Analysis
- max time kernel
145s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
27/09/2024, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
f9b98cba4adafecbccd7ccf51d673c81_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9b98cba4adafecbccd7ccf51d673c81_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target f9b98cba4adafecbccd7ccf51d673c81_JaffaCakes118.html
- Size 86KB
- Sample240927-faqj6avhpp
- SHA256 1cd729bc1c7f2334b93b455506027a9650ec20d886a15630e3118f72d723b2dd
- MD5 f9b98cba4adafecbccd7ccf51d673c81
- SHA1 c252f8d9023753bc2d6b80b6620fd968113412e4
- SHA512 891f471d9b7bf0c5619f080bc6d894d110d53e6d3d82fac3e17b77cff13450014b110c50eeb58da3d539510d3e0922f836fb6d363c09c083a34e4462a0bf9c7c
- SSDEEP 1536:bWVOZO84f43L11rqy617WfwFg+z/jIeILOrwAIm+Y+uuMyjNHN9Vk:TO8o43R1R617WfV+z/jIeILOrwA7Z+uj
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 34 sites.google.com 51 sites.google.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2556 msedge.exe 2556 msedge.exe 3436 msedge.exe 3436 msedge.exe 4972 msedge.exe 4972 msedge.exe 4972 msedge.exe 4972 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 4056 3436 msedge.exe 84 PID 3436 wrote to memory of 4056 3436 msedge.exe 84 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2032 3436 msedge.exe 85 PID 3436 wrote to memory of 2556 3436 msedge.exe 86 PID 3436 wrote to memory of 2556 3436 msedge.exe 86 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87 PID 3436 wrote to memory of 452 3436 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9b98cba4adafecbccd7ccf51d673c81_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb95f46f8,0x7ffbb95f4708,0x7ffbb95f47182⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3836595782260081866,11065162900059828141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2648 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4544
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
- MD5 9e3fc58a8fb86c93d19e1500b873ef6f
- SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
- SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
- MD5 27304926d60324abe74d7a4b571c35ea
- SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
- SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
- Size 23KB
- SHA256 7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc
- MD5 c897f8479da25ec570027594f1b4db24
- SHA1 81a3ff06cf35a87e697fc4733966dffc270ad06b
- SHA512 b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10
- SSDEEP 384:tU+gw6ZANCOehcIFLQp1N7sYfDUPbBGbouF/Ufk+/mc6522rk1l+vTZp4UMIoXAE:tUW6qNBeaIRQjfDDbouF/Uf+c6kh1l+6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
- Size 45KB
- SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
- MD5 ede70f717200a59b4cb831635de913a1
- SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
- SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
- SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 e0d9fb94343ea461cf9253e1cee50d9b6265bb38942f1f2ee9f83d2c74c36790
- MD5 54ddaa75165a7d76294d64bb5e66cdb3
- SHA1 16af3bd598e5203becd497e16ad1bf7ce6316d71
- SHA512 30d0e5a5387a03b1d91e334b5732241d7ffbd2ea1288ee83559cce25db4bec57d5f16464f3a73d9f3f01bc2a08180e06f031d0a1ac62c2601e8ab8b69ec4845f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 e9a98f2912d8206d9ccbb34c6e5539de90f7d2100491f40fcc87ed13b9c67206
- MD5 c2ba837a9713c33ffe49abc22ced31fe
- SHA1 f451cde11bbb6d25f35cbd5713f2eabeddef5492
- SHA512 1b6dba86306a78c82e605f4c89f9ef13a8b98af40fb97b151ac0a60b739c05b79c45ceb25efdd1ad6a346afec88d7482245a4d7ea8812286e4fc283f143fb18d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 3KB
- SHA256 81ff7fd562a14daae3a3bc883e38b5f846396fd46aaf23d2b226d1d3cd47a0a9
- MD5 3d1679d4e8e3f07a9834beae38ffe853
- SHA1 3db3f638fead65695a019d4bfc4f5d69688ba170
- SHA512 ff74aff11337471373183b88faf42857200e37469881a008874068c8845e211f3e8ba235ca062646b6e91c750817ec766bef91840890912c476f29b2523ecf70
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 5ce3813c0e997507c78b035b6e21e05d3e5c8f8b0b0fd85eac9a10f7f7378308
- MD5 57202c2365d527353869131f5c6a8d09
- SHA1 09b50399b4dc80f807d1c1833d792e5031300450
- SHA512 7ed4055f66697dc6588738c76d82c36b0daf78c1f5154004b6984834a3c8ce1f9ec9bb0be3e9ac7645512a2ac712aab3c3a2cf460f83dba711c1edaa35420056
- SSDEEP 96:nskd2n14NwpvWMoiVmdeH4piNN+UWQyV+VD7ziEwb:nskdsmNGWMX4k7+rt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 9KB
- SHA256 db09e1acefcc114ede6cf0fa820adcabf70f715b6b1972a1503416c5b892382a
- MD5 5b93eaa72c767883c12b3dee4c6eb743
- SHA1 8451a0cec1efbdf4af0d3cf9e0fc1a53bebc8e31
- SHA512 326699bbd7f3e245dd66edbd6ad7fe170e8ea2a012862b9720dcdb1a29ee217ee2d7bdb692e0acb5bcc4b2b8925a13bbf75ff335f1062d8492314208041d1bbb
- SSDEEP 192:nskdimIGWMZSCe21Eft1qb++efeTSCf7ZKnK5MNnkZwE24k7+rg:nsJmFWceQk7P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 fa58f12e4a9d4a1cb9267d9146f579454c1580e7b5d3d3d427168317e8128171
- MD5 81bec2dc2118f5f70fddb08b4db8cefc
- SHA1 802c2dc9f62feeb568a50209169530f8710301c2
- SHA512 b71ed88b54c1bea01c6de7090a5d5b7ef02c67daab5e7fe7f0f0dabc954094c325852df1d3d12ea6b156e8fc709c83d803e6cced8ff86531398d58f732e8db32
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB3e2RUnc8GIcM/bo5Zxg:A9iIxuERzA83h09RZxYB/8vqZxg
- MD5 SHA1 SHA512 SSDEEP