Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 12:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HiveMind_1_0_0_46.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
HiveMind_1_0_0_46.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target setup.exe
- Size 424KB
- Sample260505-pewfmsfs91
- SHA256 7a68c7ce3c6b6203a71932318ae0ec5f3b128d6f41b7a35936069b55c3f2ef1c
- MD5 8a5eaa3328250513249c0cf9ea176216
- SHA1 65ee95349ea4aac0054d0bcbfb4a4e714d53143a
- SHA512 3bad47c95034d8946ecfc948c8f13c9f8f379c2caba5e0cd37f4f0c10ccb2c8399c0d8ce926cf0c48baa66e374f73d85403eaabe1ad958dfe96990b06970e757
- SSDEEP 6144:NqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD39ojDuUlXjeOg:N7IRWDvFa+nhmuF3Y0sc9eDuUlXCx
- TLSH T15C943A2167E89031F8F326B05ABD62314A7EBCB15F3585DF129026DE89B1AC1ED3075B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation setup.exe - Loads dropped DLL 4 IoCs
pid Process 3340 MsiExec.exe 3340 MsiExec.exe 1944 MsiExec.exe 1944 MsiExec.exe - Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 2344 msiexec.exe 7 2344 msiexec.exe 13 2344 msiexec.exe 14 2344 msiexec.exe 16 2344 msiexec.exe 18 2344 msiexec.exe 24 2344 msiexec.exe 36 2344 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe - Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind Archestra user Manual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind_ReleaseNotes_03_12.xlsx msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.csproj.FileListAbsolute.txt msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindOb.aaPKG msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Griewank_side.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Program.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Banner.jpg msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.config msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Properties\AssemblyInfo.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ReadMe.rtf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Ackley.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.Metadata.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\ResolveAssemblyReference.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.application msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindManual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\MovingTarget.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\rosenbrock.py msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj.user msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind[1].ico msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\DesignTimeResolveAssemblyReferencesInput.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Rosenbrock_py.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.suo msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.sln msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.xml msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58e867.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0FCC03AE-3EED-4680-9786-023076FF48A4} msiexec.exe File created C:\Windows\Installer\e58e869.msi msiexec.exe File created C:\Windows\Installer\e58e867.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE971.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA2D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB96.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fba334cb82b6afae0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fba334cb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900fba334cb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1afba334cb000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfba334cb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4364 msiexec.exe 4364 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2344 msiexec.exe Token: SeIncreaseQuotaPrivilege 2344 msiexec.exe Token: SeSecurityPrivilege 4364 msiexec.exe Token: SeCreateTokenPrivilege 2344 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2344 msiexec.exe Token: SeLockMemoryPrivilege 2344 msiexec.exe Token: SeIncreaseQuotaPrivilege 2344 msiexec.exe Token: SeMachineAccountPrivilege 2344 msiexec.exe Token: SeTcbPrivilege 2344 msiexec.exe Token: SeSecurityPrivilege 2344 msiexec.exe Token: SeTakeOwnershipPrivilege 2344 msiexec.exe Token: SeLoadDriverPrivilege 2344 msiexec.exe Token: SeSystemProfilePrivilege 2344 msiexec.exe Token: SeSystemtimePrivilege 2344 msiexec.exe Token: SeProfSingleProcessPrivilege 2344 msiexec.exe Token: SeIncBasePriorityPrivilege 2344 msiexec.exe Token: SeCreatePagefilePrivilege 2344 msiexec.exe Token: SeCreatePermanentPrivilege 2344 msiexec.exe Token: SeBackupPrivilege 2344 msiexec.exe Token: SeRestorePrivilege 2344 msiexec.exe Token: SeShutdownPrivilege 2344 msiexec.exe Token: SeDebugPrivilege 2344 msiexec.exe Token: SeAuditPrivilege 2344 msiexec.exe Token: SeSystemEnvironmentPrivilege 2344 msiexec.exe Token: SeChangeNotifyPrivilege 2344 msiexec.exe Token: SeRemoteShutdownPrivilege 2344 msiexec.exe Token: SeUndockPrivilege 2344 msiexec.exe Token: SeSyncAgentPrivilege 2344 msiexec.exe Token: SeEnableDelegationPrivilege 2344 msiexec.exe Token: SeManageVolumePrivilege 2344 msiexec.exe Token: SeImpersonatePrivilege 2344 msiexec.exe Token: SeCreateGlobalPrivilege 2344 msiexec.exe Token: SeCreateTokenPrivilege 2344 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2344 msiexec.exe Token: SeLockMemoryPrivilege 2344 msiexec.exe Token: SeIncreaseQuotaPrivilege 2344 msiexec.exe Token: SeMachineAccountPrivilege 2344 msiexec.exe Token: SeTcbPrivilege 2344 msiexec.exe Token: SeSecurityPrivilege 2344 msiexec.exe Token: SeTakeOwnershipPrivilege 2344 msiexec.exe Token: SeLoadDriverPrivilege 2344 msiexec.exe Token: SeSystemProfilePrivilege 2344 msiexec.exe Token: SeSystemtimePrivilege 2344 msiexec.exe Token: SeProfSingleProcessPrivilege 2344 msiexec.exe Token: SeIncBasePriorityPrivilege 2344 msiexec.exe Token: SeCreatePagefilePrivilege 2344 msiexec.exe Token: SeCreatePermanentPrivilege 2344 msiexec.exe Token: SeBackupPrivilege 2344 msiexec.exe Token: SeRestorePrivilege 2344 msiexec.exe Token: SeShutdownPrivilege 2344 msiexec.exe Token: SeDebugPrivilege 2344 msiexec.exe Token: SeAuditPrivilege 2344 msiexec.exe Token: SeSystemEnvironmentPrivilege 2344 msiexec.exe Token: SeChangeNotifyPrivilege 2344 msiexec.exe Token: SeRemoteShutdownPrivilege 2344 msiexec.exe Token: SeUndockPrivilege 2344 msiexec.exe Token: SeSyncAgentPrivilege 2344 msiexec.exe Token: SeEnableDelegationPrivilege 2344 msiexec.exe Token: SeManageVolumePrivilege 2344 msiexec.exe Token: SeImpersonatePrivilege 2344 msiexec.exe Token: SeCreateGlobalPrivilege 2344 msiexec.exe Token: SeCreateTokenPrivilege 2344 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2344 msiexec.exe Token: SeLockMemoryPrivilege 2344 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2344 msiexec.exe 2344 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2344 4616 setup.exe 85 PID 4364 wrote to memory of 3340 4364 msiexec.exe 88 PID 4364 wrote to memory of 2756 4364 msiexec.exe 101 PID 4364 wrote to memory of 1944 4364 msiexec.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\HiveMind_1_0_0_46.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2344
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CFA50A27B7C087ECC0F7A6AABB6E6FA4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2756
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A51E2CF787854092475E1F994A8149E92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e868.rbs
- Size 32KB
- SHA256 4d65931ac51aee0f1a07b617af41a55c914b80851a1641df258dc3e0153bc00c
- MD5 f155f2e9d9978077ebd4b386f06dc7c8
- SHA1 f52c7e321ee445f0e2716b66f0ec360f8a78241f
- SHA512 82a99214d4d900015f916a645a1cbdfed83476a7ea0b631fe4fd590f95d1e4f9a3bcc4b7ab6e4902e175baaf95ab2a489e683fe2c0e203b38f3766909b600a0b
- SSDEEP 384:W8/I5AGel9PHeoS8p8ys/lAPvhHlJQms65KmAFakmsfd/NQElhwbAr/:fSel9PnS8QybK
- TLSH T1CDE266516D05C7C1F2E8337282E21F093B556EED91D9196E4E48CACE8A83EDDDE740E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll
- Size 189KB
- SHA256 a3f2137f7eb744d43732341539d1f6163a4c3bc90e4d78dc4f07d8b432dcf5a3
- MD5 5e2ec615065631ffcbb0ad6a938f689c
- SHA1 d8771c7dc48f879cd82b77a3bf16d7a66920e9d3
- SHA512 b45c3ad20283f36398cbebc3cd7ea3f7450dcfe5950e7bff423eda4a7788277faf8436faa45b63639525fff3efab425421c0428b4acbeadb17c92dcb6cd8b81c
- SSDEEP 3072:12iAvBjGsfMVM5FLbHWbfIq9UN0bk8MTljiFaIG+Hw/:12TSgFLbHMfIqGubmTVivH
- TLSH T1D014D61437F08656E9BF73B9C8F9138007BCBC4BB47EE34A899484E91D437424965BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL
- Size 50KB
- SHA256 24419847f0e199da7f4387ca0afefd7a54761f34ef5b0bd324bf03ea5242fb07
- MD5 7717d7db455ed7b45c0cde302eab8709
- SHA1 706d7a50dafba012b592ef292024b6cdf3f3a9e5
- SHA512 6430f012098a13ede3883e54b6d408b19c49923d415bbc7fcb0531a8ebc91e3419d36ffe444df24554154a59cdf0ae1eecb788cc9a55788947687978dbd8f409
- SSDEEP 768:CUrcyNv7xQcBcBOcht1muS7eRN1o/MH4ZywVAPqtqT2WzeW51jUb:CxyNv7x1BqOwiMH4ZywVsIWLo
- TLSH T18433D609B7EC9617F5BEDBFDE874011D47F6797EAA21E39E8D8400E918263548890B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- Size 37KB
- SHA256 b070a2480945989f59e6f3fc2ccc0fecc6fef8d4f8dba47fcf4c0822ca5a4602
- MD5 f5902cb1aad4293c91c7d8ea9c79389d
- SHA1 623382c0bea42f898fd21567bde624abe92342a0
- SHA512 ffde2bb98bba559af514c12b56d1f2f68b761a9e1d7c6f6da113618373b5bb9381c4df7871c494298225158d38f3cece513a15848b956ce3d908c1dd9172077e
- SSDEEP 768:4exo2dYpEQdmmEiVsi8ZqIyMzNFe3x1o113jr:4B2dcEf0enzzNk3L2
- TLSH T1F30384A86D7B6C6091CEC2720198775E1E3AF6D622D20909CB397A4016426CF6F7FF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 546B
- SHA256 31ce0ee6e02970a1e4b4005429e4de3bbf014d1507069780577354efa3bf8153
- MD5 dfe680e0b4d834a5bf7146d978f33f38
- SHA1 bc16285e6f514cfe67d92d51f5e05a651d4caafe
- SHA512 20d114fa24ce68a38e3be28e240e3498f12188937e283272105131cebb827b53ee787db361de6a0a6fad4572c5a375eb4335429441f7ba039753981f7576b343
- TLSH T1CBF02019889C010ADA482D8ECA42F9760A7007F3B880A096B78C512A4496B48768360F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 1KB
- SHA256 e51b2f70777031090066dd4c040d2091ccddb25c5d72129eb8d5062063ba9d80
- MD5 f7bbcc1fb752bf767fd09f54a6aae4fa
- SHA1 47804996873029e3f7b6fb0e87dd42d1e2ce462f
- SHA512 046263ce7a8c1c592c477d2cdefe45133632de7812a14c38dc666c38c2e51c5f8414047bc515c2528a79b53850f6ec3f1aeb1d5aadee64e71e3be5414a9287de
- TLSH T1B7414CFB7BF0B7886B74C3412174D376AF30D1926205408AF41BB03317473E4692400E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- Size 300B
- SHA256 d177074a4dca069b508da6e6f095881a8da006b28ad73fe5050e1e9733b760b4
- MD5 54f50fa3f35d37bd9c5a082d073e5fe1
- SHA1 920aceceaab287573520013a3471541dda7c2885
- SHA512 6742ce3945d7274afbcf7e3f1501892e5e02d584a0367009cc78cec7fb733f4f5197e73c2fb27eda6ef8f9e46fa3fd6aea353c6709d7b61fd900cd6151912788
- TLSH T1DFE05B6E17680119D26BE67559510141DB31BD22754B9B0C11D446087C55FC73C5062B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 306B
- SHA256 4f07726cd0bbe56932a129623f0976423a55823a42e2138bc345cdaf08b39f25
- MD5 fd5295d2f448735932f3581da238c7d7
- SHA1 579e7502d96d72c11c4377e13af394bd175bbee8
- SHA512 19322f87d53cb78497cf6f8b3527e9081dc11abe0ae0a26fce793d6e800ca6e68acfd95a53b5b4620930772b0f5f96717a4c267df727840d8a1e86a2f7215515
- TLSH T19FE02EA493F00333F03A2A390E708A04EDB270923201C20C02BB0A0C3C30F129C3944E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 500B
- SHA256 4ecb165703899e7ec8c645056aa866ce412a18d9ea2aed581b118ee7138a4590
- MD5 4abf7037c7c3fc9d72633c84a48130b9
- SHA1 0179b0c87fec8cc65c5086bef6eb58919b642461
- SHA512 ba9e99786bcdec16536ddb5170227c84dba854b19a6ec044606aad2fdb7d769e061091b9488fe8e4a36c8b636335d30f09da73f4a88d632ded5c46c08394ab61
- TLSH T1CFF05C6C16F1407EF275DA7596D66562D412B1123CA0CABB15D04E0E6E06A406D96212
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4570.tmp
- Size 231KB
- SHA256 ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
- MD5 5494165b1384faeefdd3d5133df92f5a
- SHA1 b7b82805f1a726c4eee39152d1a6a59031d7798c
- SHA512 ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
- SSDEEP 3072:87jf4NyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYJ:aRzCLbY92NLmPUj/u4tL7/R
- TLSH T11D346C2136D4DA32E4E321B456BCE63119BEF4705B70C2C7A3941BEE9EA96C09B34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_48FB3119D460F4716DADA7.exe
- Size 361KB
- SHA256 c478ccc77c89e180198d3e5fba8ab019697e2b0fc58a71520659e60bee7993be
- MD5 c954f844122265047876d90b1e67fcbf
- SHA1 984cc2e41c8df402dc07e2895e0ff5669d2736d4
- SHA512 d6e960835294083d8dc74cae97180dfed6fb8d24ee87ecf3f74d7f735c193e2ea7af914e3c14b77c03f0304f636a934ec961416049ac66eadafa78d62e3d854c
- SSDEEP 1536:UZHaR8jLmifWjIt47mSjVK/FjkIwqBiTZGrZDFlM8byjvMIKOmSoGilfrAdUtJAi:UASav8bKvHoH2dCpwwIfEvXvbQ/PXI
- TLSH T1577411EFA5D15065DC477BF4E032A82319B25D256AB851CD4AB4FB103A7F283CC1A92F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_E95F4F630D6D54F57C9A75.exe
- Size 9KB
- SHA256 d4f066db44f8ec61d8ec183091bead9578022c2385d4f7552b32f1b0c53fd26b
- MD5 ce8ee64c66e92bbb46231b1be06aba22
- SHA1 5bb368fbcf57d92d8c83a4487fdde7e713ed3a24
- SHA512 aa31399cde6457dfa727f3f21074efb8f1f5b7ff5bfee6e54231082e7e8f5d4b6d4df90d70529aaff3935bb3ab86dc86ac1a0d85429d247fdcff9720f4e2c0ec
- SSDEEP 96:4kUpiZtd9KZZqwoxcOZQkNqaxnvKdrg8ZxYkyPF7o:gpaUZIwgtZtpvVDN7o
- TLSH T158220343E1449694DD0B0331D9CECFAD8A577CC165A122F932FC3DAA79FB663660B209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58e867.msi
- Size 11.7MB
- SHA256 63c99b222fae2241a88c8be381f152049c5f60a1be817e52b55693c754a59667
- MD5 851fe5408ceaf904b0bd70659007827a
- SHA1 4e7dd6fe3f622fca0b8ad3b20ad0c56f2902fe10
- SHA512 abf4442ac58791d43274d355840aa4db4bfe8cc717248a2bfa2e090a269e94cf331283a6711e588d66202cc6d1c42b28afa7c3c9dd7b5416609014a426e3de45
- SSDEEP 196608:cu/SFn+UXpsgvQ2pjxdbWNlZ2npEJuqDT+2e0RfZZzDhhlsrYbR6B:pSl+q7jSJyYRfvDhTd6
- TLSH T17AC612EFA4C19175C8477BF5D036A8221573AC245AB850CE16B5FB243A7F283CC6A91F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 3f438fdfa5b4d8724ab2dadb91f576ef7c977afcf91ec24240ca04791d0738f3
- MD5 07a0b1370673590ae90cd78913208e3a
- SHA1 35198ae2ce5408f418eed761f18f7a3e38111e9f
- SHA512 86ff3505fbd1a45f13336731599b63917ed3ac93a81e9c87f2e02148a4b5c67ecd198fc712b385bd2d8f99b1b4e9e9cd1588e0672797fd0ae4cd52a88d03f406
- SSDEEP 24576:6u8m+1zQdoO/vvTLr2du42aJc0EDV1tSRrmNfSs110ac+6kgo/l0VLmxI:p
- TLSH T17647B12436F92200E7B79E3CA8F0AA634D3E7D5B9C159E8D45411B4E0921FB1E873F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb34a3fb-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9180e084-0511-48aa-8909-e3e3ef38871e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 63881936843157247661bb3464d87bd457bdfa09cbdce76e8cf517d635cd9f92
- MD5 0ef0fd80478ae91f3fb9d854c4f4f4bf
- SHA1 cfbf7f9937b72e42d032e4bded83e476ae5df51a
- SHA512 f177722e6aa1839f7b8a81aa864d5abda9ecc2e3920bf8e6c8e121e0e96b3303bd1924cdbddad1b9bf08a12efc46a9afb895b9bb776187050dc5d0ac4e7de635
- SSDEEP 96:Fl3S67Btvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:3Xb++ZVmN
- TLSH T166D178185AF54711E2B3AB3128F18557A877B811FF33CB8E0198238E6670A10F976F5B
- MD5 SHA1 SHA512 SSDEEP TLSH