Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Soundpad_M...m4.rar
windows7-x64
7Soundpad_M...m4.rar
windows10-2004-x64
7Soundpad M...ID.cfg
windows7-x64
3Soundpad M...ID.cfg
windows10-2004-x64
3Soundpad M...me.txt
windows7-x64
1Soundpad M...me.txt
windows10-2004-x64
1Soundpad M...ad.exe
windows7-x64
7Soundpad M...ad.exe
windows10-2004-x64
7Soundpad M...ig.ini
windows7-x64
1Soundpad M...ig.ini
windows10-2004-x64
1Soundpad M...ol.dll
windows7-x64
1Soundpad M...ol.dll
windows10-2004-x64
1Soundpad M...te.dll
windows7-x64
1Soundpad M...te.dll
windows10-2004-x64
1Soundpad M...pt.vdf
windows7-x64
3Soundpad M...pt.vdf
windows10-2004-x64
3Soundpad M...ion.mo
windows7-x64
3Soundpad M...ion.mo
windows10-2004-x64
3Soundpad M...ss.mp3
windows7-x64
1Soundpad M...ss.mp3
windows10-2004-x64
6Soundpad M...ue.mp3
windows7-x64
1Soundpad M...ue.mp3
windows10-2004-x64
6Soundpad M...rk.mp3
windows7-x64
1Soundpad M...rk.mp3
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...lt.m4a
windows7-x64
1Soundpad M...lt.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 18:23
Behavioral task
behavioral1
Sample
Soundpad_Mohamed_m4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Soundpad_Mohamed_m4.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win10v2004-20240226-en
General
-
Target
Soundpad Mohamed m4/Soundpad.exe
-
Size
10.9MB
-
MD5
0ae4f60d72e0d1c159505500b8a08ebb
-
SHA1
bb352dafd3c3ebebb4414b799010fe5ebddbef44
-
SHA256
ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
-
SHA512
88495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536
-
SSDEEP
196608:fDRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvu:UerSwAVE3XsRMiJpsf
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2596 regsvr32.exe 2640 regsvr32.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll" Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both" Soundpad.exe -
resource yara_rule behavioral7/memory/2856-0-0x000007FEF5490000-0x000007FEF64E0000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\UniteFx.dll Soundpad.exe File opened for modification C:\Windows\system32\UniteFx.dll Soundpad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both" Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\\DefaultIcon Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithList Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\URL Protocol Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithProgids\Soundpad.Soundlist Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\shell\open\command Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\PerceivedType = "audio" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\\shell\open\command Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe\" \"%1\"" Soundpad.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\ = "Soundpad sound list" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\ = "Soundpad.Soundlist" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\Content Type = "audio/soundpadlist" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\shell Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\shell\open Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe,1" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\DefaultIcon Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\shell\open Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\shell\open\command\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\shell Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad Soundpad.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ = "UniteFx Class" Soundpad.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\shell\open\command\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithList\ehshell.exe Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithProgids Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\ = "URL:Soundpad Protocol" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe,0" Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad.Soundlist\shell\open\command Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe\" -c \"%1\"" Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2856 Soundpad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2856 Soundpad.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2856 Soundpad.exe 2856 Soundpad.exe 2856 Soundpad.exe 2856 Soundpad.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2596 2856 Soundpad.exe 28 PID 2856 wrote to memory of 2596 2856 Soundpad.exe 28 PID 2856 wrote to memory of 2596 2856 Soundpad.exe 28 PID 2856 wrote to memory of 2596 2856 Soundpad.exe 28 PID 2856 wrote to memory of 2596 2856 Soundpad.exe 28 PID 2856 wrote to memory of 2640 2856 Soundpad.exe 29 PID 2856 wrote to memory of 2640 2856 Soundpad.exe 29 PID 2856 wrote to memory of 2640 2856 Soundpad.exe 29 PID 2856 wrote to memory of 2640 2856 Soundpad.exe 29 PID 2856 wrote to memory of 2640 2856 Soundpad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\Soundpad.exe"C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\Soundpad.exe"1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2596
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD50ee743073ee6b68f8222be2661d95315
SHA12e642772ec19edf73422fe25a8d45db1a006ff85
SHA256562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
SHA512c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba