Analysis
- max time kernel
150s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 12:25
Behavioral task
behavioral1
Sample
2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe
- Size 784KB
- Sample261026-pl42cssx3r
- SHA256 2824c4d2a6a8f5a85737e0def4d6337b2ce6dc9fd7bbeb49880613fd4433d9e2
- MD5 c9fbe589c334cab0df70a10c065167a4
- SHA1 e1ce555b266eb65a649bedfc6c6fbe088ab9a4d8
- SHA512 3dd419b31c3ed3aea155329813676d450f30b13902052075c13f932a3d577b992b04087e56487723c51329b1f44d4a0c410fdf9760e30f1bbbe92129280f1f32
- SSDEEP 12288:5gQ2uh3Gx5MbgZrwc2r5hpnW8pLzDAt4VxHUGTXSdN96cSLoV+D+nIlx:59dCegZWrhBpLzDioxHdXTcSz+nIl
- TLSH T12D0523569B58605ED13072B4573B136783D975302887DEA9B3ABDCED2FAF272341228C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe -
resource yara_rule behavioral1/memory/1432-0-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1432-13-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/files/0x0001000000017011-208.dat upx behavioral1/files/0x0001000000017057-212.dat upx behavioral1/files/0x0001000000017bd3-216.dat upx behavioral1/files/0x000100000001742f-220.dat upx behavioral1/files/0x00010000000233b0-231.dat upx behavioral1/files/0x000100000000c51e-236.dat upx behavioral1/files/0x000100000000c53f-240.dat upx behavioral1/files/0x0002000000021ae8-244.dat upx behavioral1/files/0x0001000000017ec7-248.dat upx behavioral1/files/0x000100000000fa68-252.dat upx behavioral1/files/0x000100000000c405-256.dat upx behavioral1/files/0x00010000000177ee-260.dat upx behavioral1/files/0x0001000000017814-264.dat upx behavioral1/files/0x000100000000c8e7-268.dat upx behavioral1/files/0x0001000000017853-272.dat upx behavioral1/files/0x0001000000017ec1-276.dat upx behavioral1/files/0x00010000000178cd-280.dat upx behavioral1/files/0x0001000000017042-284.dat upx behavioral1/files/0x000100000001797c-288.dat upx behavioral1/files/0x000100000001799b-292.dat upx behavioral1/files/0x00010000000179a1-296.dat upx behavioral1/files/0x00010000000180b1-300.dat upx behavioral1/files/0x0001000000016793-304.dat upx behavioral1/files/0x00010000000177c8-308.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe Token: SeDebugPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe Token: SeDebugPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe Token: SeDebugPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe Token: SeDebugPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe Token: SeDebugPrivilege 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe 1432 2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_c9fbe589c334cab0df70a10c065167a4_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 7cf74a0a6a9550cdb6605ce521c30915b4b5ebbe9d889de25d61d245610c17c8
- MD5 541a7e6f8aae014ece2e77e9c99629dc
- SHA1 525a0eeb23c7fce9b6fa1293401a29080cb63622
- SHA512 3a234fbca0244e6f9d8bbb82be5d1183935070823d71fb419280469e01df621111a42b3e0efb2cdc3745d15f6f555e3d76ed620aace3ba74d1ca2dc21e1340cc
- SSDEEP 49152:5UW632BuPkFKRrdE6oh7stBhuXjfS4LWxnR1gWNXLn9BxSnI:w3q6gjBwFNXB5
- TLSH T14DE59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B6562F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 14f438e03fbe294defb4672409032ee067878d27ce16100656ddd15149816d01
- MD5 ff4cdd2681742a8988c8a436234b0259
- SHA1 9aa7d99214ac1213da1971ede1c6ba12b474b3bd
- SHA512 dbc6539219db1269dee7c487c058894b359646b17183251c5f9ae258589a0b2c7710a17fc254d8385e702cc5fcc2efc93056d0101135a07f94706c7562893e09
- SSDEEP 24576:9XYKDtczAbh9dCegZWrhBpLzDioxHdXTcSz+nIl:Dtcq1gWNXLn9BxSnI
- TLSH T132250229B7D408FDEC67927CC9628112D7B378504760EB9B03E489691F273E86E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 ca22438dd7ed01d418b31c327bb41650a71d29c5b316078fa680acda8f5933ba
- MD5 9b57a1a39ef8022749fe9743cb3070ba
- SHA1 88025bfd6da5c52b7b57ef666591301abac95166
- SHA512 5ff7c47fbf50f5c77d02d105a1dd47c28696b68d9399b13786d1892c8b86a5252590e77e15e8a3b6723d0da46b83cdc47d9a919bfba8e6a7538bd542b30f50c2
- SSDEEP 24576:3wutOWDgp9dCegZWrhBpLzDioxHdXTcSz+nIl:3w2OXp1gWNXLn9BxSnI
- TLSH T14525014677A81CFDE562523886578136E7F2B8112A26DB1F13B0C69B1F37371BD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 2cbc7d29ed8c22e9e31fad6ad3ba7cf7e29a822e7ea8d40b17a9696f59b1192f
- MD5 7d82101f4413774a0eb43ad4cae44d88
- SHA1 b524ef82388dd8b2f1197e7e743df997e14987f6
- SHA512 f7dc9eac6e332ff683c345cbb37b565e4b25fb56956b4e7dc47861b3485d30c52670513573df033a47fabbc62033112cb33eb8cd9acd7b49eb71141c02b5bbca
- SSDEEP 98304:WQRQyi36YOcP8Lvw2gAf+PN3bb2hg3T+:dQyiKa+X+PNh
- TLSH T19A667C03F3A501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 2e7a6960c1d5045ef70a85d42456e03af1392765533d7a764340e7768f08c565
- MD5 81932d23e371e65c11971810fd078b47
- SHA1 6aba572c48dbf78fac7b5f22730886fd7fece76a
- SHA512 cda43df7134bf6365f3a377c792887269d01515dabbd76f4f14594d132632d6723286123d95a5c9e6242ef3bdb90b7ebd38a0cfea34e3c32ff7898f1d2eb169c
- SSDEEP 49152:Xi+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl01gWNXLn9BxSnI:Cu6JmTxd2d0FNXB5
- TLSH T127E5AE13F1D901E8D06AD178974A9233EA62BC490B35B6EF0A9073562F77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.7MB
- SHA256 c7887e47f65fb907624f4fa567d5e57563210936a09aabd9b8c934972dee0878
- MD5 5e9337aa7497b6efb4fb9bee6e88eb3c
- SHA1 138d0b28db2a259a5a9b43399c6aa09a07daeef7
- SHA512 8942599796188e31ea688c22aab5388f19229a5d28b9029284592da21f09dca5a8771833eaaa4e592478e98b4287154e9655fb6fa35725e57f4372e691ff4913
- SSDEEP 24576:AcP4mcvIjkGOxhKP2l71zNKbrh/8KBs9dCegZWrhBpLzDioxHdXTcSz+nIl:LP4m4IpOO6768KW1gWNXLn9BxSnI
- TLSH T19D85BF2DABDC0096D0BA917885658A4AFAB1742A1F3286CF1160937C3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 e367cd1d7f991c07ebd23a23694b6e787f6fca221bd133f9d84243c30d0dd8c0
- MD5 5619dc3a6322e40baa2228784f9efca4
- SHA1 5cab17795a518dee092ace39422da8043bfbcbb8
- SHA512 495d67f446552efba6f1821e2cd470c2747e2fb1a29d733de05e9fe0ce7774545d3faf7e33ce701910ef820c53e1d7bf1c585d6226c384c6200ee84f5fbe82af
- SSDEEP 12288:L+5gQ2uh3Gx5MbgZrwc2r5hpnW8pLzDAt4VxHUGTXSdN96cSLoV+D+nIlx:L+59dCegZWrhBpLzDioxHdXTcSz+nIl
- TLSH T1DB052356975C204FE07032B4563B526783DE36302987DDEBB3AB55E91FAF2B2782124C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 dc3cd2c94a89a38c35a6fd60631528dba973c1066f30b71a078c6181be96a963
- MD5 5a684d2fd03b8d3f99e895141a7084f3
- SHA1 5489b4364b5452e2751a29976b379a7e976decd5
- SHA512 3f51108f2112a8853ec625d9b0449896b86a44b9ad9bfcdf63d6db613e889499a789b4946167509e2ea7e014e8a1fb327b0c059799936c0b035590adc5325d43
- SSDEEP 49152:Ha0h2GEkuAe73q3ppt6zwwQm1gWNXLn9BxSnI:Ha0hNYGtJwlFNXB5
- TLSH T10795AF1E67EC82B5D0BAD278C9A6814BE6F2B4221B3156CF1151853D3F37EE44D3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 7c6f26beaec753e8bbcdffe74698073d3eb234fbf2344a801efcc4b22a53b8a4
- MD5 603c0bd51def02ba09ed89d12c0d25ab
- SHA1 b7533dc1f4c143229e441cffe2a356e853fe609f
- SHA512 0920d87dc1b85a538521a242dbfc3c13d151974ffbe39d43cfd1107889c9c7e8af034f41e151ec886ba4e9d8674c5685b41a81d8437fbca576bbee20435659c7
- SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYhjMqbdGb9dCegZWrhBpLzDioxHdXTcSz+nIl:5TDxR+N5YzTTjMDb1gWNXLn9BxSnI
- TLSH T17F75C02EA7F815E9D17E85789A238512FBB27821133193CF42A0C17E1F6B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 849KB
- SHA256 446a3087c4c2374e7fdbc42c08433adc10ba539547391f1e8d8d2b379fdd9f7d
- MD5 e39a595f225f9ad3fbcc454786eeb988
- SHA1 5a04ff835041c543a42cf7ae25048691d4ab8634
- SHA512 231d0b657428246e0e491f65f83a382d2bc4467544c05dcd2fe2e10133172eceadff2a8e7f4789ce47ad1564deddd433a92bd9ce1983c758ace74dab15fc45aa
- SSDEEP 24576:0hbHjPs09dCegZWrhBpLzDioxHdXTcSz+nIl:0hbHjT1gWNXLn9BxSnI
- TLSH T1AD05127E67AC20DDE170A27C96664247C3B1B820171297EF63D681BD0F2BAF52C35B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 4788af728108d019309f3201e7b38a39babbca5c255cf16138f78adb55e2060d
- MD5 7437b7b10de71e1ea5b4506aa1737ba7
- SHA1 1db24f8269cbaeef055605208c7f05316c20c48f
- SHA512 cd6188515f309179b3fd78b51786947bcb009ae43db9b7a6510f8c9ec9a03c879fc8a6f3d32da562ad77fa20a2d0daf966f28d5316a98251883ae40a639ab4c5
- SSDEEP 24576:jX1gnJcRTk4yti+R5dUR/re9dCegZWrhBpLzDioxHdXTcSz+nIl:jFgnaTk46pUR/C1gWNXLn9BxSnI
- TLSH T13565C02EF3B910B9D4A6D236850243B5EB71782D1F219ACB0174C538AF0AEE85E35F5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 768KB
- SHA256 564849b21052ba20c0f393f40e0b10dc629d928c6c2bd11a4c9b9dc334e5d2d9
- MD5 5ea3a60c4696257615d4ae4a99c76feb
- SHA1 081b4cb219c7e098bcd2504d99d5ac03a5f776d5
- SHA512 a8f0e5e30ae4cdcc34ab035627583ca103e90ab8943b289f82079ba7778a8640d28eeecfa9347a7e35642e260232dcb8508bd7aa94c79d2efb03a5cef0e3748d
- SSDEEP 12288:g0ugQ2uh3Gx5MbgZrwc2r5hpnW8pLzDAt4VxHUGTXSdN96cSLoV+D+nIlx:g0u9dCegZWrhBpLzDioxHdXTcSz+nIl
- TLSH T163F42356A758209ED13032B49A3B1357C3D936302857DEE9B3BF98E91F9F3B23521198
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 79cbfc7d94d0658c809738c3745110850227dc06eab8f51946bf2c2d426af9de
- MD5 3fc3c32c3bebe9291dd00593918a3c32
- SHA1 4459b63309503f62cbcd30d87c5d8e52c614e043
- SHA512 2883730580cd387bbd684c64e7fe9b8c22c51c159201006a397e50c839253f26405b611d5e27e83523a3784e7028c91767cd42f9d807b5b9597cd6f8f8ec2fd7
- SSDEEP 24576:oHL3UTa39dCegZWrhBpLzDioxHdXTcSz+nIl:oHL3Ue1gWNXLn9BxSnI
- TLSH T1FD350155E7A400F9E877923CC9768613D2B274680764EBEF03A94AA91F533F25E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 861KB
- SHA256 64f668923ec59abcdfd06127c51b52004356c70782f46d5646e4ac4bcbfa712f
- MD5 d617e3cc199fbe94d18f342445cad3d7
- SHA1 450552931b55c4ec939270f3bb89847606dff063
- SHA512 444644a881922a60eaac559677541903d1b85620993f42e14252fcab6653b5f4dd2b6fcbf4e20383c71a6f010a3ff4773d94c9bea45e1583f272b984f0c269f8
- SSDEEP 24576:+ODN9dCegZWrhBpLzDioxHdXTcSz+nIl:+O51gWNXLn9BxSnI
- TLSH T13E15121A37AC20E9E174627C8A67534AC3F1782117129BEF53E181BE1FA7BF46C36650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 c8f95ff864eaa3d2d27b5372aaf7b980ba871d1b7506d59c8710a3b67a776193
- MD5 de35315c04cf8399b465fd6c352f5bf9
- SHA1 c3c716bc9e3340470e1a587bcb3fc93cff8a743d
- SHA512 86986c447ce0c195fd3394cfd870b66d3d79148a0b2857e293bda84276ef26faa800e3cb2cde86f80e077e7682943996726e6212520098986fa69451be871868
- SSDEEP 24576:z7NM9YeZqmWMUkPjZM48Mv6bEhsH9dCegZWrhBpLzDioxHdXTcSz+nIl:z7cBWMpPjN8DbEhQ1gWNXLn9BxSnI
- TLSH T10185BF2E6BAC81D5D476D13DC9A28206F6F2B4611B318ACF1162833E6F37AF45E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 2c95d373f6da1b66495ce962a9bce88755c23c71aa0c0968dcfd3f42470af01f
- MD5 9504fb0d9d338de8112d799b2cc20cd3
- SHA1 cf51a4f9b14b3768228927b504c134cca26624fa
- SHA512 5f9c36ca8e41ef3377d1c175dde8d6ccd44c294d3f7431ae1835598e569ba260add9420e206ea9f228f64bded345dfdec8e3bd346aea37551131f478028feebb
- SSDEEP 49152:8F2YuHNETovIvNYf8kmX1gWNXLn9BxSnI:Z6ZCf8kOFNXB5
- TLSH T11F959E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF45D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 a538bf445f389cdddc80d4b035e0f17ddf882ae9a095c04640e3aebe3061f1de
- MD5 34a1376ec0f5636519fae0e484450e7a
- SHA1 8eb516511ca2ce8171b4c6fdd1e7bed3b6ae81d8
- SHA512 4b25a35f37efae92df4844f94b05eae81a37729db9cb327272f2ef81a02f0d8be11d78214e076952d847eb38baec288b40414fb6ed21570df51d632f8738029c
- SSDEEP 24576:zTMdOz0FFS+HmSLzq9dCegZWrhBpLzDioxHdXTcSz+nIl:x0K+HmSLW1gWNXLn9BxSnI
- TLSH T1CF35F27EA36D14E9E07AD27CD6538907E6B234610312AADB06D1C1B92F5BFF43939B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 cb6700de5c8a0295c04b7b5e6b5d2579e8a1f84398221cdf016a31d2765fce2d
- MD5 ef1d206c29d3b093d0f6ccced5286147
- SHA1 744b2e447b5886a71591a69f8d12bfab87284ef1
- SHA512 5f10ea11cce20801284c307bc2fc40eaa6fe10b8bd7870fb341b5ec344485932b0b9f297b9140a67b1fc72fc80ea8d1441f70ae5085f6e8157a4a3dfef5d042e
- SSDEEP 24576:3AFs06+OmlfzNXEbToba9dCegZWrhBpLzDioxHdXTcSz+nIl:QFs060lBXu11gWNXLn9BxSnI
- TLSH T1F575BF2F66AC00D5D07ED17D8A97C91AE6F1746307255ACB0260867E3F6BEF81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 0ae159ea457d5f31a53e5a874c836b1b939bf1983a69bed028632cf9a831722c
- MD5 19a0187e8e2e180eba0a0b35ee993f03
- SHA1 6f78e72887b06b7be28525e9bd1658d0e2701105
- SHA512 9776e049283ca2c95b0799260884c7e71a34a2482d84c6dfa0ca12e4d1c978460162861645d2b67a5c13f634bb81860a1046f287d97f84a73659d47e894286a5
- SSDEEP 24576:9JnJ5D3W2/L9dCegZWrhBpLzDioxHdXTcSz+nIl:9JnJ5DG2T1gWNXLn9BxSnI
- TLSH T10035E02DD2A810E8D0B7D274825A1756FFB2343D2B226AC724B4D5353F16EE0A979F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 b72fd0eba6832465590f0fde01573b3429f5510589bcc110d438393cec2ed17f
- MD5 d36e50410456a53179dffec6b16b96d8
- SHA1 37ea800f8d7d9906d7d9bb4a8fd7a1340bf10e91
- SHA512 d3516e4fcf5ce71fd92d159ab180e5814af80e59a89986cc41ff1f62e2f688a5af3e9aaa6e4ef1b87c5101bec15cf7c75d3267d806fb1888fe9bb7cfe1e4025e
- SSDEEP 49152:nF06DIKdwc+eQnSt65aVz1gWNXLn9BxSnI:FrFNXB5
- TLSH T1B0A57D16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 3e06aeee34e632c08d6e09ed054105b9cf89bfa01cccee6bb83e0b0066229fd2
- MD5 d35722ddfd00ac3cc10fa0823584bcb1
- SHA1 87ba03c08c6c69c02d04490067bb822134e42e61
- SHA512 3802a9e6a5f7e77aa43fb13471353df90027c792193c2d3c0bf189425356a87a3d392b2c46e3639d944ac7540f195d319864ec35bc1fd15e7a45933543380477
- SSDEEP 24576:AiEj9dCegZWrhBpLzDioxHdXTcSz+nIl:AiQ1gWNXLn9BxSnI
- TLSH T1BA05126E679C70EAD031617C96624246C3F6F0302B536BEF62A6C17E0F6B6F52D39640
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 902KB
- SHA256 01f62064f5063cfdc8623f98e91efc0fcea6626df222dca4198f7f9042df20a5
- MD5 b98a4c3af55bc488326e0928c6d6c05c
- SHA1 c9d0f78f74b055da9fa42b36bc71d1c398775557
- SHA512 cf591e7eb87f84896ab4041d6b5969fdef88db063bdf25e433462a0a6172efad22511cad827d303b26064b6729012b51ed63d9bf98636398e2c3b7b1f62064e3
- SSDEEP 24576:vIyWE9dCegZWrhBpLzDioxHdXTcSz+nIl:vI81gWNXLn9BxSnI
- TLSH T16615120563986099E17022789A3742928BF5BC302F129BEF62D2E67E1F7B7F17831754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 825KB
- SHA256 8056b8184f61fddce18bbb1ceb0c9d5593170ca40faaaa7ed73cf9fe492aba63
- MD5 ee49c5789c7174988e260bc618b51565
- SHA1 237a3a49389e2e544524c52cabf68b39a0621d5c
- SHA512 96126dabef33dd79299502ac9da46639c5573e6a99ad9d274b4d4f0f567be6c6a66363d30b90bd1ead0618f2a1eb098f2e7b5b42976ce5b889f4b9bb600bba58
- SSDEEP 12288:Z3zgpgQ2uh3Gx5MbgZrwc2r5hpnW8pLzDAt4VxHUGTXSdN96cSLoV+D+nIlx:Fgp9dCegZWrhBpLzDioxHdXTcSz+nIl
- TLSH T1EC05121A63E830D9E03062749A360257C2F5B83027569AFF32E6C9BE0F7B6F1A535754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 08ef19ae612eb1cca38449934c7539093a42b4d1619e71b036cfa99bffdb6f23
- MD5 4d29c0a74670f731f6e7bfb3dc1508a6
- SHA1 82915cf0bf940066507c4b56abfd7ce9b2c52303
- SHA512 f4b062e5c135b3b4b712d1285349e696a39b27daf8531ae5118c78f04ef4094bfd85e296794c290c697dd4feaf3d31ab246454b2415eeed36ba37247121c85a4
- SSDEEP 12288:PbYHgQ2uh3Gx5MbgZrwc2r5hpnW8pLzDAt4VxHUGTXSdN96cSLoV+D+nIlx:TYH9dCegZWrhBpLzDioxHdXTcSz+nIl
- TLSH T128F423595769309EE03032B8563A135382E935302947ADBF72FBD4F91FAF3B23562588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 7e34272e9a3bea3bfb9beefd237b10549399aab004fed71d8bc22bd6034e18b6
- MD5 4387699013b8816c4818bd6e7b69dd8b
- SHA1 474c29445b9ee51e8e9da0e2db47985b21474e90
- SHA512 4a5c286d0527726ee3803f95adc404f3d9334d1a2196b03df56f87bf453e1856c03e62f2e14064cde7c96df2016453d77b499b3c01320be2189ed58ddc990a18
- SSDEEP 24576:zQ9MxZKdcz9ew309dCegZWrhBpLzDioxHdXTcSz+nIl:zVKi01gWNXLn9BxSnI
- TLSH T19D659D2DABE9058AE173D27595A250C3A673B4301B31D6CF2449D03D4E7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 962KB
- SHA256 d117e480407bf5601229bc12957ce77eda61766f250748ebf45afe495bdff081
- MD5 7572f965c4a27de3009c39d73793b727
- SHA1 e829835b3766566ac05ba8fae2c68f7b97c92724
- SHA512 9bece5c954cb9d323bc82b097d38a6ae16b25e8b18853034f09db892db16c73fa79f3222a5b53bcef0235e2924ea2443f130914306c82ceb897da3e4e9fca31c
- SSDEEP 24576:Tyoc8ApK9dCegZWrhBpLzDioxHdXTcSz+nIl:2oc8ApK1gWNXLn9BxSnI
- TLSH T15825F11FBB6940A6E072913C89968346E7B3B0301B5257DB6292C33D4F67AF9BD34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.3MB
- SHA256 dd842b21650c38acf2f30975ca5a255d34c3312261b845168e8ea8153dbb8bcd
- MD5 aec5513c5a7bdde9d8411e088953969f
- SHA1 9279081d99bfe469511c5abc1072d3630203bbba
- SHA512 67a9d843d3465ddd0974967d4da0aa70687a306a79e8e15679c5821fa7ad0dcd6c1136796fc52dd04ce53abf1adca2c1bafbaf6a9a1c363d46d05085fe49824b
- SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKM1gWNXLn9BxSnI:00zuNI8FNXB5
- TLSH T103B58C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH