91548b162db29dbd8e8cd16290c7baf28a801b047f9c5008294661c0057dfcc4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hedgehog_Client_Launcher_Setup.exe
Size 19.3MB
Sample260604-phmb5sft4j
SHA256 91548b162db29dbd8e8cd16290c7baf28a801b047f9c5008294661c0057dfcc4
MD5 59e79e89f599a019d817e4b583ce144e
SHA1 0f0c583b67bd22a84c450838ac48f54abb84fdfa
SHA512 acad51dcaa06eb186cf5980abf727dd3a350d12d14b6740e78ce051bce2d81659122d817a073a1eeb565b47197f4ac76c25f02aa332745efa4b3e93f31c347e8
SSDEEP 393216:OZ4fwIEH0DOW3lccQhmXnXAvbPLHTnoG+Gmj5pZnp6/:OwwJUDOW3l5XnIbDHTncGy5pXE
TLSH
T15117337BB178653ED5AE473206B392206ABB7B51A9178C1F07F4000CCF6A5B12E7BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/files/0x001900000002b513-161.dat	SmartAssembly
behavioral2/files/0x001900000002b512-172.dat	SmartAssembly
behavioral2/files/0x001900000002b514-203.dat	SmartAssembly

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-88MN6.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-KCJUF.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Newtonsoft.Json.Bson.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.WebApi.Dtos.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-CA\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-EUROU.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-57I2C.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-5NMHE.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-CQ1RJ.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-1UNHF.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Shared.Wpf.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\es-US\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-U3NS8.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-7I7UT.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\fr-CA\is-8D265.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Pdf.v25.1.Core.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Buffers.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Security.Cryptography.ProtectedData.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\fr-FR\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-HA60F.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-UV1QH.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-CNS5E.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Core.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\fr-CA\Hedgehog.Resources.resources.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-6M97D.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-OKC2C.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\fr-FR\is-AMT48.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Editors.Wpf.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Microsoft.WindowsAPICodePack.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Drawing.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\log4net.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-529KV.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-EENAI.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Themes.Office2019Colorful.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Threading.Tasks.Extensions.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.UI.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-7FSMV.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-51GAF.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-RHMF5.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-JS0FA.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Web.Http.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-VUSPN.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-1KH2Q.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-G04VQ.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-LA2VU.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-H385F.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-5OB3V.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-10P5N.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-CA7FT.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-DGSLV.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-4ITPI.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-UQMJH.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-AH6K1.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-CA\is-L2310.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Diagnostics.DiagnosticSource.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Microsoft.IdentityModel.Abstractions.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Net.Http.Formatting.dll	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\unins000.dat	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-MEPMA.tmp	Hedgehog_Client_Launcher_Setup.tmp
File created	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\is-1ELNB.tmp	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Pdf.v25.1.Drawing.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.Desktop.v25.1.dll	Hedgehog_Client_Launcher_Setup.tmp
File opened for modification	C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Core.dll	Hedgehog_Client_Launcher_Setup.tmp

Executes dropped EXE 2 IoCs

pid	Process
3812	Hedgehog_Client_Launcher_Setup.tmp
5748	HedgehogClientLauncher.exe

Loads dropped DLL 36 IoCs

pid	Process
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe
5748	HedgehogClientLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedgehog_Client_Launcher_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedgehog_Client_Launcher_Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HedgehogClientLauncher.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4604-1-0x0000000000400000-0x00000000004D4000-memory.dmp	innosetup
behavioral2/memory/4604-11-0x0000000000400000-0x00000000004D4000-memory.dmp	innosetup

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	HedgehogClientLauncher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	HedgehogClientLauncher.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3812	Hedgehog_Client_Launcher_Setup.tmp
3812	Hedgehog_Client_Launcher_Setup.tmp
5748	HedgehogClientLauncher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	HedgehogClientLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3812	Hedgehog_Client_Launcher_Setup.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3812	4604	Hedgehog_Client_Launcher_Setup.exe	81
PID 3812 wrote to memory of 5748	3812	Hedgehog_Client_Launcher_Setup.tmp	83

C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\is-23B3F.tmp\Hedgehog_Client_Launcher_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-23B3F.tmp\Hedgehog_Client_Launcher_Setup.tmp" /SL5="$7029E,19424011,814080,C:\Users\Admin\AppData\Local\Temp\Hedgehog_Client_Launcher_Setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe
    "C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActiproSoftware.Editors.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Editors.Wpf.dll
Size 918KB
SHA256 ccea16b08c1f9f867d9ae546d721ab4fb7ff08c8ee194963ef7ee069ac8d94f3
MD5 4ff277674e9879593fa047dd1807b1bc
SHA1 32cd070fa7fc8bf3c0a26255400b941917be7e5f
SHA512 e94043c82baf8069560cc3f730587391fcae73daf7d9464390cb1e4e63a0175edf89f45e270a09baf6353f551616fbb68d9ad6b857347e01e16bdcf22de9f45e
SSDEEP 24576:3a2fEbUoHWHtsD8dNqgVtxmNa8mPp7aiiwJEE4mhB:4bUoHWHtsD8dNqgVtxmNzm
TLSH
T166157C9173204DA6C18F0E779C8015089734D652AEEEDB7B6CC17E6C6D6F7830E6A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Shared.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Shared.Wpf.dll
Size 2.1MB
SHA256 0f99a631a586d4c106415487d352263ce26d49c7c56cbe00653751884a957c1f
MD5 fe67b59c021f4c5dbfeb8d3dd679401f
SHA1 99ab864919f3b730aecdafdeccc9374f0ebdef45
SHA512 724e88fbac8758a6af9dae6d83704e86c06657e149e2850f9f27fe742ba46239afc7b541a121253a769c9170959f21bb0800a98a7766b5e7eae3e58ce94be92a
SSDEEP 49152:nIjwtRliwUY4NxFngHsVHpfrYx9Dv7R79Ngys6SyTpjj8wYHmyPQoH:I3
TLSH
T15FA5D801F04A8037DB3B6DF758B81884190972F5E644EDB5875527ACFAF632C04ABEB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiproSoftware.Themes.Metro.Wpf.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\ActiproSoftware.Themes.Metro.Wpf.dll
Size 278KB
SHA256 9ef43dc0ea5b6f405129a5f192266c094b4a6452bff27fb9c7479de86eb93628
MD5 9fa0749a3f1e4c482d2fe028a0b3de06
SHA1 7d77c957c948c500589238cd06c2264d0d0024fe
SHA512 31ca0153d1b52fa171f9cfb86e9275d25a1738b47abe3bdaf59fac98e1b3934a11a4d77a52b8b4014e5a9e0494930231c1c7e9aba6231f244151d0927eb9b7c8
SSDEEP 6144:sY9X3g2x4w4/N/AUh6QwNHaA234XpfBdBDp8GQElKoojoj36UW0okYaf:r3gg4w4/N/AUh6QwwA/XpfBdBDp8GQEl
TLSH
T10054CA06E10A8133EB3B7CF348BC5898054873FAE555DD758B56532CE6E2B3808DBA36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Data.Desktop.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.Desktop.v25.1.dll
Size 1.2MB
SHA256 d49d4bb08fd860e26ac6561ab6577120408a34b4377397b117e4127359af7cde
MD5 1a23fcf6d059c29f7bbebcf5f642ce5c
SHA1 9c222d422bce17c150693db9be7bbda1d02dfab6
SHA512 c3de3f4120a77bf1681f777b32a187881fd2150055d2d0a0befb820a1aa10fac8ef4979efb8a10b12aab9059f3b296fb48f02e84777cf151e3bf193f4dc499b2
SSDEEP 24576:rmnkYkPkXkFkhkhbJtd2S0PSRcGtaAcHsb7qmRRTADrTgRRK1+BYt/Cm9B9eJ7wO:SnkYkPkXkFkhkhbJtd2S0PSRcGtaAcHQ
TLSH
T124454C22F3BC6A9BE89F0A326463130417F1D579972FAFAE5514B9FD3E123018B54263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Data.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Data.v25.1.dll
Size 5.6MB
SHA256 00ba3c2838361d7f300255938b6f94a4da192105e9afea7c3010d1767a02ccdc
MD5 2358fb8cbdbf7fb8492312627678abb0
SHA1 f81b416e6271cd388399cdf2ec0f328bbe3d8de7
SHA512 0019b28c336e9eac75ff665913fb696877e66bf38398b1f745d50cceb80bdceab77c89e3887d82de4cac993d038441629e8d0fd75f093b90568360538d1dc55f
SSDEEP 49152:BRJb6LIAECyO65XVLE8HVzt9jd9Q5u+46hNGEqHCN6cygNkp1h1Kw1qBXX2BhfT2:BRgIAEH3XVLE8HVzt9PQ4gGEDDygH
TLSH
T188565B01EBEC8F3AE4BF0277A972012503B5F9999763D75B2500A4F93C53780AB917A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Mvvm.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Mvvm.v25.1.dll
Size 1.5MB
SHA256 597345eb971e57e88739f68d094aad72485a40633914b523a5c9f35ac7274f1c
MD5 1e3011e9b2b6947fbccb8b3d6d930026
SHA1 604dc757861e6cb113f245e009eb65094fd38d9f
SHA512 43a41c6cfaf965acc8782e278d3b3b2b85a013f21ab3b01ed53eb931c79f6d6cff96c02ea3f2b2052e2d16d269670d5942ef65e766a3d5a703b8c0f70dab6140
SSDEEP 12288:LPBprv/xzpXE5ASrZTDaATHR10wUF6SFh3EB2KSfXnJyZhMQZhKZq4qoLq:dTtSdHH5bShUB2vnu1l4Dm
TLSH
T1487580CDB744E63AFD2B4432EC613036BAB0ED91F335E3650368D5292F463660E8D5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Xpf.Core.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Core.v25.1.dll
Size 11.3MB
SHA256 59b8ffb21e1ebbbb299e46a08cae834da2a73c2be3f0020ebc27334871afa904
MD5 3c480d632b44c238a00ec13d138979cc
SHA1 564ac783b4f666a17a924d007699a5ddaf30bf8e
SHA512 96bfc5ce6416c1e4faf2cc6603fe53581ca4ea33027544ebf3787e4fe81c8869e94d22e4743f0abf2da79154c116765074de9596fe92853c43c76a53cd84672a
SSDEEP 196608:v7OxFJotWZApAVJART+/Ybzg6WAOfraPN:agq3ml+/Ybc6WAOfraPN
TLSH
T1F4C65C115BBC8F3AC56E1379E411121052F1FC846FE4D6A92245BBBE3DA3B024D927BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExpress.Xpf.Themes.Office2019Colorful.v25.1.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\DevExpress.Xpf.Themes.Office2019Colorful.v25.1.dll
Size 9.2MB
SHA256 05ddb549109504d9d63646a2425bc0f778c5de73a83f4b27b7f0b3715a4b2da6
MD5 0022b2e10890aaf2928f0ee2150abcbf
SHA1 d13f32cd2f488db4a126d56e65ee0bcd68ba4652
SHA512 47921465018dd1516bb59a7a598a1d7769e50ecac42eaf97aab95817c0c07b6a288c347d23a6f67a7762188365ca95254b0b7b85a9739c4e228525e8d53b2190
SSDEEP 49152:wODXCRExwEIbLpiQ3AArhuKJdB+85eesX8uzLGc:+bLpikdbeesX8uzf
TLSH
T14BA65A7965329A7486120F3E3440F644AA3672C2AFD0491FB2195EFE78978534F22F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Core.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Core.dll
Size 366KB
SHA256 17ea42de36d583db451c1c7c92548718afbc47b7de74d12019d39fecf7a5851c
MD5 a52580e2009f10bf33ac79b9d5a7d995
SHA1 7ea0b95a3a09814f5c23f29c9a9fa73648e0720d
SHA512 c64c620254c79f55f678598a7c9af959ef44db381187e183933d6ed6e9eb8c8b0d14e77fce96b5b14432ee1687c2a5785bbb012e591eddadb364ce9738c2e1fe
SSDEEP 3072:1zPbS8ff0+cZf+xq1KmlZvMsvFjooEtK8hguYrN6qsR+aI4hTF:tDf8+amxq4KpFg9hqrNlsR+aIYF
TLSH
T1658461537BAD1838C6B81AB6500097C125577ACDE6FC7FCEDD04186E4EA9B038BC1D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Resources.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.Resources.dll
Size 2.6MB
SHA256 4267fff3584afc9f36db339720406838a28de4337304c621ec4dd9b6f42f007d
MD5 94b66a9f69bee1797b7c9dfe8337a93a
SHA1 cd9549daa475166e17ed19f62cda6d02d965c7eb
SHA512 49ff36913dda079af87d394ee631b5bc601d89ee9324ff623f1c10e620468bac0965c26600038ecfd441ec855e284302ea53a7c276ee6f6dda32a54148df3bee
SSDEEP 24576:DLGQnhEWONbSQ/9f7ZH9XnG2bmsG0za3Z:DLDh4lf7ZH9XG0msGqap
TLSH
T108D511127DEAAA2EF54770F49FCDF59BDAADB1E403C3411B28D4236F01928425B53A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.UI.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.UI.dll
Size 4.3MB
SHA256 52fcedae5b6a1df5b7d3b5984115f441149c5e49eb1e8832908dc8314acb58d2
MD5 40c774458afb132e772a3ec02a5f8b12
SHA1 8a98e44ccc63d2b26ce9764381a251d494fb0c90
SHA512 6d95fa376df05bc5e9fbdb95fef5d3e821718b79ac01e76d26f54233155456da1ca2318f16a5358ca4ff4d12c67ee392efe992bcfb1fa5f9a0b5770b884c578d
SSDEEP 98304:jFXotQHMMMMB3WQEMMMMB3H4X8h9tsnsVXP:kQIQm4AMKP
TLSH
T12726E183D3F0EC17CC1A437C489581034AFDA618A365E36E7CCE2C5EEB6A5D18E9C659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.WebApi.Dtos.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgehog.WebApi.Dtos.dll
Size 130KB
SHA256 ca4d7f0f98d24064a2e068f927d12f00109464605e544072dbdcc3c4a1885a44
MD5 94fd15d07fa3e4a5148cfc41eb87f1d7
SHA1 c9cc32e9f153e1d71e5205f89cdd9bb6278a5add
SHA512 18dd62cc23bbe3a75c3dd6abc2b525b37618a2d9cf6833b6bad7165caf536086aace4125052aa7a718d8f0362fae986f209390b3db071cbb2945a58c8ff24a21
SSDEEP 1536:bE8CXBWNkhWPKHSKeVphHsPN6mM9l72epB8tbHdQfYda9nfIkYm:qBddiVphHbl7TsbHdQ+0
TLSH
T1CBD3B715137CD2DDF6A70A39F1704C2D0EA7B68AF813D9F99B24E88E3A21B0DD5045B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.exe

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe
Size 250KB
SHA256 aad4cdccbb1af8d37de758fa8d7bd4d76373efad09401a849a73591e90d7abca
MD5 aab52342882b7bae273af0f853d04742
SHA1 2c782f605afaf684bf78f645e8be13c4f78536a3
SHA512 002ccf2480c03499db9bf2db3cb7dfa900ad72152e6554be54f98591f4af86ced9ba35a331c653d1e9d07f2831074f1cd87808c933753d965bdb89e970414d5a
SSDEEP 3072:adzPUhukRf57a0DCwxJCn5EKtrEJEhxUKeoV68zuq5sZO8hbNxUKzyBaVgg:dNPCwKxUqVp6q5b8hb49af
TLSH
T1FE44AE1037B84677C6EF8A34E4A492600779AA47D457EF8A5D58F0EF1EB3343866123B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.exe.config

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.exe.config
Size 4KB
SHA256 690a312718a4a561b29af509f1c876caaeccdd59af302c9b1496aabcef4b976b
MD5 7cbbf5cef39958f90f0411d3596db29c
SHA1 da022acd398a05ba5f642ba6202998d3cade0f10
SHA512 73e6ebeff790e13d9b9166ee748dd25f0998cad54776c5e998abb2bffdd2990686fdc68dce325f3e196735579018aedf4d6281541161c19b3e0e81edecfc559f
SSDEEP 48:35t2e8XNCzSHPt/5r4bpqQ6YYszhzPsM7r97O7kHSvfp+v+ijohT3+q5l9+qp+b0:qe81vZ5rmYjohXrVtmVi9rP5K
TLSH
T1F391B011E9CCBFA0077209A67A6A5C61CF6D03F7190C0A8DB0DE778F4F3A9594617275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HedgehogClientLauncher.pdb

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\HedgehogClientLauncher.pdb
Size 245KB
SHA256 4c6b5843b350540b1c13d54922b853fd0f116985ca0e434feba443e352c79883
MD5 75e173c844cc60ccc783f78be5f11a1f
SHA1 9445b0e79225323cd1b0d968401ec8c44f1fcffe
SHA512 c1c3e9a4bb030d0eed4e26317066adea1ee9f6c67c513db441dec532e2fafd7f8582053127233beef8947aecb25c3327510549d00b24478d457f539df98ec0e3
SSDEEP 1536:eVg73zt1zB/5x+YieTiBUTK3p/nXNP7TfDtppI7vkFa4muWXjluiM5Px52B:e+V1lRwYiRRxtppI7zTluiMZxA
TLSH
T15434B512BF58D532C06886385AAF8B0D4B38FAC88B43572F6B55F02D7DE534A1F96394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgerow.UI.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.UI.dll
Size 212KB
SHA256 c2ef99ab759b3147687474ebec308844c1dac0ed9683e9f9521947b02b9cfb48
MD5 f8f86c828406201547e489115a874373
SHA1 d9a5f3c0f86a946df2c81652471db8acb9510e04
SHA512 74f53632e5910ae2c54333cd1b5ec04c6def24d375d5866f564fdec281eef63a59e0e1ded52d2278764b4fb69c5ac64e6fefb4ac8cc6b471da2002e2c19ce59a
SSDEEP 6144:ciLAWr/ySJuwRuN/n/gExQzISJXYk643pa5+d:ciLAWr/ySu/gExQzIy/d
TLSH
T1B9246C9073FC4239FAFF6B36A4B0A1145530F523D992C76D58D219EC68B27866A02F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgerow.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Hedgerow.dll
Size 375KB
SHA256 e74bc7879163d7a03e46ae7e59ba8fb38b4347a31fcc7a3e63db3a217dc38397
MD5 32b4f674a9b9be86b903ae16add47fa0
SHA1 b3f825005c842c3c9e4e0412f0b48ae8bdd3ac58
SHA512 c2ebd919720af8f1662766aeda3c2af398643680a98785c80d3b92a4dab74a09cc7660d9482d83e3383ff2d1b4a12f5417c1c07adb66864ef9269f03ed1b3a10
SSDEEP 6144:x2If+c+qFcm8IZJRbetlVbIo/O+uD+uEq1sq2NIL7roQtm79i9JPcAd:n+Ucm8IHylKoTq1aCNm7U3
TLSH
T1D2844C9577F84316F1FFAB36FCB015140B7AF946A96DE78E0A8460AD0CB27849850B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\Newtonsoft.Json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Web.Http.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\System.Web.Http.dll
Size 443KB
SHA256 fb2c216b321390fe726bdb842b14343db999d372b6293568cc778966fbd8f64d
MD5 e9ee73215ff2b30dc3d31f0336d09fa4
SHA1 371923c0ac6f7142d0d201829ee413d59091de4c
SHA512 60a3e80ac392de3c45d2724caadb5e2466b2956f3eff91296cb65d2a8f90bb9fc2c244ea3172d2a3d5022f92cb0dbb8775fbdd24071a1aa0ebf9a525346371ce
SSDEEP 6144:giJ5Q3WxGPl7/q20xeIs6t3nYTKN+O4RP/KZ7vFXcUkOH0uIs:V5upNoKC3PYO4x/KZMqIs
TLSH
T16AA46A2163FC0F2AE5EB4BB9F031496887F5FA526105D72F2949F4B91C937828D11BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog.Resources.resources.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\en-US\Hedgehog.Resources.resources.dll
Size 1.1MB
SHA256 130f51c80f1913c3bbc47e170914fa9aa972652296ec99c2920f19641612737b
MD5 81e12312ca05cf89cd8e589b84394842
SHA1 0382bcd5cfa9e65079ff3d3a64e7c1ded623015e
SHA512 93f46eee0d97cd7c1d4e1dbfe4fb0a6d3d70be6734e205084f2bf6d6c585f7579929ab85a19e216e9c2857ab61dd76fd702a59ca2054b9d52725caf22e069c4d
SSDEEP 6144:ut0Udkg1s+UbiCAtY4swZOWsbDpf5G1h9SGb/8ibRxBW8GUwKlg9PSjWb4Q:40Lgez+sbDpctSGTnbQ8K
TLSH
T1C035B9257DEF382DB993B5E56FCAE2DFD326B1E84353022F10A6531B52A28014B53D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Program Files (x86)\Hedgerow Software\Hedgehog Client Launcher\log4net.dll
Size 264KB
SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
MD5 27fe8d18682fd9901e589e65ef429b23
SHA1 6426e96243911beab547f2bc98a252a26692f11f
SHA512 9d6bc8c77c72cbad15e808281818c2768f1b44aa6ea1d54a979c91218b8fbf2a02fee49fa97db6cfa6087ddc363d6cdd6407e4494934b4568c514437030a2615
SSDEEP 3072:HG0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCj:HJrycoB3HVeESME3pnaVTS1nh7hCa
TLSH
T1C544195877F84A59F2FF2BB8A47644154BB5F816B87ED39E0A80A4EC2D33B108951373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hedgehog_Client_Launcher_Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-23B3F.tmp\Hedgehog_Client_Launcher_Setup.tmp
Size 3.0MB
SHA256 7d699a18cdfac6fb8e64bd24532d8aa21c39480d213d8e1546ea6146b2ce6f50
MD5 f082bcafb9ea5f36c597175eef06c082
SHA1 c3c0cffc1d2aa0fec993500025b8811bc6492d46
SHA512 d9a37b32ea116a077a9d52bd884b736f1db128057d5a40fe0d9643849c8e0a7a841ae80b5d1f61d9af094afc1e9d3ba426b59521897f18556bffdcc2af998984
SSDEEP 49152:0WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbp333de:gtLutqgwh4NYxtJpkxhGG333M
TLSH
T120E53A27F28C713ED06B3A364A3386909837F66169128C6797FC794C8F365942A3E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3812-258-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-138-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-254-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-260-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-252-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-7-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-249-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-262-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-247-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-264-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-266-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-241-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-268-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-256-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-13-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-8-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/3812-10-0x0000000000400000-0x0000000000710000-memory.dmp

Download

memory/4604-11-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/4604-1-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/4604-0-0x00000000004C2000-0x00000000004C3000-memory.dmp

Download

memory/5748-156-0x00000000064D0000-0x00000000065EE000-memory.dmp

Download

memory/5748-210-0x0000000009A30000-0x0000000009AE4000-memory.dmp

Download

memory/5748-218-0x000000000A640000-0x000000000B190000-memory.dmp

Download

memory/5748-222-0x000000000B190000-0x000000000B732000-memory.dmp

Download

memory/5748-227-0x0000000009EC0000-0x0000000009FFC000-memory.dmp

Download

memory/5748-214-0x00000000099A0000-0x00000000099C4000-memory.dmp

Download

memory/5748-223-0x0000000009CE0000-0x0000000009D72000-memory.dmp

Download

memory/5748-206-0x0000000008D80000-0x0000000008DCC000-memory.dmp

Download

memory/5748-228-0x0000000009CA0000-0x0000000009CC0000-memory.dmp

Download

memory/5748-229-0x000000000B740000-0x000000000BC6C000-memory.dmp

Download

memory/5748-177-0x0000000008460000-0x0000000008498000-memory.dmp

Download

memory/5748-233-0x000000000A190000-0x000000000A31E000-memory.dmp

Download

memory/5748-234-0x0000000009EB0000-0x0000000009EBE000-memory.dmp

Download

memory/5748-185-0x0000000008940000-0x00000000089B2000-memory.dmp

Download

memory/5748-238-0x000000000C5A0000-0x000000000CED0000-memory.dmp

Download

memory/5748-189-0x00000000089C0000-0x0000000008A20000-memory.dmp

Download

memory/5748-242-0x000000000C550000-0x000000000C558000-memory.dmp

Download

memory/5748-243-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/5748-244-0x00000000FFD30000-0x00000000FFD40000-memory.dmp

Download

memory/5748-245-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/5748-181-0x0000000008860000-0x00000000088BE000-memory.dmp

Download

memory/5748-169-0x0000000008FE0000-0x0000000009424000-memory.dmp

Download

memory/5748-173-0x00000000084B0000-0x000000000859C000-memory.dmp

Download

memory/5748-165-0x0000000007DF0000-0x0000000007E28000-memory.dmp

Download

memory/5748-164-0x00000000085E0000-0x00000000087FE000-memory.dmp

Download

memory/5748-158-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/5748-157-0x00000000FFD30000-0x00000000FFD40000-memory.dmp

Download

memory/5748-152-0x0000000005790000-0x0000000005A34000-memory.dmp

Download

memory/5748-148-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/5748-147-0x0000000004F40000-0x0000000004F86000-memory.dmp

Download

memory/5748-143-0x0000000000510000-0x0000000000552000-memory.dmp

Download