![](/screenshots/1131e862-0ec4-4443-bdd7-7c8a1c1cd25b.png)
cgpsurvey.com
Open in
urlscan Pro
139.59.108.226
Malicious Activity!
Public Scan
Effective URL: https://cgpsurvey.com/feedback_au_nd/index_20.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%...
Submission: On August 23 via manual from AU
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 25th 2018. Valid for: 3 months.
This is the only time cgpsurvey.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 62.90.64.19 62.90.64.19 | 1680 (NV-ASN CE...) (NV-ASN CELLCOM ltd.) | |
2 2 | 62.113.254.110 62.113.254.110 | 47447 (TTM) (TTM) | |
1 1 | 18.195.174.160 18.195.174.160 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
26 | 139.59.108.226 139.59.108.226 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2400:cb00:204... 2400:cb00:2048:1::6818:131d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
31 | 5 |
ASN1680 (NV-ASN CELLCOM ltd., IL)
PTR: 62-90-64-19.bb.netvision.net.il
www.5r.ai |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-174-160.eu-central-1.compute.amazonaws.com
click.qualified-visitor.com |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
cgpsurvey.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.foxpush.net | |
json.foxpush.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
cgpsurvey.com
cgpsurvey.com |
263 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
33 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
foxpush.com
json.foxpush.com |
2 KB |
1 |
foxpush.net
cdn.foxpush.net |
9 KB |
1 |
qualified-visitor.com
1 redirects
click.qualified-visitor.com |
2 KB |
1 |
winsterio.com
1 redirects
go.winsterio.com |
357 B |
1 |
batophor.com
1 redirects
go.batophor.com |
201 B |
1 |
5r.ai
1 redirects
www.5r.ai |
324 B |
31 | 9 |
Domain | Requested by | |
---|---|---|
26 | cgpsurvey.com |
cgpsurvey.com
ajax.googleapis.com |
1 | fonts.gstatic.com |
cgpsurvey.com
|
1 | fonts.googleapis.com |
cgpsurvey.com
|
1 | json.foxpush.com |
cdn.foxpush.net
|
1 | cdn.foxpush.net |
cgpsurvey.com
|
1 | ajax.googleapis.com |
cgpsurvey.com
|
1 | click.qualified-visitor.com | 1 redirects |
1 | go.winsterio.com | 1 redirects |
1 | go.batophor.com | 1 redirects |
1 | www.5r.ai | 1 redirects |
31 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nqasurvey.com Let's Encrypt Authority X3 |
2018-07-25 - 2018-10-23 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-08-07 - 2018-10-16 |
2 months | crt.sh |
foxpush.net CloudFlare Inc ECC CA-2 |
2018-02-05 - 2019-02-05 |
a year | crt.sh |
foxpush.com CloudFlare Inc ECC CA-2 |
2018-02-05 - 2019-02-05 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2018-08-07 - 2018-10-16 |
2 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cgpsurvey.com/feedback_au_nd/index_20.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F67.0.3396.87%20Safari%2F537.36&browserversion=Chrome%2067&city=Hofheim%20Am%20Taunus&country=DE&device=DESKTOP&isp=Hetzner%20Online%20AG&ip=148.251.45.254&os=MacOS&osversion=MacOS%2010.13%20High%20Sierra&browser=Chrome&type=&match=wl&id=3069a4f9-0440-4c4e-a2c5-8ca019494a81&cid=3ef5d8d5-27ca-464c-a350-d782b7d38e16&language=Unknown&carrier=&clickid=1535068084125&cep=ZKHFlQjtg98zJeEn52IJyf8k649PCmI5NLWpiqAMsiSgWWDJOzcYz4t8jCgd-by8i3Oheq-Jj5XcP5qi6llyAnbc7uv4HVWWyykfpaRt04ca8K5QN4NCoQMwNLkj4aObRpfadHw0gVbGAabk-4QTarRTe5ruQp52v4kTR5lZNme9O3Zp5rfMr6iMf-yWc7LfRd1_sEWyGdk7W2K06vqusGyWWWG46JPR9mr22EQ1JUnMJX3UuQlJ9hZCMQ-aD9vR7rJnpwSS3I_0Hfb-xsprfieJqujammbTyfbLs9IRWMFeLme3rdtwYYdwVzTXrippYrIg8_zWsDYsad1nmTAFHZlNf6qs2EoO1KrkRnPK5p5hroxFPwV9lJx_6bTQQdQyLMRJM3soiQoDJ9RZ3kiz3Lp54UwP_Spsxy-W_Vr9ZMAF4AxJeDiGG-zklfCPtZbIv0DiwNDR0nAreP_dyRGIiA&voluum-cid={voluum-cid}&category=&sid=132699611&revenue={revenue}&target=wl&cost=
Frame ID: 48D4EF633B63D61AF350B800FEEF3CD2
Requests: 31 HTTP requests in this frame
Screenshot
![](/screenshots/1131e862-0ec4-4443-bdd7-7c8a1c1cd25b.png)
Page URL History Show full URLs
-
http://www.5r.ai/s/30ogud/3ny
HTTP 302
http://go.batophor.com/ts3089-sms-woolworths-au-linktest HTTP 302
http://go.winsterio.com/ts3089-sms-woolworths-revs-au-linktest HTTP 302
https://click.qualified-visitor.com/3ef5d8d5-27ca-464c-a350-d782b7d38e16?id={id}&voluum-cid={voluum-cid}&categor... HTTP 302
https://cgpsurvey.com/feedback_au_nd/index_20.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac... Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.5r.ai/s/30ogud/3ny
HTTP 302
http://go.batophor.com/ts3089-sms-woolworths-au-linktest HTTP 302
http://go.winsterio.com/ts3089-sms-woolworths-revs-au-linktest HTTP 302
https://click.qualified-visitor.com/3ef5d8d5-27ca-464c-a350-d782b7d38e16?id={id}&voluum-cid={voluum-cid}&category=&sid=132699611&country={country}&revenue={revenue}&target=wl&cost=&clickid=1535068083.91-132699611-21609 HTTP 302
https://cgpsurvey.com/feedback_au_nd/index_20.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F67.0.3396.87%20Safari%2F537.36&browserversion=Chrome%2067&city=Hofheim%20Am%20Taunus&country=DE&device=DESKTOP&isp=Hetzner%20Online%20AG&ip=148.251.45.254&os=MacOS&osversion=MacOS%2010.13%20High%20Sierra&browser=Chrome&type=&match=wl&id=3069a4f9-0440-4c4e-a2c5-8ca019494a81&cid=3ef5d8d5-27ca-464c-a350-d782b7d38e16&language=Unknown&carrier=&clickid=1535068084125&cep=ZKHFlQjtg98zJeEn52IJyf8k649PCmI5NLWpiqAMsiSgWWDJOzcYz4t8jCgd-by8i3Oheq-Jj5XcP5qi6llyAnbc7uv4HVWWyykfpaRt04ca8K5QN4NCoQMwNLkj4aObRpfadHw0gVbGAabk-4QTarRTe5ruQp52v4kTR5lZNme9O3Zp5rfMr6iMf-yWc7LfRd1_sEWyGdk7W2K06vqusGyWWWG46JPR9mr22EQ1JUnMJX3UuQlJ9hZCMQ-aD9vR7rJnpwSS3I_0Hfb-xsprfieJqujammbTyfbLs9IRWMFeLme3rdtwYYdwVzTXrippYrIg8_zWsDYsad1nmTAFHZlNf6qs2EoO1KrkRnPK5p5hroxFPwV9lJx_6bTQQdQyLMRJM3soiQoDJ9RZ3kiz3Lp54UwP_Spsxy-W_Vr9ZMAF4AxJeDiGG-zklfCPtZbIv0DiwNDR0nAreP_dyRGIiA&voluum-cid={voluum-cid}&category=&sid=132699611&revenue={revenue}&target=wl&cost= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index_20.php
cgpsurvey.com/feedback_au_nd/ Redirect Chain
|
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_2_d.css
cgpsurvey.com/feedback_au_nd/css/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flag_au.png
cgpsurvey.com/feedback_au_nd/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loader_gif.gif
cgpsurvey.com/feedback_au_nd/img/ |
18 KB 17 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.png
cgpsurvey.com/feedback_au_nd/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.png
cgpsurvey.com/feedback_au_nd/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.png
cgpsurvey.com/feedback_au_nd/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.png
cgpsurvey.com/feedback_au_nd/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.png
cgpsurvey.com/feedback_au_nd/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.png
cgpsurvey.com/feedback_au_nd/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
secure_min.png
cgpsurvey.com/feedback_au_nd/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.0/ |
90 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
redirect.js
cgpsurvey.com/ |
57 B 417 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script_20_d.js
cgpsurvey.com/feedback_au_nd/js/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
foxpush_SDK_min.js
cdn.foxpush.net/sdk/ |
33 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
livetrendingnewscom.json
json.foxpush.com/ |
924 B 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gift_title_wl.png
cgpsurvey.com/feedback_au_nd/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.css
cgpsurvey.com/feedback_au_nd/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
offers_11_d.json
cgpsurvey.com/feedback_au_nd/datas/ |
2 KB 940 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.json
cgpsurvey.com/feedback_au_nd/datas/ |
1 KB 694 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
2 KB 657 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
operator_wl.png
cgpsurvey.com/feedback_au_nd/img/ |
24 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
female_diet.png
cgpsurvey.com/feedback_au_nd/img/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moist.png
cgpsurvey.com/feedback_au_nd/img/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
skincare_new.png
cgpsurvey.com/feedback_au_nd/img/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
maleenhace.png
cgpsurvey.com/feedback_au_nd/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
muscle.png
cgpsurvey.com/feedback_au_nd/img/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
male_diet.png
cgpsurvey.com/feedback_au_nd/img/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
male_skincare.png
cgpsurvey.com/feedback_au_nd/img/ |
23 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.json
cgpsurvey.com/feedback_au_nd/datas/ |
1 KB 694 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)54 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _foxpush function| $ function| jQuery number| FOXPUSH_SDK_version object| foxpush_config boolean| foxpush_popup_allowed boolean| is_foxpush_frame_loaded object| _foxpush_object function| _foxpush_removeA function| _foxpush_check_segment function| _foxpush_local_segment function| _foxpush_subscribe function| _foxpush_unsubscribe undefined| foxpush_log undefined| obj object| foxpush_browser function| fox_appendHtml function| IsJsonString function| foxpsuh_blocked function| isFacebookApp function| foxpush_window function| hexToRgb function| _foxpush_querystring string| eventMethod function| eventer string| messageEvent object| foxpush_request object| _foxpush_templates string| redirect_url function| loadingOffers function| $_GET string| targets string| titles boolean| keywordName string| message function| clickIE4 function| clickNS4 number| timerId object| mydate number| day number| month number| daym number| year object| dayarray object| montharray object| now object| newDate function| loadingData function| move string| ua string| target string| titleOut boolean| IE object| jQuery18000522398112522679540 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.foxpush.net
cgpsurvey.com
click.qualified-visitor.com
fonts.googleapis.com
fonts.gstatic.com
go.batophor.com
go.winsterio.com
json.foxpush.com
www.5r.ai
139.59.108.226
18.195.174.160
2400:cb00:2048:1::6818:131d
2a00:1450:4001:80b::2003
2a00:1450:4001:821::200a
2a00:1450:4001:824::200a
62.113.254.110
62.90.64.19
01522549a0a0a1d2b0c677a23d6bfeb299e2f19cd51ef502ca2446478c0c2aef
0c8b68cc677c86cd4917a10f85aee7802c06874b4c278b73e1914eefe60db317
153b2b99ac2597e357a7a409baa0bc540e319cc703da3129f5399557faa2c6ed
1684ea8cac825ad753d5912299e27dbf6159d3d53c0a5b99f0474e87e43969fa
184e3e9b5d158d32a00a0dcf99277d7c3b347662ec21459de52469a8e6df7328
1d1cbc6d11c4f33ac89fadff4ea2c39ef5f1534af5ea6f5d8d826ec8cac4b2f9
1dbd2ea1a7ef271fae6368c1ac6e9e2aec31e495659fd5e9f6691005c2ac142b
1f9372aff6fed6d2d4c6992bb8e588a270c5148db1adebddc5d6847ab0dc3aa8
28eea8b398fa3ef334cb50f71606e83fc0e06d2077f7396facd7431354b29484
29965a9f4caf73d596f4eb7443de2aadbd80ca9f2c716f9c2a179c070f2d5b06
35a21333c81302e934ee42b7b85b2c6a731bfffb418fe52fe795cb1974186976
4132fb4009ca017b9bf4c84d6d7b12e7a5362bca767488f077e69ebfad9c9f19
43d7d18f88d927977c904198319761a6cbabcce30bd71a112aeef9f1fd5855ef
4959d6e3d1be34605bcc60460eb0999ed9faf561db25e9d9b87ec3f37c099653
70f7000b82ee8cb278257912aaf86a72505caa47f58063ed4530511c229ff8ba
7c1f3406a589a8e59e829a8459afd8f25fb8a50a27233fc8d2524e8355ebdd96
803205fc81a2f44770bbdd50f0f61e943b82791d940103115e9c6c703afb811a
897b8c9d61053140694298388f802d70ab9ed4e0dd1ca70898e2addcdb16b47b
8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31
8ee090108157533e6468f0284caf8a6546705a9f1b6ad5be6312e922dfd77cfc
91dd15ff86ef51fa2fdfff7c9e84871c22f44afb32b538d53dcc844190c046eb
b08ebee3e83f9550edddc94a94b391f919a2da46e2254f33478ea3a575734147
b2284cb536284aa9c29aa5c2943a2a53e8fe4457e89de12fe63ebf2ad032c8c3
b6cbf8dae268a9a8a06000c1e30c3bd9dfdaf57faa19ee28a86920a66bfc3f4f
ba2d312305be36489c58ddba6386a599a4b3d9181019bee7ff86e5922cdb4ba9
bcc19857d61a70683071426a9452fb4190deefd86ae0554cbd596d6960f367d8
d1a30d4f07bc5beea557f6ef3cbb21ae7c94c08eb0686e0f3d11518e3b676a11
dd504221f5066c57a04ecc1e0f9b77fd215c18cb24376a8f4e39aec2e57ca9e3
e3b94e6964f2ca9ae8c2a08d1b073c9bbfb33b480b7f9ed896fc2965090fff3e
f21fa6ab1d70e77de38ab033edeb6752a51f681d9b5e49018b682ef05b2593bd