Analysis
-
max time kernel
50s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 18:15
Static task
static1
Behavioral task
behavioral1
Sample
WannaCry.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
WannaCry.exe
Resource
win11-20240709-en
Errors
General
-
Target
WannaCry.exe
-
Size
224KB
-
MD5
5c7fb0927db37372da25f270708103a2
-
SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29
-
SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
-
SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
-
SSDEEP
3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
Processes:
WannaCry.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD98A7.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD98AE.tmp WannaCry.exe -
Executes dropped EXE 4 IoCs
Processes:
!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exepid process 1712 !WannaDecryptor!.exe 3216 !WannaDecryptor!.exe 3656 !WannaDecryptor!.exe 2440 !WannaDecryptor!.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WannaCry.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r" WannaCry.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
!WannaDecryptor!.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Drops file in Windows directory 1 IoCs
Processes:
LogonUI.exedescription ioc process File created C:\Windows\rescache\_merged\2229298842\625393736.pri LogonUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.exeWannaCry.exe!WannaDecryptor!.exetaskkill.exetaskkill.exeWMIC.execmd.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.execscript.exetaskkill.exetaskkill.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4364 taskkill.exe 5052 taskkill.exe 2956 taskkill.exe 640 taskkill.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exedescription pid process Token: SeDebugPrivilege 5052 taskkill.exe Token: SeDebugPrivilege 640 taskkill.exe Token: SeDebugPrivilege 2956 taskkill.exe Token: SeDebugPrivilege 4364 taskkill.exe Token: SeIncreaseQuotaPrivilege 2880 WMIC.exe Token: SeSecurityPrivilege 2880 WMIC.exe Token: SeTakeOwnershipPrivilege 2880 WMIC.exe Token: SeLoadDriverPrivilege 2880 WMIC.exe Token: SeSystemProfilePrivilege 2880 WMIC.exe Token: SeSystemtimePrivilege 2880 WMIC.exe Token: SeProfSingleProcessPrivilege 2880 WMIC.exe Token: SeIncBasePriorityPrivilege 2880 WMIC.exe Token: SeCreatePagefilePrivilege 2880 WMIC.exe Token: SeBackupPrivilege 2880 WMIC.exe Token: SeRestorePrivilege 2880 WMIC.exe Token: SeShutdownPrivilege 2880 WMIC.exe Token: SeDebugPrivilege 2880 WMIC.exe Token: SeSystemEnvironmentPrivilege 2880 WMIC.exe Token: SeRemoteShutdownPrivilege 2880 WMIC.exe Token: SeUndockPrivilege 2880 WMIC.exe Token: SeManageVolumePrivilege 2880 WMIC.exe Token: 33 2880 WMIC.exe Token: 34 2880 WMIC.exe Token: 35 2880 WMIC.exe Token: 36 2880 WMIC.exe Token: SeIncreaseQuotaPrivilege 2880 WMIC.exe Token: SeSecurityPrivilege 2880 WMIC.exe Token: SeTakeOwnershipPrivilege 2880 WMIC.exe Token: SeLoadDriverPrivilege 2880 WMIC.exe Token: SeSystemProfilePrivilege 2880 WMIC.exe Token: SeSystemtimePrivilege 2880 WMIC.exe Token: SeProfSingleProcessPrivilege 2880 WMIC.exe Token: SeIncBasePriorityPrivilege 2880 WMIC.exe Token: SeCreatePagefilePrivilege 2880 WMIC.exe Token: SeBackupPrivilege 2880 WMIC.exe Token: SeRestorePrivilege 2880 WMIC.exe Token: SeShutdownPrivilege 2880 WMIC.exe Token: SeDebugPrivilege 2880 WMIC.exe Token: SeSystemEnvironmentPrivilege 2880 WMIC.exe Token: SeRemoteShutdownPrivilege 2880 WMIC.exe Token: SeUndockPrivilege 2880 WMIC.exe Token: SeManageVolumePrivilege 2880 WMIC.exe Token: 33 2880 WMIC.exe Token: 34 2880 WMIC.exe Token: 35 2880 WMIC.exe Token: 36 2880 WMIC.exe Token: SeBackupPrivilege 656 vssvc.exe Token: SeRestorePrivilege 656 vssvc.exe Token: SeAuditPrivilege 656 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
!WannaDecryptor!.exepid process 2440 !WannaDecryptor!.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeLogonUI.exepid process 1712 !WannaDecryptor!.exe 1712 !WannaDecryptor!.exe 3216 !WannaDecryptor!.exe 3216 !WannaDecryptor!.exe 3656 !WannaDecryptor!.exe 3656 !WannaDecryptor!.exe 2440 !WannaDecryptor!.exe 2440 !WannaDecryptor!.exe 1068 LogonUI.exe 1068 LogonUI.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
WannaCry.execmd.execmd.exe!WannaDecryptor!.execmd.exedescription pid process target process PID 1304 wrote to memory of 2632 1304 WannaCry.exe cmd.exe PID 1304 wrote to memory of 2632 1304 WannaCry.exe cmd.exe PID 1304 wrote to memory of 2632 1304 WannaCry.exe cmd.exe PID 2632 wrote to memory of 2012 2632 cmd.exe cscript.exe PID 2632 wrote to memory of 2012 2632 cmd.exe cscript.exe PID 2632 wrote to memory of 2012 2632 cmd.exe cscript.exe PID 1304 wrote to memory of 1712 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 1712 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 1712 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 4364 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 4364 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 4364 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 640 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 640 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 640 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 2956 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 2956 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 2956 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 5052 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 5052 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 5052 1304 WannaCry.exe taskkill.exe PID 1304 wrote to memory of 3216 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 3216 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 3216 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 2180 1304 WannaCry.exe cmd.exe PID 1304 wrote to memory of 2180 1304 WannaCry.exe cmd.exe PID 1304 wrote to memory of 2180 1304 WannaCry.exe cmd.exe PID 2180 wrote to memory of 3656 2180 cmd.exe !WannaDecryptor!.exe PID 2180 wrote to memory of 3656 2180 cmd.exe !WannaDecryptor!.exe PID 2180 wrote to memory of 3656 2180 cmd.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 2440 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 2440 1304 WannaCry.exe !WannaDecryptor!.exe PID 1304 wrote to memory of 2440 1304 WannaCry.exe !WannaDecryptor!.exe PID 3656 wrote to memory of 3416 3656 !WannaDecryptor!.exe cmd.exe PID 3656 wrote to memory of 3416 3656 !WannaDecryptor!.exe cmd.exe PID 3656 wrote to memory of 3416 3656 !WannaDecryptor!.exe cmd.exe PID 3416 wrote to memory of 2880 3416 cmd.exe WMIC.exe PID 3416 wrote to memory of 2880 3416 cmd.exe WMIC.exe PID 3416 wrote to memory of 2880 3416 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 90201721758547.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1712 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3216 -
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2440
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:656
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3964055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
797B
MD5afa18cf4aa2660392111763fb93a8c3d
SHA1c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA5124161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
-
Filesize
1KB
MD51ca0acebf8e8f571c629295332aa0867
SHA1946543c49265bde60ba661e2b6f81db745e65376
SHA2569b27cfbc094c96e265e5fb37a024e0cc6f8092ecce1b30c39f8b2c5e89179ea5
SHA5123f1aee1fbd222a769463d8f7d22ee81f7e5b1037369a16d2e8edde534d56c0013243778d9e5612616421376f272144e4899792881086a213d167d9a055f4c0e7
-
Filesize
136B
MD5237928b92667fb3e04cf9c0bae053d40
SHA146ba6422ada85e306140719aba8c360508d9ce99
SHA256e6c9776b3d4d0a004602e02fd07e8b761bd5d020a5feca35592efb993feca113
SHA51264233ba561164ff660587e7c18fdc67b3c2aa845f1f5844dfe1d8428b41858403f3979e5d9d7bc7d74e1234c35afb3a10e7328dbbb1b3803b4095371cb3edd85
-
Filesize
136B
MD5db0c93dfd4ea8d36b22be711a20e5a4d
SHA1864cd3767022171ce35b9f8760ae27f33ebe6d27
SHA256551af7bc3edf3d2c65725559e36e24f78be6f2305c1dd1132199c137e6d112bb
SHA5121b94bf1d6341620bf696c1290b001d4a9d31f13a60fd55d81d35ef363e0e18ff5f51fe50c7d95e3feb529e7c640ed05b2a65b58ad02c1958aee649508b289aa6
-
Filesize
136B
MD5b0119a1671c88ac18148a0e4e52fae78
SHA1ebc282f7e83fc95d5f5207298ec48425b48a4482
SHA2562c2b7197a9ae63adc02441a2dcf76150e089fc3f303cdc2e7de50b0d58a1c8cf
SHA5127baa7274c695f82e66d7eccf5f0470605ff3583f8f433fd7fb0228ca4ce5d470f5539277be695bb3168a164c977575560f115ac94d0d8cfca838e4b0cccaf63d
-
Filesize
336B
MD53540e056349c6972905dc9706cd49418
SHA1492c20442d34d45a6d6790c720349b11ec591cde
SHA25673872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
SHA512c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
-
Filesize
219B
MD55f6d40ca3c34b470113ed04d06a88ff4
SHA150629e7211ae43e32060686d6be17ebd492fd7aa
SHA2560fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
SHA5124d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
-
Filesize
628B
MD5e7c5cf531f7d00874e00ffb3c1c34a87
SHA1199c789d53bc7c78f126f3b69b17a95968300141
SHA2565857a15e2783293fda7ffe7feea3904d128e18cce4352b1e2c25812df38286d4
SHA5126569ac5521e7cca593a02a841b52479645d3eb1238395f720690c394e7e82796aa3f39a30d068d86c29e3061bd9919c3430e4c33cb3c4b2258bae024d8b33f64
-
Filesize
42KB
MD5980b08bac152aff3f9b0136b616affa5
SHA12a9c9601ea038f790cc29379c79407356a3d25a3
SHA256402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
-
Filesize
236KB
MD5cf1416074cd7791ab80a18f9e7e219d9
SHA1276d2ec82c518d887a8a3608e51c56fa28716ded
SHA25678e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA5120bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5