Analysis
- max time kernel
96s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 14:18
Behavioral task
behavioral1
Sample
2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe
- Size 1.2MB
- Sample260601-rmgnkaft5y
- SHA256 f212b4feed8ead1043599eacb86cabdda310a86591c56cc6f66affbb2997f6e6
- MD5 8d5a2370b8d7633bed82094069014d64
- SHA1 ad499c4e334684fd7b511b5c7521f378c85ef56d
- SHA512 31863057d3ece73b7dfa3428fd0cd75c558d1321316e6bb6410e364773ff9cd9add62f01d1d262701b5624b1ed99feb04ef91db8aa485b5a0abec5a628192e7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGq9:A3k03kHRJARJwi
- TLSH T15F454706E69400E8D11E8134C7969A22FB377C5217E097CB13D4E63E2F626D0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3564-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b50f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4420-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3564-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4420-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ddf-1284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e7-1634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b51e-1664.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a104-2061.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b50f-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028ddf-1284.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e7-1634.dat aspack_v212_v242 behavioral2/files/0x001a00000002b51e-1664.dat aspack_v212_v242 behavioral2/files/0x000300000002a104-2061.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4420 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3564 2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe 4420 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_8d5a2370b8d7633bed82094069014d64_amadey_cobalt-strike_elex_hijackloader_icedid_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3564
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 f212b4feed8ead1043599eacb86cabdda310a86591c56cc6f66affbb2997f6e6
- MD5 8d5a2370b8d7633bed82094069014d64
- SHA1 ad499c4e334684fd7b511b5c7521f378c85ef56d
- SHA512 31863057d3ece73b7dfa3428fd0cd75c558d1321316e6bb6410e364773ff9cd9add62f01d1d262701b5624b1ed99feb04ef91db8aa485b5a0abec5a628192e7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGq9:A3k03kHRJARJwi
- TLSH T15F454706E69400E8D11E8134C7969A22FB377C5217E097CB13D4E63E2F626D0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$
- Size 1.3MB
- SHA256 d867ff3afdf41a7988b1be00c583df13c524aa48bbc2c187b49ae52bf65f1db8
- MD5 7e21c60ca47b142ff82feaca039bcebd
- SHA1 ee59a427bbea3560a1440b387771d6469080aef6
- SHA512 088c25f1a2737e8fbc9f68549880f9d96a1c281480592ed56e25aaba4dac5adf574e75417467e8f117aa7825d816d60ac1f209f51d842acf3c83e373c350b630
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGqIGen:A3k03kHRJARJwUI
- TLSH T173553707E69400E8D15E8134C7958A22FB37B86207E097DB13D4D63E2F626D0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.3MB
- SHA256 23faf58b05b54c1110aa250aa48e76802e63e3407155ef638dfa32af81ab308f
- MD5 8a5b60a4ee3f27fb450ee60365435d14
- SHA1 5a686064a165a4f87669bf709ca15d20b8054cb7
- SHA512 f266ce2951d8c0847edbbc8d0e47d6e1f90c4613773ca47a10ceed421ad062040d1a2fc9a49b7c02ef8b55eba13824a079c9ed2666dd959c8828edbc253ead11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGq/TjE:A3k03kHRJARJwgw
- TLSH T1E0554707E69400E8D15E8134C7958A22FB37B86217E097CB13D4D63E2F626D0AEFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.8MB
- SHA256 156b56fbd50e0c948edf4a7c94f726a8ea6bf1f448962599f9417801081761db
- MD5 fe6802e6afc72a0788197f2eec6b6e0e
- SHA1 3d1d268e1149f4ca2fdd25cfcb6b85ede14d6a78
- SHA512 1933c07315ebaeeb251413ab7dd3b5d10bcc7b24dccdf0dc719d002d6f0cba4253a21ada269ee3d0081779dbf2e5507a381002123036c10c79d14f60ed443bc4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGqJ0Le5ji0hmxNrM:A3k03kHRJARJwiPji0Aj
- TLSH T136855A16F6A402A5D06EC178C7D29A56FA33384217B086CB13D4D63D2F637D19EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.3MB
- SHA256 fdd755ddcffd9455c14343ece0ba994da3453977e712c158d2d5fa5ef2b90031
- MD5 2a789589f5333be4ae5376a3bd18059b
- SHA1 b0954a078bb2ae9082ccaff867bd60bff92a4bf3
- SHA512 98bc1dcabdfa8740249e589e6de1b453143798a80d0667720021f8af3d2b2ebb15687be9a70450e630de8341e5ae7b32bcc243bbf12a9171ed530cf37458ffe8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGqpF:A3k03kHRJARJwy
- TLSH T112553802E69400E4D15E8134CB968A22F637BD5207E096EF13D4F63E2F726D0AEF9657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.5MB
- SHA256 1dac667a92604685be1badbe42cee6993de749bba87aa8523c6cd8348f8fdd3c
- MD5 e46450c9db21718fab117ed3d82755a4
- SHA1 7347ebec3a910a772dcc3075ae1d4ff918331cb0
- SHA512 b636194cc861c4c297dc16df9e62334685c8c9f4d36f6cbb5ea290459c942561d63a3ff752d58ed5f87b0fc49612d07131b67fb2fc568938f67c1a006b118363
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8saE2uox0zGqZV+PAk2hMH3:A3k03kHRJARJwwi2WH3
- TLSH T15A655922E69400E9D11E8134CBA59626F7377C5207E192CB13D4E63E2F627D0AEFA753
- MD5 SHA1 SHA512 SSDEEP TLSH