Analysis
- max time kernel
80s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 15:01
Behavioral task
behavioral1
Sample
2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260519-sdzy8afx3x
- SHA256 2d8a4e7da58a04acfc3126d7b797d4f27b66c4c28161af0efdf1a2c84e072e1f
- MD5 7cbd7853951a35a36e32951289267d5c
- SHA1 51768448fd5fc8b84b7a427fcef09330e3269cd9
- SHA512 8e292f8f19ff92d59cd7853136eb6e812123b1c34386f47d8362fcd91e0f6b4d913d8fb49d1df52fb9ef7eba7d7a13cce5d0c5f2db6c82f04e7c8f0141d225bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmC:A3k03kD4U2v+b56ru56rX
- TLSH T1AB557B17B7884FB4D11F81348B899662E3BB7C614F2057DB1794BE293F326C0AA39647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000243a6-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2924-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3076-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023523-148.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002c00000001e809-1536.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000230f5-1762.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c0000000243a6-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-11.dat aspack_v212_v242 behavioral1/files/0x0002000000023523-148.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1286.dat aspack_v212_v242 behavioral1/files/0x002c00000001e809-1536.dat aspack_v212_v242 behavioral1/files/0x00030000000230f5-1762.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3076 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3076 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_7cbd7853951a35a36e32951289267d5c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 2d8a4e7da58a04acfc3126d7b797d4f27b66c4c28161af0efdf1a2c84e072e1f
- MD5 7cbd7853951a35a36e32951289267d5c
- SHA1 51768448fd5fc8b84b7a427fcef09330e3269cd9
- SHA512 8e292f8f19ff92d59cd7853136eb6e812123b1c34386f47d8362fcd91e0f6b4d913d8fb49d1df52fb9ef7eba7d7a13cce5d0c5f2db6c82f04e7c8f0141d225bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmC:A3k03kD4U2v+b56ru56rX
- TLSH T1AB557B17B7884FB4D11F81348B899662E3BB7C614F2057DB1794BE293F326C0AA39647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.7MB
- SHA256 84a9dc236384c9166f06eaf151ecaea91a80c9dc4d4f7890129ff9b66dc0c627
- MD5 42972eeee1355fb7362524fea098a09c
- SHA1 7da9335af783bab7341b837747d9970edab8f9cd
- SHA512 f8e82be0202314a4e810abbce3158300256d8098cb7b57b07bcab3644f86e9a7e40070683722e81e3e2787b4687cddc4844aa2694397238a904f850315072fa1
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmO3Td9CHKy7GZO:A3k03kD4U2v+b56ru56rXTd9CHKyao
- TLSH T16F856C16B7880FB4E16F81348A959662E7B77C654F2097CF13947E193F326C0AA39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$
- Size 1.4MB
- SHA256 aa5c5605f890412aa649b2840f5b7656706518f48f949a88d931153944c8348e
- MD5 84b839a2924a6fe86ade76e19ce01fce
- SHA1 5da07f8c251b4b7da2954d6670c55786ba4ba0c7
- SHA512 8c8f970145be537050f0d582982a681f78730887c8cfbd71c58997a3d741b2f6d4cae33d7d7f8f0ee18821ccc2bee0b4145f4ae1f9a071c7a3e40c7022368c59
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5Tvinrm+TjE:A3k03kD4U2v+b56ru56rNw
- TLSH T10E656A17A7884FB4D11F81348A859662E3BB7C614F2057DB1794BE293F32AC0AE39747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.8MB
- SHA256 8c5e2aadb5b53dbf89866982c48c5d4915d757489bfadf0f46a42741d0bb5cb7
- MD5 d19260b6f23fcb37b2c0bee7a3eee284
- SHA1 2e066f5ef982ea3920db92694a3a80f0dc2561c7
- SHA512 5e1fce855d8f76dc6eb50f4e9112b1d84cf862b2e574a2fa589d6b2e90af3f52d08c50383effa96592d79618763a3978337d9e7702647bc229bacb7f2d43e035
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmC0Le5ji0hmxNrM:A3k03kD4U2v+b56ru56rTPji0Aj
- TLSH T195955B16B6584F75D02FC175CA9696A6E6B33C510F3087CB1384AF283F366D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.4MB
- SHA256 2a2b5457510c33d2501052821a8045286b5aa1b90785880e3b7757aa05c60763
- MD5 ded4b1f699c6e5ca20a3ce568a394a66
- SHA1 7e199a4f9d6a6331a9e77c98218c03e4037767b0
- SHA512 c061ec11e6fc544c71a9812f2a28465ea84826c2ce849e847b5dfb91550abafab8c03a6ee524684049947231d139afb923faa2d85266949260e8edc953232b0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmrD:A3k03kD4U2v+b56ru56rU
- TLSH T12A65E216E6484FA4C11F8134CB959662B2B77C614FA093CB17D4EE3D3F326C0AAB9647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.3MB
- SHA256 fef8bddb123ffdcbc89b26788140ca0648ee6758ee603b656da7228607e7c109
- MD5 5cd51d1d81e840997b4c149cfd0053d7
- SHA1 06541ee867d0d1098608049eee457c5bc3e50001
- SHA512 173d20aaf3adf84c62e92b8d223ee768deff804e160240f6238681f4a2f901308a8b1f406d470e2b8a7da894ae27250f43eea1032e13ab5e66b0e45776b8745c
- SSDEEP 24576:A3mnXoZ643mnXoZ6ia4U2E+mRP3gQD5TvinrmVD5TvinrmgF:A3k03kD4U2v+b56ru56r9
- TLSH T107556C16A7884FB5C25F81348F899661F2BB7C610F2057EB1794BF297F326C0AA35607
- MD5 SHA1 SHA512 SSDEEP TLSH