Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 10:08
Behavioral task
behavioral1
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win10v2004-20240226-en
General
-
Target
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
-
Size
1.1MB
-
MD5
dea3cd30c30338a50368cf65f7ff5f1f
-
SHA1
ce678c542226ef7099fa74a74cd2a664e4bec841
-
SHA256
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269
-
SHA512
4fc2dd833ef4e0251976a083b8d3e52732fb792c2a467f401be82c952354daef7b1aca84da1fc2a99bc52a4b3f5372799545eeb29c775b42d32a57f20e65c3a3
-
SSDEEP
24576:Y/M3X2S1dvOtYJx3n5r020E5BeGx/qrzmj1LNU5DECibbbbpcu:YC2SjTJx3n5r02V5UfzmpLIYbbbbpcu
Malware Config
Extracted
C:\Users\Admin\Desktop\255356-readme.html
avaddon
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe family_avaddon -
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Renames multiple (144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exepid process 5108 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-566096764-1992588923-1249862864-1000\desktop.ini 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process File opened (read-only) \??\T: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\V: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\E: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\G: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\L: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\N: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\Q: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\R: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\W: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\F: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\J: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\O: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\P: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\U: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\Y: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\Z: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\A: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\B: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\K: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\S: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\H: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\I: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\M: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe File opened (read-only) \??\X: 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 api.myip.com 13 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exepid process 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2456 wmic.exe Token: SeSecurityPrivilege 2456 wmic.exe Token: SeTakeOwnershipPrivilege 2456 wmic.exe Token: SeLoadDriverPrivilege 2456 wmic.exe Token: SeSystemProfilePrivilege 2456 wmic.exe Token: SeSystemtimePrivilege 2456 wmic.exe Token: SeProfSingleProcessPrivilege 2456 wmic.exe Token: SeIncBasePriorityPrivilege 2456 wmic.exe Token: SeCreatePagefilePrivilege 2456 wmic.exe Token: SeBackupPrivilege 2456 wmic.exe Token: SeRestorePrivilege 2456 wmic.exe Token: SeShutdownPrivilege 2456 wmic.exe Token: SeDebugPrivilege 2456 wmic.exe Token: SeSystemEnvironmentPrivilege 2456 wmic.exe Token: SeRemoteShutdownPrivilege 2456 wmic.exe Token: SeUndockPrivilege 2456 wmic.exe Token: SeManageVolumePrivilege 2456 wmic.exe Token: 33 2456 wmic.exe Token: 34 2456 wmic.exe Token: 35 2456 wmic.exe Token: 36 2456 wmic.exe Token: SeIncreaseQuotaPrivilege 956 wmic.exe Token: SeSecurityPrivilege 956 wmic.exe Token: SeTakeOwnershipPrivilege 956 wmic.exe Token: SeLoadDriverPrivilege 956 wmic.exe Token: SeSystemProfilePrivilege 956 wmic.exe Token: SeSystemtimePrivilege 956 wmic.exe Token: SeProfSingleProcessPrivilege 956 wmic.exe Token: SeIncBasePriorityPrivilege 956 wmic.exe Token: SeCreatePagefilePrivilege 956 wmic.exe Token: SeBackupPrivilege 956 wmic.exe Token: SeRestorePrivilege 956 wmic.exe Token: SeShutdownPrivilege 956 wmic.exe Token: SeDebugPrivilege 956 wmic.exe Token: SeSystemEnvironmentPrivilege 956 wmic.exe Token: SeRemoteShutdownPrivilege 956 wmic.exe Token: SeUndockPrivilege 956 wmic.exe Token: SeManageVolumePrivilege 956 wmic.exe Token: 33 956 wmic.exe Token: 34 956 wmic.exe Token: 35 956 wmic.exe Token: 36 956 wmic.exe Token: SeIncreaseQuotaPrivilege 3352 wmic.exe Token: SeSecurityPrivilege 3352 wmic.exe Token: SeTakeOwnershipPrivilege 3352 wmic.exe Token: SeLoadDriverPrivilege 3352 wmic.exe Token: SeSystemProfilePrivilege 3352 wmic.exe Token: SeSystemtimePrivilege 3352 wmic.exe Token: SeProfSingleProcessPrivilege 3352 wmic.exe Token: SeIncBasePriorityPrivilege 3352 wmic.exe Token: SeCreatePagefilePrivilege 3352 wmic.exe Token: SeBackupPrivilege 3352 wmic.exe Token: SeRestorePrivilege 3352 wmic.exe Token: SeShutdownPrivilege 3352 wmic.exe Token: SeDebugPrivilege 3352 wmic.exe Token: SeSystemEnvironmentPrivilege 3352 wmic.exe Token: SeRemoteShutdownPrivilege 3352 wmic.exe Token: SeUndockPrivilege 3352 wmic.exe Token: SeManageVolumePrivilege 3352 wmic.exe Token: 33 3352 wmic.exe Token: 34 3352 wmic.exe Token: 35 3352 wmic.exe Token: 36 3352 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription pid process target process PID 1716 wrote to memory of 2456 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 2456 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 2456 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 956 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 956 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 956 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 3352 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 3352 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe PID 1716 wrote to memory of 3352 1716 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe wmic.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe"C:\Users\Admin\AppData\Local\Temp\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exeC:\Users\Admin\AppData\Roaming\Microsoft\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exeFilesize
1.1MB
MD5dea3cd30c30338a50368cf65f7ff5f1f
SHA1ce678c542226ef7099fa74a74cd2a664e4bec841
SHA2560f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269
SHA5124fc2dd833ef4e0251976a083b8d3e52732fb792c2a467f401be82c952354daef7b1aca84da1fc2a99bc52a4b3f5372799545eeb29c775b42d32a57f20e65c3a3
-
C:\Users\Admin\Desktop\255356-readme.htmlFilesize
50KB
MD5599c9604b895c0e8e97db4ba491941f1
SHA1aa08ab33e24b516b82505ef874f08e7827a6dc3e
SHA2568c8733f1b7dc0ed9aeae56cb65efc2305e3e762945217ec601e2bd62f116d4d1
SHA512c1980bff9f599753b4fb4abe147c3e25027bd33d10df40301bb61d6b234fdd879579c0cd25f72390e8149e6d62b31b386a7bb649985f4f5dcef1a5fca4193321