9c1910b6.ngrok.io Open in urlscan Pro
52.15.72.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://9c1910b6.ngrok.io/web/path/index.php?userid=regina_grosser@europe.pall.com
Effective URL:
https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Submission: On May 22 via manual (May 22nd 2018, 9:38:04 am UTC) from US

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 52.15.72.79, located in Columbus, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is 9c1910b6.ngrok.io.
TLS certificate: Issued by RapidSSL RSA CA 2018 on March 12th 2018. Valid for: a year.

This is the only time 9c1910b6.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
2 7	52.15.72.79 52.15.72.79		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2.20.23.219 2.20.23.219		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2

7 52.15.72.79 (Columbus, United States) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: 03.edge.prod.oh.ngrok.com

9c1910b6.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.20.23.219 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-219.deploy.static.akamaitechnologies.com

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	ngrok.io 2 redirects 9c1910b6.ngrok.io	120 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	85 KB
7	2

	Domain	Requested by
7	9c1910b6.ngrok.io	2 redirects 9c1910b6.ngrok.io
2	secure.aadcdn.microsoftonline-p.com	9c1910b6.ngrok.io
7	2

This site contains no links.

Subject Issuer	Validity	Valid
*.ngrok.io RapidSSL RSA CA 2018	`2018-03-12` - `2019-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Frame ID: 168D02D8A9CCF4BF94F2E0CCCFF52936
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://9c1910b6.ngrok.io/web/path/index.php?userid=regina_grosser@europe.pall.com HTTP 302
https://9c1910b6.ngrok.io/web/path/office/index.php?email=regina_grosser@europe.pall.com HTTP 302
https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_gro... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

204 kB
Transfer

411 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://9c1910b6.ngrok.io/web/path/index.php?userid=regina_grosser@europe.pall.com HTTP 302
https://9c1910b6.ngrok.io/web/path/office/index.php?email=regina_grosser@europe.pall.com HTTP 302
https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request office.php Show response
9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/
Redirect Chain

https://9c1910b6.ngrok.io/web/path/index.php?userid=regina_grosser@europe.pall.com
https://9c1910b6.ngrok.io/web/path/office/index.php?email=regina_grosser@europe.pall.com
https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com

24 KB
25 KB

347ms
347ms

Document
text/html

52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 / PHP/7.2.3
Resource Hash: 777072a1b2bf23e5a0eb3f9c4011d76e601ce6be264edf9ea3863d81e8addaad

Request headers

Host: 9c1910b6.ngrok.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 168D02D8A9CCF4BF94F2E0CCCFF52936

Response headers

Date: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
X-Powered-By: PHP/7.2.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
X-Powered-By: PHP/7.2.3
Set-Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Content-Length: 283
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK converged.login.min.css
9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 84 KB
85 KB 270ms
267ms Stylesheet
text/css 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/converged.login.min.css
Requested by: Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 9c1910b6.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u
Connection: keep-alive
Cache-Control: no-cache
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 22 May 2018 09:38:01 GMT
Last-Modified: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: W/"15199-56cc82c90e22b"
Content-Length: 86425
Content-Type: text/css

GET
H/1.1 200
OK convergedlogin_pcore.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/ 284 KB
82 KB 24ms
6ms Script
application/x-javascript 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedlogin_pcore.min.js

Requested by

Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-20-23-219.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Origin: https://9c1910b6.ngrok.io

Response headers

Date: Tue, 22 May 2018 09:37:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Jul 2017 22:42:16 GMT
Content-MD5: 70JDX0xpFgO/0lUo3MXuxw==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=428402
Strict-Transport-Security: max-age=31536000
Content-Length: 83081

GET
H/1.1 200
OK convergedloginpaginatedstrings-en-gb.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/ 10 KB
4 KB 23ms
5ms Script
application/x-javascript 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedloginpaginatedstrings-en-gb.min.js

Requested by

Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-20-23-219.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Origin: https://9c1910b6.ngrok.io

Response headers

Date: Tue, 22 May 2018 09:37:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Jul 2017 22:41:35 GMT
Content-MD5: 2aonJl133r+/GhKf7Kl2dw==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=428402
Strict-Transport-Security: max-age=31536000
Content-Length: 3442

GET
H/1.1 200
OK bannerlogo
9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 4 KB
5 KB 516ms
298ms Image
image/png 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/bannerlogo?ts=635974776182591704
Requested by: Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 9c1910b6.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u
Connection: keep-alive
Cache-Control: no-cache
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 22 May 2018 09:38:01 GMT
Last-Modified: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: W/"11e9-56cc82c90de5a"
Content-Length: 4585

GET
H/1.1 200
OK microsoft_logo.svg
9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 4 KB
4 KB 516ms
298ms Image
image/svg+xml 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Requested by: Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 9c1910b6.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u
Connection: keep-alive
Cache-Control: no-cache
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 22 May 2018 09:38:01 GMT
Last-Modified: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: W/"e43-56cc82c90e9cc"
Content-Length: 3651
Content-Type: image/svg+xml

GET
H/1.1 200
OK picker_account_aad.svg
9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 756 B
1015 B 598ms
377ms Image
image/svg+xml 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c
Requested by: Host: 9c1910b6.ngrok.io
URL: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 9c1910b6.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
Cookie: PHPSESSID=jeb463c4fobgu8nddptos7ig3u
Connection: keep-alive
Cache-Control: no-cache
Referer: https://9c1910b6.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=regina_grosser@europe.pall.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 22 May 2018 09:38:01 GMT
Last-Modified: Tue, 22 May 2018 09:38:00 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: W/"2f4-56cc82c90e9cc"
Content-Length: 756
Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Debug object| $Do undefined| g_iSRSFailed undefined| g_sSRSSuccess function| webpackJsonp object| StringRepository boolean| __

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			9c1910b6.ngrok.io/	1969-12-31 23:59:59	Name: PHPSESSID Value: jeb463c4fobgu8nddptos7ig3u

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9c1910b6.ngrok.io
secure.aadcdn.microsoftonline-p.com
2.20.23.219
52.15.72.79
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c
777072a1b2bf23e5a0eb3f9c4011d76e601ce6be264edf9ea3863d81e8addaad
bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603