Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 12:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HiveMind_1_0_0_46.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
HiveMind_1_0_0_46.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target setup.exe
- Size 424KB
- Sample260505-pewfmsfs91
- SHA256 7a68c7ce3c6b6203a71932318ae0ec5f3b128d6f41b7a35936069b55c3f2ef1c
- MD5 8a5eaa3328250513249c0cf9ea176216
- SHA1 65ee95349ea4aac0054d0bcbfb4a4e714d53143a
- SHA512 3bad47c95034d8946ecfc948c8f13c9f8f379c2caba5e0cd37f4f0c10ccb2c8399c0d8ce926cf0c48baa66e374f73d85403eaabe1ad958dfe96990b06970e757
- SSDEEP 6144:NqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD39ojDuUlXjeOg:N7IRWDvFa+nhmuF3Y0sc9eDuUlXCx
- TLSH T15C943A2167E89031F8F326B05ABD62314A7EBCB15F3585DF129026DE89B1AC1ED3075B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 1636 MsiExec.exe 1636 MsiExec.exe 4548 MsiExec.exe 4548 MsiExec.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4768 msiexec.exe 3 4768 msiexec.exe 4 4768 msiexec.exe 5 4768 msiexec.exe 6 4768 msiexec.exe 7 4768 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in Program Files directory 53 IoCs
description ioc Process File created C:\Program Files (x86)\Decision Makers\HiveMind\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Banner.jpg msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ReadMe.rtf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind[1].ico msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.csproj.FileListAbsolute.txt msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Program.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\MovingTarget.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\Microsoft.Scripting.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindOb.aaPKG msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.xml msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Scripting.Metadata.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Microsoft.Dynamic.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.csproj.user msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\DLL\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.sln msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.manifest msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\rosenbrock.py msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.exe.config msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\HiveMindLib.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\ArchestrA\NCalc.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\netchartdir.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\IronPython.dll msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindManual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind_ReleaseNotes_03_12.xlsx msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Griewank_side.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\DesignTimeResolveAssemblyReferencesInput.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\obj\x86\Debug\ResolveAssemblyReference.cache msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Ackley.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\HiveMindExampleProject.suo msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\Properties\AssemblyInfo.cs msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind.application msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.vshost.exe msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMind Archestra user Manual.pdf msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindExampleProject.pdb msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\Examples\Rosenbrock_py.HMD msiexec.exe File created C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\NCalc.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58c09c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC1E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0FCC03AE-3EED-4680-9786-023076FF48A4} msiexec.exe File opened for modification C:\Windows\Installer\MSIC2B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC176.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2C456E7F89FB148B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9D212FC9E945B0BA.TMP msiexec.exe File created C:\Windows\Installer\e58c09e.msi msiexec.exe File created C:\Windows\SystemTemp\~DF04F36EFB48DAF1BC.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF294853FD683960B.TMP msiexec.exe File created C:\Windows\Installer\e58c09c.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a09cc7b9ddbd1cc00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a09cc7b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a09cc7b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa09cc7b9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da09cc7b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1332 msiexec.exe 1332 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4768 msiexec.exe Token: SeIncreaseQuotaPrivilege 4768 msiexec.exe Token: SeSecurityPrivilege 1332 msiexec.exe Token: SeCreateTokenPrivilege 4768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4768 msiexec.exe Token: SeLockMemoryPrivilege 4768 msiexec.exe Token: SeIncreaseQuotaPrivilege 4768 msiexec.exe Token: SeMachineAccountPrivilege 4768 msiexec.exe Token: SeTcbPrivilege 4768 msiexec.exe Token: SeSecurityPrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeLoadDriverPrivilege 4768 msiexec.exe Token: SeSystemProfilePrivilege 4768 msiexec.exe Token: SeSystemtimePrivilege 4768 msiexec.exe Token: SeProfSingleProcessPrivilege 4768 msiexec.exe Token: SeIncBasePriorityPrivilege 4768 msiexec.exe Token: SeCreatePagefilePrivilege 4768 msiexec.exe Token: SeCreatePermanentPrivilege 4768 msiexec.exe Token: SeBackupPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeShutdownPrivilege 4768 msiexec.exe Token: SeDebugPrivilege 4768 msiexec.exe Token: SeAuditPrivilege 4768 msiexec.exe Token: SeSystemEnvironmentPrivilege 4768 msiexec.exe Token: SeChangeNotifyPrivilege 4768 msiexec.exe Token: SeRemoteShutdownPrivilege 4768 msiexec.exe Token: SeUndockPrivilege 4768 msiexec.exe Token: SeSyncAgentPrivilege 4768 msiexec.exe Token: SeEnableDelegationPrivilege 4768 msiexec.exe Token: SeManageVolumePrivilege 4768 msiexec.exe Token: SeImpersonatePrivilege 4768 msiexec.exe Token: SeCreateGlobalPrivilege 4768 msiexec.exe Token: SeCreateTokenPrivilege 4768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4768 msiexec.exe Token: SeLockMemoryPrivilege 4768 msiexec.exe Token: SeIncreaseQuotaPrivilege 4768 msiexec.exe Token: SeMachineAccountPrivilege 4768 msiexec.exe Token: SeTcbPrivilege 4768 msiexec.exe Token: SeSecurityPrivilege 4768 msiexec.exe Token: SeTakeOwnershipPrivilege 4768 msiexec.exe Token: SeLoadDriverPrivilege 4768 msiexec.exe Token: SeSystemProfilePrivilege 4768 msiexec.exe Token: SeSystemtimePrivilege 4768 msiexec.exe Token: SeProfSingleProcessPrivilege 4768 msiexec.exe Token: SeIncBasePriorityPrivilege 4768 msiexec.exe Token: SeCreatePagefilePrivilege 4768 msiexec.exe Token: SeCreatePermanentPrivilege 4768 msiexec.exe Token: SeBackupPrivilege 4768 msiexec.exe Token: SeRestorePrivilege 4768 msiexec.exe Token: SeShutdownPrivilege 4768 msiexec.exe Token: SeDebugPrivilege 4768 msiexec.exe Token: SeAuditPrivilege 4768 msiexec.exe Token: SeSystemEnvironmentPrivilege 4768 msiexec.exe Token: SeChangeNotifyPrivilege 4768 msiexec.exe Token: SeRemoteShutdownPrivilege 4768 msiexec.exe Token: SeUndockPrivilege 4768 msiexec.exe Token: SeSyncAgentPrivilege 4768 msiexec.exe Token: SeEnableDelegationPrivilege 4768 msiexec.exe Token: SeManageVolumePrivilege 4768 msiexec.exe Token: SeImpersonatePrivilege 4768 msiexec.exe Token: SeCreateGlobalPrivilege 4768 msiexec.exe Token: SeCreateTokenPrivilege 4768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4768 msiexec.exe Token: SeLockMemoryPrivilege 4768 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4768 msiexec.exe 4768 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4768 4920 setup.exe 79 PID 1332 wrote to memory of 1636 1332 msiexec.exe 81 PID 1332 wrote to memory of 5308 1332 msiexec.exe 85 PID 1332 wrote to memory of 4548 1332 msiexec.exe 87 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\HiveMind_1_0_0_46.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4768
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5C809D166F80C2EEB17065DDFE66D4C4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1636
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5308
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F0303E182BE17C29AE32F65AB6D01B502⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c09d.rbs
- Size 32KB
- SHA256 41679ae6660940bf9ddc1d83552b25c6196150b3874b2a1a63ad1920f85a1206
- MD5 8b0a0fa2fc940dc1ffb2a486735fa790
- SHA1 fcb42d3fc27962871fb43dbab4b332f6a82d0769
- SHA512 e656a29bc3630f87540c82aa00e0f7c2f85537fd29c0546f91f744dcc9e38d43dc8f823568f4835d48f0c0029d2a98f7c348c401098c355d07cc49607469b1b7
- SSDEEP 384:G/Z5AGel9PHeoZ8p81KkUAs6hAlEVPfxaJYAqaB9saOow9nHhwbArv:Gbel9PnZ8iqby
- TLSH T19CE264115A08C7C3F2A8337282F61F092B656EADD1D8586D4E49C5CE8983D9EDF781E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\DLL\NCalc.dll
- Size 189KB
- SHA256 a3f2137f7eb744d43732341539d1f6163a4c3bc90e4d78dc4f07d8b432dcf5a3
- MD5 5e2ec615065631ffcbb0ad6a938f689c
- SHA1 d8771c7dc48f879cd82b77a3bf16d7a66920e9d3
- SHA512 b45c3ad20283f36398cbebc3cd7ea3f7450dcfe5950e7bff423eda4a7788277faf8436faa45b63639525fff3efab425421c0428b4acbeadb17c92dcb6cd8b81c
- SSDEEP 3072:12iAvBjGsfMVM5FLbHWbfIq9UN0bk8MTljiFaIG+Hw/:12TSgFLbHMfIqGubmTVivH
- TLSH T1D014D61437F08656E9BF73B9C8F9138007BCBC4BB47EE34A899484E91D437424965BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Decision Makers\HiveMind\HiveMindExampleProject\bin\Debug\HiveMindLib.DLL
- Size 50KB
- SHA256 24419847f0e199da7f4387ca0afefd7a54761f34ef5b0bd324bf03ea5242fb07
- MD5 7717d7db455ed7b45c0cde302eab8709
- SHA1 706d7a50dafba012b592ef292024b6cdf3f3a9e5
- SHA512 6430f012098a13ede3883e54b6d408b19c49923d415bbc7fcb0531a8ebc91e3419d36ffe444df24554154a59cdf0ae1eecb788cc9a55788947687978dbd8f409
- SSDEEP 768:CUrcyNv7xQcBcBOcht1muS7eRN1o/MH4ZywVAPqtqT2WzeW51jUb:CxyNv7x1BqOwiMH4ZywVsIWLo
- TLSH T18433D609B7EC9617F5BEDBFDE874011D47F6797EAA21E39E8D8400E918263548890B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- Size 37KB
- SHA256 b070a2480945989f59e6f3fc2ccc0fecc6fef8d4f8dba47fcf4c0822ca5a4602
- MD5 f5902cb1aad4293c91c7d8ea9c79389d
- SHA1 623382c0bea42f898fd21567bde624abe92342a0
- SHA512 ffde2bb98bba559af514c12b56d1f2f68b761a9e1d7c6f6da113618373b5bb9381c4df7871c494298225158d38f3cece513a15848b956ce3d908c1dd9172077e
- SSDEEP 768:4exo2dYpEQdmmEiVsi8ZqIyMzNFe3x1o113jr:4B2dcEf0enzzNk3L2
- TLSH T1F30384A86D7B6C6091CEC2720198775E1E3AF6D622D20909CB397A4016426CF6F7FF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 546B
- SHA256 31ce0ee6e02970a1e4b4005429e4de3bbf014d1507069780577354efa3bf8153
- MD5 dfe680e0b4d834a5bf7146d978f33f38
- SHA1 bc16285e6f514cfe67d92d51f5e05a651d4caafe
- SHA512 20d114fa24ce68a38e3be28e240e3498f12188937e283272105131cebb827b53ee787db361de6a0a6fad4572c5a375eb4335429441f7ba039753981f7576b343
- TLSH T1CBF02019889C010ADA482D8ECA42F9760A7007F3B880A096B78C512A4496B48768360F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 1KB
- SHA256 e51b2f70777031090066dd4c040d2091ccddb25c5d72129eb8d5062063ba9d80
- MD5 f7bbcc1fb752bf767fd09f54a6aae4fa
- SHA1 47804996873029e3f7b6fb0e87dd42d1e2ce462f
- SHA512 046263ce7a8c1c592c477d2cdefe45133632de7812a14c38dc666c38c2e51c5f8414047bc515c2528a79b53850f6ec3f1aeb1d5aadee64e71e3be5414a9287de
- TLSH T1B7414CFB7BF0B7886B74C3412174D376AF30D1926205408AF41BB03317473E4692400E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_07E19536AD36D9C337A7321FC4162CD1
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- Size 300B
- SHA256 a48a3402398f10758c87f44ba91f17e382d06072275b4068fd491a8799723fed
- MD5 3ccebdcf95438b1772ebb50e341ce394
- SHA1 9670f170484b1f2c4603739ca207c61c850d10e0
- SHA512 136397369e9f979e3e0243fcf0b9d19226c8623003cdecc4478cef7992477c96c49ed320c95a96f974a5805af052470d776671588c4e6ec3236d0948581d082e
- TLSH T1A6E0A57E1BA84119D17BE67559510141DF31BD22754F9B0C10D4450C7C55FC73C5061B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 306B
- SHA256 21497e190ffac8c93c0349e0aa6c5c120061c553a4c02e4400811bd1ded333bb
- MD5 b2f029808050e2c7f4dbbeaa2cb82386
- SHA1 f3341c368834fc53efd6a2f9126c58352b58c6e7
- SHA512 e487b5f53fe759939db837b13c9c30257a8e9193fce3c26509ccabbfbad466b6c1ba805f8e84345cf227a18b0724d03b5e52a514a62dc344d2c8322619c2c2b0
- TLSH T133E0A7A457F10773F1366A395E70CA14EDB770937515C24C16BB0A1D7C25F129C3554E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
- Size 398B
- SHA256 3e04ec5effb48b0b7f80fc8e4e93e09071adb22ed269fa530be3a3de88f657d3
- MD5 5337e67014fa6fd419377b4aa8922bfe
- SHA1 4d8a4f101bf33317852b909af195484b719e6197
- SHA512 bbdf47b4fa66b20dd5e5edc6bb00164591a1821edd8c35d9157faec29b7af9a5183452912427734b7f6b10ba12197f515d0290757327efffd31128a85a546257
- TLSH T130E07D193FF9013CF0B71CF585E562588C6DF0B1084D827D014013097A2AA00CC72E31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 500B
- SHA256 8d03ab5e29e60d5ea8c16a22d0c23716816e5964ed313931924d51dfda877224
- MD5 8f4593dbfac67c1dac0602be4a52fc23
- SHA1 d0afccc6a8dc3c9c1807f71d9218280f9dd86e94
- SHA512 c7be55706f01f68ba4fc5ffd0f7b8f0e036c6a0a70dd952605c7f12170ec34f2de3194b4623de6e26e6eb842705086d151f04a7f67c254c4029dcb1b8a476108
- TLSH T14AF05C6C16F1407AF275DA759AD66562D412B1123CA4CABB15D04E0E6E42E40AD96212
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_07E19536AD36D9C337A7321FC4162CD1
- Size 396B
- SHA256 b3e683f2dec224b26807625702b0d7f4e490b6fc156290ed60c9849eed2fd681
- MD5 7d2120998406e71ae1a6560a611f6207
- SHA1 7e7038f6142ccbc76d324a29706491be5337b9c1
- SHA512 62857d2f67265e2d2634ea9b2d38256079fdc5dc97e1fbf91b39c85364c48109b89da141612d1352e7b674427f8d258350f267e8074c14c15b2ca2f72186563b
- TLSH T1BEE0262869BA115EE177EDBC4FC5E2A0CE75E221011603A410C05211EB02C045D82AB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3236.tmp
- Size 231KB
- SHA256 ba0ad3a4d2112b269e379a2231128e7ebe23e95d5d04878d6ee8815e657bb055
- MD5 5494165b1384faeefdd3d5133df92f5a
- SHA1 b7b82805f1a726c4eee39152d1a6a59031d7798c
- SHA512 ecd5012df2a060fa58664e856a84716f162d3420e7a7a1368612451ec65f2dcd674c7031d780a6c9d357700f6baeb31325748bc29270850ee4070079f15be613
- SSDEEP 3072:87jf4NyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYJ:aRzCLbY92NLmPUj/u4tL7/R
- TLSH T11D346C2136D4DA32E4E321B456BCE63119BEF4705B70C2C7A3941BEE9EA96C09B34747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_48FB3119D460F4716DADA7.exe
- Size 361KB
- SHA256 c478ccc77c89e180198d3e5fba8ab019697e2b0fc58a71520659e60bee7993be
- MD5 c954f844122265047876d90b1e67fcbf
- SHA1 984cc2e41c8df402dc07e2895e0ff5669d2736d4
- SHA512 d6e960835294083d8dc74cae97180dfed6fb8d24ee87ecf3f74d7f735c193e2ea7af914e3c14b77c03f0304f636a934ec961416049ac66eadafa78d62e3d854c
- SSDEEP 1536:UZHaR8jLmifWjIt47mSjVK/FjkIwqBiTZGrZDFlM8byjvMIKOmSoGilfrAdUtJAi:UASav8bKvHoH2dCpwwIfEvXvbQ/PXI
- TLSH T1577411EFA5D15065DC477BF4E032A82319B25D256AB851CD4AB4FB103A7F283CC1A92F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{0FCC03AE-3EED-4680-9786-023076FF48A4}\_E95F4F630D6D54F57C9A75.exe
- Size 9KB
- SHA256 d4f066db44f8ec61d8ec183091bead9578022c2385d4f7552b32f1b0c53fd26b
- MD5 ce8ee64c66e92bbb46231b1be06aba22
- SHA1 5bb368fbcf57d92d8c83a4487fdde7e713ed3a24
- SHA512 aa31399cde6457dfa727f3f21074efb8f1f5b7ff5bfee6e54231082e7e8f5d4b6d4df90d70529aaff3935bb3ab86dc86ac1a0d85429d247fdcff9720f4e2c0ec
- SSDEEP 96:4kUpiZtd9KZZqwoxcOZQkNqaxnvKdrg8ZxYkyPF7o:gpaUZIwgtZtpvVDN7o
- TLSH T158220343E1449694DD0B0331D9CECFAD8A577CC165A122F932FC3DAA79FB663660B209
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c09c.msi
- Size 11.7MB
- SHA256 63c99b222fae2241a88c8be381f152049c5f60a1be817e52b55693c754a59667
- MD5 851fe5408ceaf904b0bd70659007827a
- SHA1 4e7dd6fe3f622fca0b8ad3b20ad0c56f2902fe10
- SHA512 abf4442ac58791d43274d355840aa4db4bfe8cc717248a2bfa2e090a269e94cf331283a6711e588d66202cc6d1c42b28afa7c3c9dd7b5416609014a426e3de45
- SSDEEP 196608:cu/SFn+UXpsgvQ2pjxdbWNlZ2npEJuqDT+2e0RfZZzDhhlsrYbR6B:pSl+q7jSJyYRfvDhTd6
- TLSH T17AC612EFA4C19175C8477BF5D036A8221573AC245AB850CE16B5FB243A7F283CC6A91F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 aff38f3a291ef05313a74194a0a550fb9c522ad461db1bd18559a7c7f873b4f7
- MD5 4e2e973b6a814faa498e61da9c340f3d
- SHA1 6ac2b1ff6b86688dfbb4e0386333d90f22a676a0
- SHA512 83a59ef5116832b8261be9d0d0a6d3f85e5b1e7cdc70a0395a673c274f8dbf047b9aedb981e5e2663c52574a4f05220adee4a44bb9976bb4321cf0e0ce1bb30a
- SSDEEP 24576:O2gmSp1qdoO/vvTLx26+xEHqfqJRg4OQW25dXpkajB6IkG+/4hrtb3w9h:x
- TLSH T1B447C32436F92110E7F79E3C68F0AA234D3A7D5B9C1A9E8D05451F4E0961FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b9c79ca0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{41ae2550-b845-467b-98f3-d2fa2e97bf3c}_OnDiskSnapshotProp
- Size 6KB
- SHA256 fe5865540c50c7680024f600f401cedea9b9fc03135ae15cc4cc7a686fb9b55b
- MD5 da5c50b69f6039e58e6b6b50f598fe1f
- SHA1 74c782c3ea788767c5209fb783e59d9ae930db45
- SHA512 2e40f1f4e1308cf541c33ec9597cb9241e2f58854fa9269dcc2fbbfa8de0d9ea65b63db68f1744da6a01f2bc18a94d1712bb404a57719cedd56f4e86993d0832
- SSDEEP 96:F4S7tltvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:6Ulnb++ZVmN
- TLSH T171D189185AE54311E2B3AB3228F18557A877B911EF33CB8E0198238E2670910F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH