Analysis
- max time kernel
117s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 16:10
Behavioral task
behavioral1
Sample
2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.2MB
- Sample260525-tmlnmads4k
- SHA256 4682be374eb636718e50cf4679b7010e192e1dbb1e83de4668c107c7ea158781
- MD5 7aa4f951ff56898d4987047004d0c953
- SHA1 df6467cec2a535e28952c662e711b9cac166faaa
- SHA512 e7d810509d8f075ee7f2b9e02afb300d4e694c2edb9a9fd0c7dc48e44a3d34d13b6d173b4fe676a6bba5406a8464bccaa06fcae04575b8d14cc3af93e7184a21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgG:A3k03kHRJi56r
- TLSH T1A9557B03E6950FA5D64F813099964622EA777D421F2097EF1368BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/5096-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b00000002b627-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6100-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5096-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6100-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00bb0000000272b1-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001a60c-1534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a8e4-1647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1975.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a0a3-2065.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001b00000002b627-7.dat aspack_v212_v242 behavioral2/files/0x00bb0000000272b1-1375.dat aspack_v212_v242 behavioral2/files/0x002000000001a60c-1534.dat aspack_v212_v242 behavioral2/files/0x000400000002a8e4-1647.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1975.dat aspack_v212_v242 behavioral2/files/0x000200000002a0a3-2065.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6100 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5096 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 6100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5096
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.2MB
- SHA256 4682be374eb636718e50cf4679b7010e192e1dbb1e83de4668c107c7ea158781
- MD5 7aa4f951ff56898d4987047004d0c953
- SHA1 df6467cec2a535e28952c662e711b9cac166faaa
- SHA512 e7d810509d8f075ee7f2b9e02afb300d4e694c2edb9a9fd0c7dc48e44a3d34d13b6d173b4fe676a6bba5406a8464bccaa06fcae04575b8d14cc3af93e7184a21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgG:A3k03kHRJi56r
- TLSH T1A9557B03E6950FA5D64F813099964622EA777D421F2097EF1368BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.9MB
- SHA256 00002aa5fff72bf53d65325015ac9bf3c3710de657ef5f5defa5cfbfc7d3d3f3
- MD5 18c0effbf7f1d2194a88bb47fba4d3fd
- SHA1 f3bf6e92f37412cb07816fa830232eb088e61e0b
- SHA512 cbf1e572609cfd93a0ba4344961723ceeb589990ae4afdc7359d30e5ffc0ba88bc89f8e6ba66b9ffd79afacb776c829dc7176a52b2eed2fde3c5305913107979
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgG+VkGDvQGs94U:A3k03kHRJi56rnVk0QGTvntQb
- TLSH T116956B1292A80BD4D16FC278CA568512FA727C461F2197DF0364FA263F736D0AE3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.7MB
- SHA256 775d1c5f7de5e41214df3436943bbebbfef2ba648b6f9d7ff3ed35090a7ed6ef
- MD5 b3752d22c19e0f71c3d5e18f1f8c9e76
- SHA1 335567678d998c0598792f325dee6a4966ed0eea
- SHA512 1f568c173426d235bb373df64cf1759a6854093104197b313b393c0b86a7af38711bec2cc1c19210c5401143ff1d2cf304ce3a7c2fc021d2df97f58e5a0f72cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGT3Td9CHKy7Go:A3k03kHRJi56rwTd9CHKyao
- TLSH T1AD856B02E6D40AE4E16F81349DA64622EA777C561F208BDF1354BE153F327C0AE39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.7MB
- SHA256 a5c15e53781a39472cacc134443f8192b063d5e5eaf5c41f31279857f5b88e9f
- MD5 f4ad59be0d701ad15cfcb3727a3d9868
- SHA1 d990bc97ee421f3e2cb923b3adc020ccae0be624
- SHA512 21c5b51a95c449f0c74b893393f64d10753c8ec9c2f0a75b7d6c6dcd80d876cb5cfe865784f0cccc08b7f7f9e10440dbf8267c75f0b90fc719a8b570a5141a9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGbUr2d29dBrtb:A3k03kHRJi56rOUidGl
- TLSH T1AC857C02E6980AE5D15F8134CA964662EA777C520F2097DF1364BF293F32BD06F3A356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.7MB
- SHA256 c60be81be97a3fcd4cb3ef26358417984cae5744678a5dd06a65352888bfdf96
- MD5 7c975658b4e9cc3a77d19a4ef14d105e
- SHA1 966f8e89d3c74a974e48c47ffe061e0e919151f5
- SHA512 a2ddf2dc70985cdc823e11a9e63a2b5cd0a75bf773ff0500f9359f604a01e554094480d793064c8ddef7a5bd465efddf3aee772a61b93d0ecf9fac9fa5cd89a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGK3npi63iC:A3k03kHRJi56rpXpiMh
- TLSH T139856C02A7D80AA4E2BB42309EB54661EA777C515F3087DF23947E193F717C0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.5MB
- SHA256 5f4618891c7377a27e826b8c3435b4963e83eb9174b421945c442b64b17d3b51
- MD5 a9e2333eb7150ab6b17664979261e49a
- SHA1 7dfe53defef40529d10138898edb3b7c295524ed
- SHA512 3974ac65457c9c42bfa194c7f532097d8d0bbd7f25abb2b548b7637245cd669c27e68ec552c1f95ad7124b4fbdb8c1dd24c497d8bf77f6d97d5a799ed98b2117
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGLV+PAk2hMH3:A3k03kHRJi56rwi2WH3
- TLSH T106757B12E6940EA5D25F81309D998626EA377D420F2183DF1354BF2A3F727D0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH