Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
- Size 1.0MB
- Sample260825-1356jaba76
- SHA256 9bbfc89860d761ea93346d4a70574fb8cfbb228441c59562b3afbc76715512e4
- MD5 c0eff4b2b32a3b4f2ee717db9f8c1460
- SHA1 1ddcc5e5bda753e2ac6cadbc5cc1896c9c0217c3
- SHA512 ec134db2f2d1fee7d7a538c33ae434c4e8295a9a7363f83e0d4f6df5b909a79ce7c5664f61e1c0082726b9482d95926b3f6bba169f86c1cfc88901069764f13f
- SSDEEP 24576:cMw8KH/B1FFD28ssB/7t0ib+UQP9kTPaaVmXJ4:c4K51L28B/7t0iw9/P4
- TLSH T14A35BF037B8144F9F05BC07A565A9739A976BC210F20AADF5350EF292F32AD0AB3D355
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1124 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.sho - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Shohdi.hdi 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.sho 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.sho - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1556 wrote to memory of 1124 1556 2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.shoC:\Users\Admin\AppData\Local\Temp\2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.sho2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.sho
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0eff4b2b32a3b4f2ee717db9f8c1460_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.sho
- Size 293KB
- SHA256 69c4e6a9101e46b939685bcedc0bf32e2262dcefb99149892afef3f4dd329c68
- MD5 fa3ac2bc834604e84539a6523d126314
- SHA1 222c6e2a143894ac75295285e2fdd4e797f38449
- SHA512 fde1082961488dd524b0d91ab46a3f91f40da1b689dd54c2de3402564811e270fb5c3aa0c9e86be3135fb90372a1496a5c6743988e243c50ed4e02ef5798fedd
- SSDEEP 6144:UzlwDO8fTzFOkP1v4DR5lYJR4SVvAaaNXsTi8Poej8A4mbdt/M:Upz8fTzQk9kTPaaVmXJu
- TLSH T1D9543A013F518EB6F5A2807B297A671E1A6ABD224B10D2C373607B4DCD325C5DE3E366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Shohdi.hdi
- Size 1.0MB
- SHA256 c42ba23a94f4c6eac6c37caf66359808f24f5589408708dc2172cba0bbe0a28a
- MD5 5473efc6bf364df06880a54832b4317c
- SHA1 ae0f5a947c37dcfed0db53c8b3db9b06bcaf5836
- SHA512 82ee45e891c3f345f28afb870fe6ed9b0689dfb9f9268c864f969544ae1649249903803caa0d56274e609483d14bd0e6454e75ddc9424ec9be77441645eb3fbd
- SSDEEP 24576:yMw8KH/B1FFD28ssB/7t0ib+UQP9kTPaaVmXJ4:y4K51L28B/7t0iw9/P4
- TLSH T18435BF037B8144F9F05BC075566A9739A976BC210F20AADF5390EF292F32AD0AB3D355
- MD5 SHA1 SHA512 SSDEEP TLSH