Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Soundpad_M...m4.rar
windows7-x64
7Soundpad_M...m4.rar
windows10-2004-x64
7Soundpad M...ID.cfg
windows7-x64
3Soundpad M...ID.cfg
windows10-2004-x64
3Soundpad M...me.txt
windows7-x64
1Soundpad M...me.txt
windows10-2004-x64
1Soundpad M...ad.exe
windows7-x64
7Soundpad M...ad.exe
windows10-2004-x64
7Soundpad M...ig.ini
windows7-x64
1Soundpad M...ig.ini
windows10-2004-x64
1Soundpad M...ol.dll
windows7-x64
1Soundpad M...ol.dll
windows10-2004-x64
1Soundpad M...te.dll
windows7-x64
1Soundpad M...te.dll
windows10-2004-x64
1Soundpad M...pt.vdf
windows7-x64
3Soundpad M...pt.vdf
windows10-2004-x64
3Soundpad M...ion.mo
windows7-x64
3Soundpad M...ion.mo
windows10-2004-x64
3Soundpad M...ss.mp3
windows7-x64
1Soundpad M...ss.mp3
windows10-2004-x64
6Soundpad M...ue.mp3
windows7-x64
1Soundpad M...ue.mp3
windows10-2004-x64
6Soundpad M...rk.mp3
windows7-x64
1Soundpad M...rk.mp3
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Soundpad M...lt.m4a
windows7-x64
1Soundpad M...lt.m4a
windows10-2004-x64
6Soundpad M...ed.m4a
windows7-x64
1Soundpad M...ed.m4a
windows10-2004-x64
6Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 18:23
Behavioral task
behavioral1
Sample
Soundpad_Mohamed_m4.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Soundpad_Mohamed_m4.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Soundpad Mohamed m4/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
Soundpad Mohamed m4/Readme.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Soundpad Mohamed m4/Soundpad.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Soundpad Mohamed m4/SteamConfig.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
Soundpad Mohamed m4/UniteFxControl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Soundpad Mohamed m4/UniteFxUpdate.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Soundpad Mohamed m4/installscript.vdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Soundpad Mohamed m4/languages/es_ES/translation.mo
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
Soundpad Mohamed m4/sounds/ba dum tss.mp3
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Soundpad Mohamed m4/sounds/cue.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Soundpad Mohamed m4/sounds/firework.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-disabled.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Soundpad Mohamed m4/sounds/notify/auto-keys-enabled.m4a
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Soundpad Mohamed m4/sounds/notify/default.m4a
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Soundpad Mohamed m4/sounds/notify/disabled.m4a
Resource
win10v2004-20240226-en
General
-
Target
Soundpad Mohamed m4/Soundpad.exe
-
Size
10.9MB
-
MD5
0ae4f60d72e0d1c159505500b8a08ebb
-
SHA1
bb352dafd3c3ebebb4414b799010fe5ebddbef44
-
SHA256
ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
-
SHA512
88495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536
-
SSDEEP
196608:fDRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvu:UerSwAVE3XsRMiJpsf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation Soundpad.exe -
Loads dropped DLL 2 IoCs
pid Process 1760 regsvr32.exe 4068 regsvr32.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll" Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both" Soundpad.exe -
resource yara_rule behavioral8/memory/2284-0-0x00007FFF29BE0000-0x00007FFF2AC30000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\UniteFx.dll Soundpad.exe File created C:\Windows\system32\UniteFx.dll Soundpad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 63 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\ = "URL:Soundpad Protocol" Soundpad.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\shell\open Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\ = "Soundpad.Soundlist" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\Content Type = "audio/soundpadlist" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both" Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\ = "Soundpad sound list" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\shell Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithList Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\shell\open\command\ Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\shell\open\command Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\URL Protocol Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\shell Soundpad.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe\" \"%1\"" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe,0" Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\shell\open\command Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithProgids\Soundpad.Soundlist Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe,1" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithList\ehshell.exe\ Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\shell\open\command\ Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithProgids Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\DefaultIcon Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ = "UniteFx Class" Soundpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\PerceivedType = "audio" Soundpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Soundpad Mohamed m4\\Soundpad.exe\" -c \"%1\"" Soundpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\shell\open Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Soundpad.Soundlist\DefaultIcon Soundpad.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\.spl\OpenWithList\ehshell.exe Soundpad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2284 Soundpad.exe Token: 33 984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 984 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2284 Soundpad.exe 2284 Soundpad.exe 2284 Soundpad.exe 2284 Soundpad.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 1760 2284 Soundpad.exe 87 PID 2284 wrote to memory of 1760 2284 Soundpad.exe 87 PID 2284 wrote to memory of 4068 2284 Soundpad.exe 88 PID 2284 wrote to memory of 4068 2284 Soundpad.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\Soundpad.exe"C:\Users\Admin\AppData\Local\Temp\Soundpad Mohamed m4\Soundpad.exe"1⤵
- Checks computer location settings
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:1760
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:4068
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
PID:984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD50ee743073ee6b68f8222be2661d95315
SHA12e642772ec19edf73422fe25a8d45db1a006ff85
SHA256562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
SHA512c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba