Analysis
- max time kernel
111s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 16:04
Behavioral task
behavioral1
Sample
2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260820-th18hsed47
- SHA256 25d552dd1eebd779b6667c4fa5c9dc3a7dd3a6fdcc61bced13e703554d52f50d
- MD5 0680ad6c93d72aeab74c2994ac0bf221
- SHA1 c0116950e807ea16933e4b4fc74d605e38115967
- SHA512 92150f001261baabc65432d9c3f903ebe1c72913d1081044bf5d247cba57fa4a316e0217c32d8be3ace2c2dccb31327a750940c473fa8b7d2cca124be46d575c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcM:A3k03kHRJoqJtb2IC
- TLSH T108853A16E6A44265D06EC074CB929656FA333C8217A086DB13C5F73D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2000-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c52c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2000-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2032-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-302.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c532-307.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997d-538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a89e-1157.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a0000000170b9-1524.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c52c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-302.dat aspack_v212_v242 behavioral2/files/0x000d00000001c532-307.dat aspack_v212_v242 behavioral2/files/0x000300000001997d-538.dat aspack_v212_v242 behavioral2/files/0x000300000001a89e-1157.dat aspack_v212_v242 behavioral2/files/0x001a0000000170b9-1524.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2032 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{32D54D7A-68C8-4A48-B601-5B27D66D3DA0}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2000 2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_0680ad6c93d72aeab74c2994ac0bf221_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2000
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 25d552dd1eebd779b6667c4fa5c9dc3a7dd3a6fdcc61bced13e703554d52f50d
- MD5 0680ad6c93d72aeab74c2994ac0bf221
- SHA1 c0116950e807ea16933e4b4fc74d605e38115967
- SHA512 92150f001261baabc65432d9c3f903ebe1c72913d1081044bf5d247cba57fa4a316e0217c32d8be3ace2c2dccb31327a750940c473fa8b7d2cca124be46d575c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcM:A3k03kHRJoqJtb2IC
- TLSH T108853A16E6A44265D06EC074CB929656FA333C8217A086DB13C5F73D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 efcd791ce89c99d6da8a580fdd9c00c01a6529e0db33f571a90916b6a42dd616
- MD5 69a63feedb942d2bcbf5195332df1864
- SHA1 5a743acb950ee4f8912c9df62463a4fe79ab8a25
- SHA512 028a7efd62b07365ffadcbf42d039a7747446e7d85cfe75c8e0e3800453a3a13e8722b8f329de8d2fbe6b1e0e80464b0068a4060bed1ce2b57f9f46a2abf26a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcN:A3k03kHRJoqJtb2IQTd9CHKyao
- TLSH T10CB53A12E6A402A5D06B8174CB969656FA333C421BB08ADF13D4F63D1F337D19AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 65424e15c24f019e8a127089d6187a0c8bc6781cce16d5ffdd6c589e7479b645
- MD5 da94063407b3b0d2d35ce1f100957dba
- SHA1 c877c1c855fee11ebcb918ece914a825d85e56d9
- SHA512 1ab0cc201ef26356cdb8550548996bdcc88e847b46de28bcef0c7ba5aacdbb003a2964d5b6717c399bb411e7d109ad4ff17de4edd49b2ea9009bf3d6d8254127
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcg:A3k03kHRJoqJtb2ICPji0Aj
- TLSH T1C9B53A16F6A44265D06AC075CBD29656FA333C821BB086CB13C5E73C2F377D19A7A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.8MB
- SHA256 3ef3a74d4b12c855095a8fdc1a79a3a033b9548c5d41c86aae9f9e307a34e668
- MD5 78e2a425faf4043129485888e38f4da4
- SHA1 1feccb786b36bcf3f2f2fefb551967cb32c4547c
- SHA512 ebb1ac38f6127c95b41f884813c8af968afc92238cdae6c84f39f5139f9737de51e182ec6f13bceb2d5c888a4189861802b08618ac4d5dd227986d95a79d8d7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcn:A3k03kHRJoqJtb2IZ
- TLSH T15D853A16E6A44265D06EC074CB929656FA333C8217A086DB13C5F73D2F337D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 2.2MB
- SHA256 289420eb1cf4f0da9141c25d02d5c9a06bdf9aa6f63975f4d286b64cc2147c3a
- MD5 393258d12e0a7f9e041cfcdf732580e6
- SHA1 84dcb92439a6a8a2d942adc14c5c54abb1ad3053
- SHA512 9e7811fc925606153089129dfe9ce1c209355a3e5c44f51cfc9756bf4e3a5e91d197b561e48f66e6317a2e268ce83d8442f5806ea098259026725905f9f6aeb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzc0:A3k03kHRJoqJtb2I/Td9CHKya6
- TLSH T16AB53A12E6A402A5D06B8174CB969656FA333C421BB08ADF13D4F63D1F337D19AB9723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 1.8MB
- SHA256 8b56dfc88e6c60a638a3fce4abffdca924b4face99ea58b130ad47118a111d59
- MD5 3e50e611a352f5c5ffc03d8bf0c25fd3
- SHA1 04c825012bc811c37409e5b6460336a2eebb4056
- SHA512 1fabcfce747577252ba76ae20dde7c81e2e3697c2d0783121e92c99142aa6fae216e7ba2005edcc9fd44dd38a7197fb8361dc1693d27c0231398351ed21ecd79
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcd:A3k03kHRJoqJtb2I3
- TLSH T110853A16E6A44265D06EC074CB969656FA333C4217A086DB13C5F73D2F337D0AABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe
- Size 2.0MB
- SHA256 0f0ee1d3ca806372f6549a112caf5f2172a4a00c635ebc0e2249ef8579dfc1f4
- MD5 72635245451398435e26e9ea8e111b8d
- SHA1 04f5ebba93e9efd11134596d066cd0bef845394e
- SHA512 b5eae1e31f3e8bc95e9bb656c0b6a6f756d4a8ef7c36ad7f568c3f386783c7b336f01abbf3de5b6881592cb8eb01c58e96355593386d79532b20cc933743398a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKcya8eYTqMi8CtBd2QHCHmTBW5jBzcy:A3k03kHRJoqJtb2Is
- TLSH T150A52A12E6544261D06E8074EBD29657FA733C8117A196DB23C5FB3D2F33AD0AAF5322
- MD5 SHA1 SHA512 SSDEEP TLSH