Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 12:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HiveMind_1_0_0_46.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
HiveMind_1_0_0_46.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target HiveMind_1_0_0_46.msi
- Size 11.7MB
- Sample260505-pewfmsfs91
- SHA256 63c99b222fae2241a88c8be381f152049c5f60a1be817e52b55693c754a59667
- MD5 851fe5408ceaf904b0bd70659007827a
- SHA1 4e7dd6fe3f622fca0b8ad3b20ad0c56f2902fe10
- SHA512 abf4442ac58791d43274d355840aa4db4bfe8cc717248a2bfa2e090a269e94cf331283a6711e588d66202cc6d1c42b28afa7c3c9dd7b5416609014a426e3de45
- SSDEEP 196608:cu/SFn+UXpsgvQ2pjxdbWNlZ2npEJuqDT+2e0RfZZzDhhlsrYbR6B:pSl+q7jSJyYRfvDhTd6
- TLSH T17AC612EFA4C19175C8477BF5D036A8221573AC245AB850CE16B5FB243A7F283CC6A91F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 2692 MsiExec.exe 2692 MsiExec.exe 6016 MsiExec.exe 6016 MsiExec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2124 msiexec.exe 3 2124 msiexec.exe 4 2124 msiexec.exe 5 2124 msiexec.exe 6 2124 msiexec.exe 7 2124 msiexec.exe 8 2124 msiexec.exe 9 5908 msiexec.exe 11 5908 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind_ReleaseNotes_03_12.xlsx msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\rosenbrock.py msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.Metadata.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\DesignTimeResolveAssemblyReferencesInput.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Program.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.sln msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj.user msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Banner.jpg msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ReadMe.rtf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind[1].ico msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\ResolveAssemblyReference.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Ackley.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.suo msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindManual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\MovingTarget.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind Archestra user Manual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindOb.aaPKG msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Griewank_side.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Rosenbrock_py.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Properties\AssemblyInfo.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.application msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.xml msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.csproj.FileListAbsolute.txt msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.config msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF93CE6A379C1ACF85.TMP msiexec.exe File created C:\Windows\Installer\e58db69.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD3147C252317D132.TMP msiexec.exe File created C:\Windows\Installer\e58db67.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFBD212E0F1284BEB7.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{0FCC03AE-3EED-4680-9786-023076FF48A4} msiexec.exe File opened for modification C:\Windows\Installer\MSI1853.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF41598C77276BB3AE.TMP msiexec.exe File opened for modification C:\Windows\Installer\e58db67.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1709.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1787.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2124 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e689d3d397d010a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e689d3d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e689d3d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae689d3d3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de689d3d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5908 msiexec.exe 5908 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2124 msiexec.exe Token: SeIncreaseQuotaPrivilege 2124 msiexec.exe Token: SeSecurityPrivilege 5908 msiexec.exe Token: SeCreateTokenPrivilege 2124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2124 msiexec.exe Token: SeLockMemoryPrivilege 2124 msiexec.exe Token: SeIncreaseQuotaPrivilege 2124 msiexec.exe Token: SeMachineAccountPrivilege 2124 msiexec.exe Token: SeTcbPrivilege 2124 msiexec.exe Token: SeSecurityPrivilege 2124 msiexec.exe Token: SeTakeOwnershipPrivilege 2124 msiexec.exe Token: SeLoadDriverPrivilege 2124 msiexec.exe Token: SeSystemProfilePrivilege 2124 msiexec.exe Token: SeSystemtimePrivilege 2124 msiexec.exe Token: SeProfSingleProcessPrivilege 2124 msiexec.exe Token: SeIncBasePriorityPrivilege 2124 msiexec.exe Token: SeCreatePagefilePrivilege 2124 msiexec.exe Token: SeCreatePermanentPrivilege 2124 msiexec.exe Token: SeBackupPrivilege 2124 msiexec.exe Token: SeRestorePrivilege 2124 msiexec.exe Token: SeShutdownPrivilege 2124 msiexec.exe Token: SeDebugPrivilege 2124 msiexec.exe Token: SeAuditPrivilege 2124 msiexec.exe Token: SeSystemEnvironmentPrivilege 2124 msiexec.exe Token: SeChangeNotifyPrivilege 2124 msiexec.exe Token: SeRemoteShutdownPrivilege 2124 msiexec.exe Token: SeUndockPrivilege 2124 msiexec.exe Token: SeSyncAgentPrivilege 2124 msiexec.exe Token: SeEnableDelegationPrivilege 2124 msiexec.exe Token: SeManageVolumePrivilege 2124 msiexec.exe Token: SeImpersonatePrivilege 2124 msiexec.exe Token: SeCreateGlobalPrivilege 2124 msiexec.exe Token: SeCreateTokenPrivilege 2124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2124 msiexec.exe Token: SeLockMemoryPrivilege 2124 msiexec.exe Token: SeIncreaseQuotaPrivilege 2124 msiexec.exe Token: SeMachineAccountPrivilege 2124 msiexec.exe Token: SeTcbPrivilege 2124 msiexec.exe Token: SeSecurityPrivilege 2124 msiexec.exe Token: SeTakeOwnershipPrivilege 2124 msiexec.exe Token: SeLoadDriverPrivilege 2124 msiexec.exe Token: SeSystemProfilePrivilege 2124 msiexec.exe Token: SeSystemtimePrivilege 2124 msiexec.exe Token: SeProfSingleProcessPrivilege 2124 msiexec.exe Token: SeIncBasePriorityPrivilege 2124 msiexec.exe Token: SeCreatePagefilePrivilege 2124 msiexec.exe Token: SeCreatePermanentPrivilege 2124 msiexec.exe Token: SeBackupPrivilege 2124 msiexec.exe Token: SeRestorePrivilege 2124 msiexec.exe Token: SeShutdownPrivilege 2124 msiexec.exe Token: SeDebugPrivilege 2124 msiexec.exe Token: SeAuditPrivilege 2124 msiexec.exe Token: SeSystemEnvironmentPrivilege 2124 msiexec.exe Token: SeChangeNotifyPrivilege 2124 msiexec.exe Token: SeRemoteShutdownPrivilege 2124 msiexec.exe Token: SeUndockPrivilege 2124 msiexec.exe Token: SeSyncAgentPrivilege 2124 msiexec.exe Token: SeEnableDelegationPrivilege 2124 msiexec.exe Token: SeManageVolumePrivilege 2124 msiexec.exe Token: SeImpersonatePrivilege 2124 msiexec.exe Token: SeCreateGlobalPrivilege 2124 msiexec.exe Token: SeCreateTokenPrivilege 2124 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2124 msiexec.exe Token: SeLockMemoryPrivilege 2124 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2124 msiexec.exe 2124 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5908 wrote to memory of 2692 5908 msiexec.exe 80 PID 5908 wrote to memory of 1160 5908 msiexec.exe 84 PID 5908 wrote to memory of 6016 5908 msiexec.exe 86 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\HiveMind_1_0_0_46.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2124
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE1CAC6E879845CE34DDCE8B3E79C30A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2692
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1160
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 74A8F58C869BF8AB326889150DCFE50D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6016
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58db68.rbs
- Size 33KB
- SHA256 5bcf2ee2dcb9a66fa0ceffad250c73d3149f94a86f7e7d1166aa690c8468f50d
- MD5 9bea7ec61d24da3437997e807205d756
- SHA1 c90f4904247ec748d508f44f7d81edb92101b4b9
- SHA512 9fd328a907bb4cc33516616c659ecfb9b7da1ede5ccfb38d3ce6ef33f52276ef717bd71c4d08565eb16506d554b128059b63e6cee0f5394254c3400e71ea0b81
- SSDEEP 384:T/Z5AGel9PHeogi18p8Be04qSGqizJAkiBRhALvMlM6V2ziAlADwKNMbCXAD5av6:Tbel9PnV8mubC
- TLSH T107E286115A99C3C1F6B533B183E62F483725AE9C92D41A6D4E88C5CE8A83EDDDE740D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll
- Size 189KB
- SHA256 a3f2137f7eb744d43732341539d1f6163a4c3bc90e4d78dc4f07d8b432dcf5a3
- MD5 5e2ec615065631ffcbb0ad6a938f689c
- SHA1 d8771c7dc48f879cd82b77a3bf16d7a66920e9d3
- SHA512 b45c3ad20283f36398cbebc3cd7ea3f7450dcfe5950e7bff423eda4a7788277faf8436faa45b63639525fff3efab425421c0428b4acbeadb17c92dcb6cd8b81c
- SSDEEP 3072:12iAvBjGsfMVM5FLbHWbfIq9UN0bk8MTljiFaIG+Hw/:12TSgFLbHMfIqGubmTVivH
- TLSH T1D014D61437F08656E9BF73B9C8F9138007BCBC4BB47EE34A899484E91D437424965BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL
- Size 50KB
- SHA256 24419847f0e199da7f4387ca0afefd7a54761f34ef5b0bd324bf03ea5242fb07
- MD5 7717d7db455ed7b45c0cde302eab8709
- SHA1 706d7a50dafba012b592ef292024b6cdf3f3a9e5
- SHA512 6430f012098a13ede3883e54b6d408b19c49923d415bbc7fcb0531a8ebc91e3419d36ffe444df24554154a59cdf0ae1eecb788cc9a55788947687978dbd8f409
- SSDEEP 768:CUrcyNv7xQcBcBOcht1muS7eRN1o/MH4ZywVAPqtqT2WzeW51jUb:CxyNv7x1BqOwiMH4ZywVsIWLo
- TLSH T18433D609B7EC9617F5BEDBFDE874011D47F6797EAA21E39E8D8400E918263548890B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- Size 37KB
- SHA256 b070a2480945989f59e6f3fc2ccc0fecc6fef8d4f8dba47fcf4c0822ca5a4602
- MD5 f5902cb1aad4293c91c7d8ea9c79389d
- SHA1 623382c0bea42f898fd21567bde624abe92342a0
- SHA512 ffde2bb98bba559af514c12b56d1f2f68b761a9e1d7c6f6da113618373b5bb9381c4df7871c494298225158d38f3cece513a15848b956ce3d908c1dd9172077e
- SSDEEP 768:4exo2dYpEQdmmEiVsi8ZqIyMzNFe3x1o113jr:4B2dcEf0enzzNk3L2
- TLSH T1F30384A86D7B6C6091CEC2720198775E1E3AF6D622D20909CB397A4016426CF6F7FF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 546B
- SHA256 31ce0ee6e02970a1e4b4005429e4de3bbf014d1507069780577354efa3bf8153
- MD5 dfe680e0b4d834a5bf7146d978f33f38
- SHA1 bc16285e6f514cfe67d92d51f5e05a651d4caafe
- SHA512 20d114fa24ce68a38e3be28e240e3498f12188937e283272105131cebb827b53ee787db361de6a0a6fad4572c5a375eb4335429441f7ba039753981f7576b343
- TLSH T1CBF02019889C010ADA482D8ECA42F9760A7007F3B880A096B78C512A4496B48768360F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 1KB
- SHA256 e51b2f70777031090066dd4c040d2091ccddb25c5d72129eb8d5062063ba9d80
- MD5 f7bbcc1fb752bf767fd09f54a6aae4fa
- SHA1 47804996873029e3f7b6fb0e87dd42d1e2ce462f
- SHA512 046263ce7a8c1c592c477d2cdefe45133632de7812a14c38dc666c38c2e51c5f8414047bc515c2528a79b53850f6ec3f1aeb1d5aadee64e71e3be5414a9287de
- TLSH T1B7414CFB7BF0B7886B74C3412174D376AF30D1926205408AF41BB03317473E4692400E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- Size 300B
- SHA256 eb78521fd0c25d4affb56bc3bf5d7b150f092f2ac32e189e3222d07c08476255
- MD5 7d15863d2829ead9709054230395db6d
- SHA1 de87f083ffe083edc887aaa4fcb7f279551781b1
- SHA512 4da15423a0a974dd9b2a31407a6b9223a4f9d783602c6157b039eb45dbce94ba4d47d2b7c7601129d925458b30f7cc0f2a447862d723de70588790474c4e39f4
- TLSH T1D4E05B7E17684119D56BEA755A510141EB31BD22755B9F0C10D446086C55F873C50617
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 306B
- SHA256 557e5100213f047e658d33f83ad3d67d474b82d935f075052a7792ca459341ec
- MD5 f9694ae98b5a12e1e6557d92165d34dc
- SHA1 46fbd40482eefa35f29bedecc4714a82321bb736
- SHA512 003c08df0cdaa1305e08096e298295a36e1805119435ebc0908b883cad65b94e0b5f21794bbb5d797797a4b7de09bee403b67f32644dd6aaaf63b49830ce895f
- TLSH T1A9E02EA043F00733F03A6A390E708A14EDB230922505C20C12BB0A0C3C20F129C3540E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
- Size 398B
- SHA256 7128681193445a0af0bd5d42a80736707776f3ce31a9f7158691c188076ff41a
- MD5 82a9b8af5425e124bbe404a1e238b018
- SHA1 201c695256ccbd088be9b263c55df2ba16f86dce
- SHA512 fd1749420b09dc8b402e33d58a64428421d2e9fbdd329506171eeb32ef95d762d3cf716251cf6661bc76a595b9b074bafc70d9729f506d943d9f6b31879bad9f
- TLSH T1A1E07D153BF9013CF07F1CF589D992198C6DF0B1085E967D015013097A2A900CC71932
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 413fbc1c3cfaa2797372bcf911d31f6fddf79aee2ee89081089c613609de820c
- MD5 2c869689f0c13e8af7b511e3afa96fa7
- SHA1 0e40e38e7d88ba4fc08da58abb555de906bd61f5
- SHA512 1d6b59392ea49c344bc2443ac47faa1388a3a016c2f38d7f8448fc60c1af823c72588a4282cd4468c6c36890cb4185f265c88f8857426ec5e83e43f7c2ab44ed
- TLSH T102E02E022BE80204F5770E3CA8737108993BB33B6A01CACC0234008D1C21F62CC3371D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 500B
- SHA256 32bbf11b5e18969e9be451e14f8a3a90bbe29a0aa23b93ff3e958d61120ca852
- MD5 91869bcd60654dd8f627de9ac6d15ded
- SHA1 65bb08f198ed16e6a999537bffeaac247e91234f
- SHA512 cf97ef4a57cacac87aede07164ba143cf02257f3af796b1d9bbfc770bfb54fd76d5b2dc7fc4ab24c5015daf5a482103e581bdd2da7b508c6e8e60d7880d30543
- TLSH T149F0DC2C15F0403AF279DA3497D66562C412B1123CA0CABB05C04E0E6E02A406C96212
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_07E19536AD36D9C337A7321FC4162CD1
- Size 396B
- SHA256 133dbbe5d6933f6a8cf6af643f6134633a5d9b2d300359143473861f1f510d16
- MD5 1b5ba6346d29a26915c135fdf672b927
- SHA1 e9b482038cef45410d005890b2713aec45b8d66d
- SHA512 e9466e904c5888961f9e6b33f4e061f7e5927e589fe67faa397b5820f640791727a1fe5ee5bb154ba6eacda7c9c1eb5b9b7e4a0622155d1f1803e1f443c0c085
- TLSH T173E07D2829BB015EE177EDBC4FC2E2E0CE75E321011607A400C05210FB02D045DC2EB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI433E.tmp
- Size 231KB
- SHA256 ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
- MD5 5494165b1384faeefdd3d5133df92f5a
- SHA1 b7b82805f1a726c4eee39152d1a6a59031d7798c
- SHA512 ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
- SSDEEP 3072:87jf4NyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYJ:aRzCLbY92NLmPUj/u4tL7/R
- TLSH T11D346C2136D4DA32E4E321B456BCE63119BEF4705B70C2C7A3941BEE9EA96C09B34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_48FB3119D460F4716DADA7.exe
- Size 361KB
- SHA256 c478ccc77c89e180198d3e5fba8ab019697e2b0fc58a71520659e60bee7993be
- MD5 c954f844122265047876d90b1e67fcbf
- SHA1 984cc2e41c8df402dc07e2895e0ff5669d2736d4
- SHA512 d6e960835294083d8dc74cae97180dfed6fb8d24ee87ecf3f74d7f735c193e2ea7af914e3c14b77c03f0304f636a934ec961416049ac66eadafa78d62e3d854c
- SSDEEP 1536:UZHaR8jLmifWjIt47mSjVK/FjkIwqBiTZGrZDFlM8byjvMIKOmSoGilfrAdUtJAi:UASav8bKvHoH2dCpwwIfEvXvbQ/PXI
- TLSH T1577411EFA5D15065DC477BF4E032A82319B25D256AB851CD4AB4FB103A7F283CC1A92F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_E95F4F630D6D54F57C9A75.exe
- Size 9KB
- SHA256 d4f066db44f8ec61d8ec183091bead9578022c2385d4f7552b32f1b0c53fd26b
- MD5 ce8ee64c66e92bbb46231b1be06aba22
- SHA1 5bb368fbcf57d92d8c83a4487fdde7e713ed3a24
- SHA512 aa31399cde6457dfa727f3f21074efb8f1f5b7ff5bfee6e54231082e7e8f5d4b6d4df90d70529aaff3935bb3ab86dc86ac1a0d85429d247fdcff9720f4e2c0ec
- SSDEEP 96:4kUpiZtd9KZZqwoxcOZQkNqaxnvKdrg8ZxYkyPF7o:gpaUZIwgtZtpvVDN7o
- TLSH T158220343E1449694DD0B0331D9CECFAD8A577CC165A122F932FC3DAA79FB663660B209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58db67.msi
- Size 11.7MB
- SHA256 63c99b222fae2241a88c8be381f152049c5f60a1be817e52b55693c754a59667
- MD5 851fe5408ceaf904b0bd70659007827a
- SHA1 4e7dd6fe3f622fca0b8ad3b20ad0c56f2902fe10
- SHA512 abf4442ac58791d43274d355840aa4db4bfe8cc717248a2bfa2e090a269e94cf331283a6711e588d66202cc6d1c42b28afa7c3c9dd7b5416609014a426e3de45
- SSDEEP 196608:cu/SFn+UXpsgvQ2pjxdbWNlZ2npEJuqDT+2e0RfZZzDhhlsrYbR6B:pSl+q7jSJyYRfvDhTd6
- TLSH T17AC612EFA4C19175C8477BF5D036A8221573AC245AB850CE16B5FB243A7F283CC6A91F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 869b074b9c59e22ea7484675ec9624b5bc0a9d9111c01e2d56825619ad44016e
- MD5 02ceb4661bbd08fa5db608df6b0c246f
- SHA1 6ab0be25199fee755fcd7460d5f5fd3ec8d83e80
- SHA512 64df64541ce27b07439941f3d6025772a268edc5a5eecbd611fcd244cfda0a7f17f07cef3e5fc70d2a6e9ac7219c907543b31b5f4ba54549735ada3f10919c1e
- SSDEEP 24576:/2gmSp17doO/vvTLn2MeREnqfqpnA44mWWPd3pksVX6IkQIJ4Xdb7BmrB:1
- TLSH T14C47052436F92110E7F79F3CA8F0AA23493A7D5B9C15DE8C46411B4E0961FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d3d389e6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ecfbd182-1101-4e9f-8e51-1029aca8f005}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7c6a22a9db16e12b6fc2d2b73ef6d2db5cc8682bde687913a213416f7ac7ae38
- MD5 6aee22a112877265c9d94bdd29f02a38
- SHA1 aee3dfab485298a84ff85f043f98241fe27e02cd
- SHA512 e7fd9265398df31baa88955756f26714f31eaee5c6b4d0b5de4576df7804bbbd34f63c97cae0bf22fd14346e4e0b06baf28645dbb162970f5a571ebcef11834c
- SSDEEP 96:F3iSXBwjtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:tiecb++ZVmN
- TLSH T13DD189185AF54711E2B3AB3229F18557A477B811EF33CB8E0298238E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH