![](/screenshots/28e6230f-e418-41b5-859e-0bcb1b356e05.png)
xxcysq.com
Open in
urlscan Pro
107.150.11.107
Malicious Activity!
Public Scan
Effective URL: https://xxcysq.com/login.php?token=%27.5a0d8bf37513bcac724dd547859
Submission: On November 07 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on November 7th 2022. Valid for: 3 months.
This is the only time xxcysq.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 3.226.62.59 3.226.62.59 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 17 | 107.150.11.107 107.150.11.107 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
1 | 2600:140b:1a0... 2600:140b:1a00:383::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
5 | 23.207.174.61 23.207.174.61 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2600:140b:2:9... 2600:140b:2:99a::11a6 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 63.140.50.108 63.140.50.108 | 16509 (AMAZON-02) (AMAZON-02) | |
23 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-62-59.compute-1.amazonaws.com
rebrand.ly |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 107.150.11.107.static.quadranet.com
xxcysq.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-207-174-61.deploy.static.akamaitechnologies.com
image.card.jp.rakuten-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
xxcysq.com
2 redirects
xxcysq.com |
206 KB |
5 |
rakuten-static.com
image.card.jp.rakuten-static.com |
2 KB |
2 |
2o7.net
1 redirects
rakuten.112.2o7.net — Cisco Umbrella Rank: 926575 |
1 KB |
2 |
go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1661 c.go-mpulse.net — Cisco Umbrella Rank: 731 |
50 KB |
1 |
rebrand.ly
1 redirects
rebrand.ly — Cisco Umbrella Rank: 46595 |
285 B |
23 | 5 |
Domain | Requested by | |
---|---|---|
17 | xxcysq.com |
2 redirects
xxcysq.com
|
5 | image.card.jp.rakuten-static.com |
xxcysq.com
|
2 | rakuten.112.2o7.net |
1 redirects
xxcysq.com
|
1 | c.go-mpulse.net |
s.go-mpulse.net
|
1 | s.go-mpulse.net |
xxcysq.com
|
1 | rebrand.ly | 1 redirects |
23 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
r10.to |
www.rakuten-card.co.jp |
support.rakuten-card.jp |
privacy.rakuten.co.jp |
www.rakuten.co.jp |
static.id.rakuten.co.jp |
www.jpcert.or.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
xxcysq.com R3 |
2022-11-07 - 2023-02-05 |
3 months | crt.sh |
akstat.io DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-04-15 - 2023-04-19 |
a year | crt.sh |
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-04 - 2023-06-07 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://xxcysq.com/login.php?token=%27.5a0d8bf37513bcac724dd547859
Frame ID: C8122EE1B49E4A069F22B76F064B8274
Requests: 21 HTTP requests in this frame
Frame:
https://xxcysq.com/static/1/saved_resource.html
Frame ID: 53033C1F00A4A9831A505E8A8E6C9034
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/28e6230f-e418-41b5-859e-0bcb1b356e05.png)
Page Title
楽天e-NAVI: ログイン画面Page URL History Show full URLs
-
https://rebrand.ly/34eee1
HTTP 301
https://xxcysq.com/jp.php Page URL
-
https://xxcysq.com/index.php?t=29b8e095533996b89f251ce9048d758c86ccccd32b51fb906afba623676c35e6
HTTP 302
https://xxcysq.com/mobile.php?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&acti... HTTP 302
https://xxcysq.com/login.php?token=%27.5a0d8bf37513bcac724dd547859 Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
33 Outgoing links
These are links going to different origins than the main page.
Title: サービス一覧
Search URL Search Domain Scan URL
Title: 楽天銀行
Search URL Search Domain Scan URL
Title: 楽天証券
Search URL Search Domain Scan URL
Title: 楽天生命
Search URL Search Domain Scan URL
Title: 楽天ポイントカード
Search URL Search Domain Scan URL
Title: 楽天Edy
Search URL Search Domain Scan URL
Title: 楽天ペイ
Search URL Search Domain Scan URL
Title: 楽天の保険
Search URL Search Domain Scan URL
Title: 自動車保険一括見積
Search URL Search Domain Scan URL
Title: 楽天市場
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 楽天カードトップへ
Search URL Search Domain Scan URL
Title: よくあるご質問
Search URL Search Domain Scan URL
Title: 個人情報保護方針
Search URL Search Domain Scan URL
Title: ユーザID・パスワードを忘れた場合
Search URL Search Domain Scan URL
Title: 会員規約(個人情報の取扱に関する同意条項)
Search URL Search Domain Scan URL
Title: プライバシーステートメント
Search URL Search Domain Scan URL
Title: 楽天会員に新規登録する 楽天会員に新規登録してサービスを利用する(無料)
Search URL Search Domain Scan URL
Title: 楽天会員とは?
Search URL Search Domain Scan URL
Title: ログインができない場合の解決方法
Search URL Search Domain Scan URL
Title: ご利用にあたって(ご準備いただくもの/推奨環境)
Search URL Search Domain Scan URL
Title: よくあるご質問
Search URL Search Domain Scan URL
Title: 初めてご登録する場合
Search URL Search Domain Scan URL
Title: 家族カードを登録する場合
Search URL Search Domain Scan URL
Title: カード番号が変更になった場合
Search URL Search Domain Scan URL
Title: カードを複数枚登録している場合
Search URL Search Domain Scan URL
Title: 楽天及び楽天カードを装った不審なメール
Search URL Search Domain Scan URL
Title: 楽天カードのセキュリティサービス
Search URL Search Domain Scan URL
Title: こちら
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: クレジットポリシー
Search URL Search Domain Scan URL
Title: 免責事項
Search URL Search Domain Scan URL
Title: コピーライト
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://rebrand.ly/34eee1
HTTP 301
https://xxcysq.com/jp.php Page URL
-
https://xxcysq.com/index.php?t=29b8e095533996b89f251ce9048d758c86ccccd32b51fb906afba623676c35e6
HTTP 302
https://xxcysq.com/mobile.php?_encoding=UTF8&openid.assoc_handle=jpflex&openid.claimed_id=&action=sign-in&path=home&ref_=nav_Account&signIn=1&useRedirectOnSuccess=1 HTTP 302
https://xxcysq.com/login.php?token=%27.5a0d8bf37513bcac724dd547859 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://rebrand.ly/34eee1 HTTP 301
- https://xxcysq.com/jp.php
- https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s12074624700259?AQB=1&ndh=1&t=7%2F10%2F2022%2021%3A49%3A51%201%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fxxcysq.com%2Flogin.php%3Ftoken%3D%2527.5a0d8bf37513bcac724dd547859&r=https%3A%2F%2Fxxcysq.com%2Fjp.php&cc=JPY&ch=login&server=xxcysq.com&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=Other%20Websites%3Axxcysq.com%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=Other%20Websites%3Axxcysq.com&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.015&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1 HTTP 302
- https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s12074624700259?AQB=1&pccr=true&vidn=31B4BEBF962B628A-40001CAB08E48677&ndh=1&t=7%2F10%2F2022%2021%3A49%3A51%201%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fxxcysq.com%2Flogin.php%3Ftoken%3D%2527.5a0d8bf37513bcac724dd547859&r=https%3A%2F%2Fxxcysq.com%2Fjp.php&cc=JPY&ch=login&server=xxcysq.com&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=Other%20Websites%3Axxcysq.com%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=Other%20Websites%3Axxcysq.com&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.015&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
jp.php
xxcysq.com/ Redirect Chain
|
1 KB 1003 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.23238u92u82.js
xxcysq.com/vendor/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.php
xxcysq.com/ Redirect Chain
|
48 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
xxcysq.com/static/1/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ral-1.8.1.js
xxcysq.com/static/1/ |
29 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
xxcysq.com/static/1/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate-3.1.0.min.js
xxcysq.com/static/1/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
xxcysq.com/static/1/ |
2 KB 786 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
challenger.css
xxcysq.com/static/1/ |
2 KB 684 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BGD27-RKZLH-HC9BY-VXAAE-E5EDR
s.go-mpulse.net/boomerang/ |
205 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rc-logo_CardEnavi_1.svg
xxcysq.com/static/1/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spacer.gif
xxcysq.com/static/1/ |
49 B 103 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stop_540x249.png
xxcysq.com/static/1/ |
57 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s_code.js
xxcysq.com/static/1/ |
68 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saved_resource.html
xxcysq.com/static/1/ Frame 5303 |
248 B 283 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rexicon-32-eye-f.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/ |
294 B 428 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rexicon-32-check.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/ |
288 B 429 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rexicon-32-new-window-l.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/ |
445 B 478 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rexicon-32-chevron-right.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/ |
315 B 440 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rexicon-32-sign-info-l.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/ |
473 B 517 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
config.json
c.go-mpulse.net/api/ |
51 B 323 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BGD27-RKZLH-HC9BY-VXAAE-E5EDR
xxcysq.com/static/1/ Frame 5303 |
205 KB 58 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s12074624700259
rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/ Redirect Chain
|
43 B 272 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)68 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation undefined| $ function| jQuery function| ctlDupSend function| setCheckboxValue function| setCheckboxValueDev function| setFocus object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| _countAA function| doBBBd object| RAL object| __challenger_stats object| __challenger_events boolean| doRefresh object| __challenger_conf object| __challenger function| Fingerprint2Shrinked function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| trackingParam object| allInputs string| scParamKey string| scParamValue object| accountSetting number| _scStartTime object| rakutenSC string| s_account object| s function| s_doPlugins function| isAndroid function| isChrome function| isSmartphone function| isSafari string| s_code string| s_objectID function| s_gi function| do_PrePlugins function| do_PostPlugins function| sendSCRequest function| c_r function| c_w string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft function| s_c object| s_c_il number| s_c_in string| s_tnt object| s_i_rakuten number| BOOMR_configt number| BOOMR_onload8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
xxcysq.com/ | Name: PHPSESSID Value: vj7pah85dpn5nqihicgd4q5p3k |
|
.xxcysq.com/ | Name: 62345ba76168db0033ce8ae6a90ce5a762956614 Value: nwcMGFHjQc7nDOZDxhWlbg%3D%3D |
|
.xxcysq.com/ | Name: ak_bmsc Value: 4zeEvajla5VXwOLAS9VKlrh7jAudo3g3vf3nZLBFoS4gt%2BpOsS0PkLwchMK46pZ8w3nUh%2FbWFuOGsbuBKlTWggKp7t0r9mF9eqtHl2ICT5sOcx3tzCdXtlIm%2FBQLg6oT31xsLIgFKPd9UFCo7RIDLuMLFTGWuToJLNoqaa9tCdsJfam5evilpRNJWuVkhx5dbwfZYJEMwSir7mUIl3CU2BI0N%2BUloIORnNYZbfX6QNg96yA04D0tV9FJtH4IYofFtyhQsoaqW2xpREw2AcbH7ZBfU3Al9yKGdBBQRyEEmi%2FAr2XjUnYaxUVpptL9C%2FHZqDBVX1xMh10SNhsRR0ztdTyDL3G1JrfUzsT7r32wlhyGEdwkvSUvc50lOZ%2F16B%2FwHmEjagnFqmk43vv7h0ci5kdZqGbTd5L0n83BT3H9xQXp3DBU5Ebbmq8GMTZ74%2FlEmN8N1%2BnqSU2WTODu%2Fr3RsRNws1bfxxf58fXtiq%2FFmJdj8M%2BnH514kNGjiUdkwAY4YnzvjVAvBwGD2ZJ60iM%2FqjP4VKFCemOPG6sGPqj80%2F7yH%2B7KfE7bTCFIWLoBfG7pRpxGv3hTK7dKx88Nn%2F%2FfLcy8lxZaROMH9dNW2QtwmIie0FMiSUyuqV8RyEC%2BKFY7JElWgP0Itdo2Zw8c4%2FIQYjR%2BO2KGYU2DG0WcEnGidJzrPuyL0f%2FH3fkmqvE0t5Al9wrYgtBobv6d37YoguhMgTB9an%2Bz76yqoaGbY9n8R%2FM%3D |
|
.xxcysq.com/ | Name: _amkc Value: 49d753fb-1d5b-4a46-ba14-9b90f91b0531 |
|
.xxcysq.com/ | Name: _ra Value: 1667857790920|61b641b8-802f-4656-971a-b12244e58c0c |
|
.xxcysq.com/ | Name: s_sess Value: %20s_cc%3Dtrue%3B%20s_prevsite%3Dcard%3B%20s_sq%3D%3B |
|
.rakuten.112.2o7.net/ | Name: s_vi Value: [CS]v1|31B4BEBF962B628A-40001CAB08E48677[CE] |
|
.xxcysq.com/ | Name: RT Value: "z=1&dm=xxcysq.com&si=bdf002da-a38e-418e-b104-3d9838b00abd&ss=la7bgqu1&sl=1&tt=1cx&rl=1&ld=1cy" |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c.go-mpulse.net
image.card.jp.rakuten-static.com
rakuten.112.2o7.net
rebrand.ly
s.go-mpulse.net
xxcysq.com
107.150.11.107
23.207.174.61
2600:140b:1a00:383::11a6
2600:140b:2:99a::11a6
3.226.62.59
63.140.50.108
027955e7d4d65ff988f8a9b9b586a843d9d0c3c79ed47ad5f4046e83e6bbd2ce
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
0c3bed51efa47d32c8b01eee1b2700db3619b542f7e5c2dacd5991fd27d402f8
14d72db96bbb479c505f417e6dd2d1ac6e84f44af2c37a95001b8b178fe97686
22709220ed44887008351f7173cb52d515186de8840ace769dcc5e905a11b794
229a4c6e872bb11a3325501e43ef3e506d1ebb9be98ed79321d7c879d98e695e
2b95cec0ca02606508b391a9748001431fe830ce3837a6907e07470079c134a6
4c20c5e7e9e5dd269c9cf036bdcfdee942dfc45dcdb80e043c695f9337168405
4d1de4ecb415cada2052d1d3733ab2d123691707583cab3e3f9a1ebfa96dd232
503e5231837a0fea130419b5a515a98cbf03ec483fe581e31093c472874bcd2c
5f99b5fb5150c5b137166ab89940ee679294dd7073336b80fa85f810ab0688e8
61f30c6851b1ef5e73f3371bf5e5dff51f4e968c85b353744d45d32c480483bc
99d3ec89a43fa27d170fcbd760034e1616dac184383dae0e43b457788b404e78
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a5d4b62dbc1e744844c913c945d7e3f9892990a382d2ebb349e74274c46d6543
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
b3b56ecf18e2df1fd4e935c9de0360bf4362ad67d7b7e1fa098ce488afed3248
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
c9c25e5db965f66edd1ca79a3db5c19191fc06e3fdf5298f9bff2ae4ef926c17
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02