583d4ad2f0c57542abcf4ec385a8
MD5 7d2e8a2e8d63f92233214661c5127db5
SHA1 99e5a3d80b50a57a600cbcbcd596a4023bf56f98
SHA512 9c0f76a12c28e7d307f0475d506f7736bef1127d99d57fecceaf4956dcd3b579a9b612071cf6e9622b3dec6acffd53dbc75decc35df164fa0c4235d3879aa04b
SSDEEP 3072:PR3nOl5R4QY22rVp+xDRvI90/amoEtKmkutYfLqDVysf+aIxJTM:p3nOav2Kp+i90HRkDfLMVysf+aIrM
TLSH
T1468451637BAD2435CAB81AB6600093C425577ECCE6FC7FCDDC14586E4EA9A038BC1D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Resources.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Resources.dll
Size 2.7MB
SHA256 dff5e76a6a2d082cb3279b349eab1d8db8d03f4ecd4d729fc8e71934b28421e8
MD5 9e79d18b2fd1bf5251628e0466ae2c0b
SHA1 4aff28a24416e707c099d5a25f4678d4e4cdcc6e
SHA512 5cf9bb62e53d09a3185baf979a994191ede0e58aea24ded7135cadbcd7b4c672c85ca332783abcc9107dbedc5e39b268c7f0dbf6f3b738ec0996c229ae02e6cd
SSDEEP 24576:ML5BMsH6XwXsA7V3/3fkZH9XxTO8kOyGHlo3:ML5+U7tffkZH9XVyOyGFo
TLSH
T17FD511127DEA6A2EF64770F49FCDF59BDAADB1E403C3411B28D4236F01928425B53A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.UI.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.UI.dll
Size 4.3MB
SHA256 46663a8d603c1056799ecb427cd421f5964322befc1857af0d90df0455842650
MD5 3cca61df3caa3a659ffc0bbe6ef93c80
SHA1 6827e24cf99a7e2d5501964339d8c5ce95eb3922
SHA512 f70a8793c6018336c52afd94738fbc3dc12ff2c84aa68e85345966d6274c8a952e98168fb4b5c33a70b1b8608321df43e385cfbd7a7cc3a4cbbf96a3da00cf78
SSDEEP 98304:MFXotQHMMMMB3WQEMMMMB3H4X8h9tsnsVX:PQIQm4AMK
TLSH
T1E126E183D3F0EC17CC1A437C489581034AFDA618A365E36E7CCE2C5EEB6A5D18E9C659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.WebApi.Dtos.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.WebApi.Dtos.dll
Size 130KB
SHA256 6bee2b9c72b42adf153e621a1db43e5787f5a28acd51493d399f6de2623bbb9a
MD5 9f628b21291f84fddd1d7eafd341460c
SHA1 5aa4262d2cb012e617d22bafdd63c284ffc82a13
SHA512 ac46c8983abeca828c4a665d8f80cbdba6ae33169e9e9db2a31e936273ee5dd9715a78f8fb1e3bb1351dd8d2c2a0dfb48a5c3231cb1a798d2ac791e4e2741f12
SSDEEP 1536:fE8CXBWNkhWPKHSKeVphHsPN6QM9l72epB8tdHdwSe7eii9/mfIbHqvm:mBddiVphHll7TsdHdweHT5
TLSH
T189D3B616137CD2DDF6A70A39F1304C2D0EA7B689F813D9F99B24E88E3A25B0DD5045B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.exe

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe
Size 250KB
SHA256 9e85f4b4e5cf900d5a7c357b584eccddd806f0a9f1ab282c1c1b208c2d9ac7d1
MD5 fe235e54d14e866586cb016a762630bb
SHA1 47d15aec60518baf3b083fbf12881f9bc9b98fbe
SHA512 2329d5dc9a69836dad5de93beb4a8fdf853928a0121f1f21a11bddda0db6f4f8a54e5034a2bfa94da7bd86e95ce94088803c023bbfc9612d77730223d193079b
SSDEEP 3072:2dzPUhukRf57a0DCwxJmnDqtrEJahxUKeoV68zuq5sZO8hbLxUKz8tajTT:pNPCwOm2qVp6q5b8hbqTaXT
TLSH
T10744AE1037B84677C6BF8A34E4A492600776AA47D457EF8A5D58F0EF1EB3343866123B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.exe.config

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe.config
Size 4KB
SHA256 690a312718a4a561b29af509f1c876caaeccdd59af302c9b1496aabcef4b976b
MD5 7cbbf5cef39958f90f0411d3596db29c
SHA1 da022acd398a05ba5f642ba6202998d3cade0f10
SHA512 73e6ebeff790e13d9b9166ee748dd25f0998cad54776c5e998abb2bffdd2990686fdc68dce325f3e196735579018aedf4d6281541161c19b3e0e81edecfc559f
SSDEEP 48:35t2e8XNCzSHPt/5r4bpqQ6YYszhzPsM7r97O7kHSvfp+v+ijohT3+q5l9+qp+b0:qe81vZ5rmYjohXrVtmVi9rP5K
TLSH
T1F391B011E9CCBFA0077209A67A6A5C61CF6D03F7190C0A8DB0DE778F4F3A9594617275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.pdb

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.pdb
Size 245KB
SHA256 f71aa54df3dba33abfe6634ff8b6ca824d97945f01a96ceee5b7ae94613fb907
MD5 49461dc425579f2bf9cf3e03a2f2b7e5
SHA1 7ea01dc125f73944a8dd8988ec433c8582a74146
SHA512 6474fef547c5924d512d21da287badaa0925e02ccb958c9ccc35fe110842feed9a24f010b695170c56f53f4c8558dbcf00cf85f7012f6c0bc2a5090ac0969897
SSDEEP 1536:ehgS3et1zB/5P+YGeT6BUTK3p/nXNP7TfDtppI7vkFa4muWXjluiM5Px62B:eSN1lRGYG1RxtppI7zTluiMZxx
TLSH
T1F734B512BF58D532C06886385AAF8B0D4B38FAC88B43572F5B55F02D7DE534A1F96394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgerow.UI.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.UI.dll
Size 212KB
SHA256 b2659a2a314e536e35fd76ecd2c0d70deef82a6695d3a11f5d8756dcece54506
MD5 9af24503554ac90dcf7af3aeeb63bc92
SHA1 00f44ecc26f48d13ae3f7045c43d088e11b90ca2
SHA512 23dd83e7b2ebd9ddf8b933426d602a0f3f60f972f61e1b04bcf88ccf2b723814f0d47163790cfce411ed5f062ddec2814f73fe1eca7e4dcfce5462a823e41733
SSDEEP 6144:ViLAWr/ySJuwRuN/n/gExmzISJXYk6KVDs5:ViLAWr/ySu/gExmzI2
TLSH
T1F2246C9073FC4239FAFF6B36A4B0A1145530F523D992C76D58D219EC28B27866A02F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgerow.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.dll
Size 375KB
SHA256 2187637cd6eaea690e744fd3d5afc2ee65846f1e479f89a5ec255a0aff714533
MD5 49c2e6955ad5e35d4f161b6807504fd2
SHA1 3e182d60bc36afbdfe85e7062cbf69e81f8dc269
SHA512 4c8a8ef5da57a337918703c593862ad7ba0baa948425a94e247966d71d2256974de86d97ceff00d9746c776962d644187bb649f0bc8740fcd1997e88fd46cdc6
SSDEEP 6144:i2If+c+qFcm8IZJRbetlVbIo/O+uD+uEq1sq2NkL7roQtm79iSJn:C+Ucm8IHylKoTq1a+Nm7U
TLSH
T1BB844D9577F84316E1FFEB36FCB015140B7AF946A96DE78E0A8460AD0CB27849850B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Newtonsoft.Json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Web.Http.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Web.Http.dll
Size 443KB
SHA256 fb2c216b321390fe726bdb842b14343db999d372b6293568cc778966fbd8f64d
MD5 e9ee73215ff2b30dc3d31f0336d09fa4
SHA1 371923c0ac6f7142d0d201829ee413d59091de4c
SHA512 60a3e80ac392de3c45d2724caadb5e2466b2956f3eff91296cb65d2a8f90bb9fc2c244ea3172d2a3d5022f92cb0dbb8775fbdd24071a1aa0ebf9a525346371ce
SSDEEP 6144:giJ5Q3WxGPl7/q20xeIs6t3nYTKN+O4RP/KZ7vFXcUkOH0uIs:V5upNoKC3PYO4x/KZMqIs
TLSH
T16AA46A2163FC0F2AE5EB4BB9F031496887F5FA526105D72F2949F4B91C937828D11BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Resources.resources.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-US\Hedgehog.Resources.resources.dll
Size 1.1MB
SHA256 f1f8124983d89ae60872cc31bcad48824d110a3b890d03f4c4e490ce0a7ef7a7
MD5 a81b368a97f1b1298f4dff6d55d6844d
SHA1 9279401d159b1de934fb0ec69b98fcbe85552172
SHA512 d3e276a0aa2ef8b5a535a965bb88c356fc599c0cc77343a13794bdab9a4da3ea20d9cf44c6ae64fc588cade156ca77195b48a7017920161e8015cd853dff5989
SSDEEP 6144:bu2+N1vJsPkcswZOWs5Q4yXQ2Go1h9+GQxZHrrx7W8GUwKlg9PSjNb4Q:i2UOPcQ4yXQot+GUtr88D
TLSH
T1E735B9257DEF382DB993B5E56FCAE2DFD326B1E84353022F10A6531B52A28014B53D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\log4net.dll
Size 264KB
SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
MD5 27fe8d18682fd9901e589e65ef429b23
SHA1 6426e96243911beab547f2bc98a252a26692f11f
SHA512 9d6bc8c77c72cbad15e808281818c2768f1b44aa6ea1d54a979c91218b8fbf2a02fee49fa97db6cfa6087ddc363d6cdd6407e4494934b4568c514437030a2615
SSDEEP 3072:HG0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCj:HJrycoB3HVeESME3pnaVTS1nh7hCa
TLSH
T1C544195877F84A59F2FF2BB8A47644154BB5F816B87ED39E0A80A4EC2D33B108951373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog_Client_Launcher_Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PRRT9.tmp\Hedgehog_Client_Launcher_Setup.tmp
Size 3.0MB
SHA256 dcc9ff8a2f5f0b78a3326b0baa290a883db34600bea1d101cbf4949e340ce835
MD5 ee1cdd9f2c379c23eed649d3d3b9aa51
SHA1 166371840fc13c28e925ffbbfd87c421bdefebaa
SHA512 1ff27fa5f9fc9520e67415285bec921b8940bde75ba3f9cab8816a12eacd179b8f655b07e1bfafdbc98be453c3984b7dfaae158756f49a2845e9fd580d3a37cb
SSDEEP 49152:0WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbp333dr:gtLutqgwh4NYxtJpkxhGG3335
TLSH
T1B8E53A27F28C713ED06B3A364A3386909837F66169128C6797FC794C8F365942A3E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4836-258-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-138-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-254-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-260-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-252-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-7-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-249-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-262-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-247-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-264-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-241-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-266-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-268-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-256-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-13-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-8-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4836-10-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/5124-11-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/5124-0-0x00000000004C2000-0x00000000004C3000-memory.dmp

Download

memory/5124-1-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/5200-156-0x0000000006D40000-0x0000000006E62000-memory.dmp

Download

memory/5200-214-0x000000000A1F0000-0x000000000A214000-memory.dmp

Download

memory/5200-222-0x000000000B9E0000-0x000000000BF82000-memory.dmp

Download

memory/5200-223-0x000000000A520000-0x000000000A5B2000-memory.dmp

Download

memory/5200-228-0x000000000A4E0000-0x000000000A500000-memory.dmp

Download

memory/5200-227-0x000000000A700000-0x000000000A83C000-memory.dmp

Download

memory/5200-210-0x000000000A280000-0x000000000A334000-memory.dmp

Download

memory/5200-206-0x00000000094E0000-0x000000000952C000-memory.dmp

Download

memory/5200-218-0x000000000AE90000-0x000000000B9E0000-memory.dmp

Download

memory/5200-229-0x000000000BF90000-0x000000000C4BC000-memory.dmp

Download

memory/5200-233-0x000000000A9D0000-0x000000000AB5E000-memory.dmp

Download

memory/5200-234-0x000000000A6F0000-0x000000000A6FE000-memory.dmp

Download

memory/5200-185-0x0000000008FF0000-0x0000000009062000-memory.dmp

Download

memory/5200-238-0x000000000CDF0000-0x000000000D720000-memory.dmp

Download

memory/5200-189-0x0000000009070000-0x00000000090D0000-memory.dmp

Download

memory/5200-242-0x0000000009F40000-0x0000000009F48000-memory.dmp

Download

memory/5200-181-0x0000000008F10000-0x0000000008F70000-memory.dmp

Download

memory/5200-243-0x0000000005C30000-0x0000000005C40000-memory.dmp

Download

memory/5200-244-0x00000000FF090000-0x00000000FF0A0000-memory.dmp

Download

memory/5200-245-0x0000000005C30000-0x0000000005C40000-memory.dmp

Download

memory/5200-177-0x00000000087D0000-0x0000000008808000-memory.dmp

Download

memory/5200-169-0x00000000096E0000-0x0000000009B24000-memory.dmp

Download

memory/5200-173-0x0000000008E20000-0x0000000008F0C000-memory.dmp

Download

memory/5200-165-0x0000000008520000-0x0000000008558000-memory.dmp

Download

memory/5200-164-0x0000000008C00000-0x0000000008E1E000-memory.dmp

Download

memory/5200-158-0x0000000005C30000-0x0000000005C40000-memory.dmp

Download

memory/5200-157-0x00000000FF090000-0x00000000FF0A0000-memory.dmp

Download

memory/5200-152-0x0000000005FF0000-0x000000000629C000-memory.dmp

Download

memory/5200-148-0x0000000005C30000-0x0000000005C40000-memory.dmp

Download

memory/5200-147-0x00000000057A0000-0x00000000057E6000-memory.dmp

Download

memory/5200-143-0x0000000000C00000-0x0000000000C42000-memory.dmp

Download