cffbf27c.ngrok.io Open in urlscan Pro
52.14.61.47 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cffbf27c.ngrok.io/PDF/
Submission: On May 01 via manual (May 1st 2019, 1:02:59 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 52.14.61.47, located in Columbus, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is cffbf27c.ngrok.io.
TLS certificate: Issued by RapidSSL RSA CA 2018 on March 11th 2019. Valid for: a year.

This is the only time cffbf27c.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
7	52.14.61.47 52.14.61.47		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	2a01:4f9:2a:f... 2a01:4f9:2a:f67::2		24940 (HETZNER-AS) (HETZNER-AS)
2	151.101.120.193 151.101.120.193		54113 (FASTLY) (FASTLY - Fastly)
1	209.17.68.209 209.17.68.209		14173 (PHOTOBUCKET) (PHOTOBUCKET - PHOTOBUCKET.COM)
11	4

7 52.14.61.47 (Columbus, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-14-61-47.us-east-2.compute.amazonaws.com

cffbf27c.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a01:4f9:2a:f67::2 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

www.freeiconspng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.120.193 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.17.68.209 (Denver, United States)

ASN14173 (PHOTOBUCKET - PHOTOBUCKET.COM, INC., US)

i63.tinypic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	ngrok.io cffbf27c.ngrok.io	130 KB
2	imgur.com i.imgur.com	51 KB
2	freeiconspng.com 1 redirects www.freeiconspng.com	401 B
1	tinypic.com i63.tinypic.com	43 KB
11	4

	Domain	Requested by
7	cffbf27c.ngrok.io	cffbf27c.ngrok.io
2	i.imgur.com	cffbf27c.ngrok.io
2	www.freeiconspng.com	1 redirects cffbf27c.ngrok.io
1	i63.tinypic.com	cffbf27c.ngrok.io
11	4

This site contains no links.

Subject Issuer	Validity	Valid
*.ngrok.io RapidSSL RSA CA 2018	`2019-03-11` - `2020-03-11`	a year	crt.sh
freeiconspng.com COMODO RSA Domain Validation Secure Server CA	`2018-12-06` - `2019-12-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cffbf27c.ngrok.io/PDF/
Frame ID: 67177FEF39C7E572CBC34939289731B4
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

11
Requests

73 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

224 kB
Transfer

221 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://www.freeiconspng.com/ptp.php?pdf-word-icon-31 HTTP 302
https://www.freeiconspng.com/img/2082

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response cffbf27c.ngrok.io/PDF/	7 KB 7 KB	891ms 255ms	Document text/html	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / PHP/5.6.40 Resource Hash `7df02fc6b482258e0f416f8ed8cb9fc01f3591070b84773f3bef9db57a393ce3` Request headers Host cffbf27c.ngrok.io Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:50 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By PHP/5.6.40 Content-Length 7140 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	facebox.css cffbf27c.ngrok.io/PDF/javascript/facebox/src/	1 KB 1 KB	246ms 243ms	Stylesheet text/css	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/javascript/facebox/src/facebox.css Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:49 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "47f-5839789469697" Content-Length 1151 Content-Type text/css
GET H/1.1	200 OK	only.js Show response cffbf27c.ngrok.io/PDF/js/	599 B 866 B	263ms 259ms	Script application/javascript	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/js/only.js Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `051946860b04b5b64a52df8b240e4888469c4b384b4816df4974f84a0f3408f4` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:49 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "257-58397893bf00d" Content-Length 599 Content-Type application/javascript
GET H/1.1	200 OK	jquery-1.6.2.min.js Show response cffbf27c.ngrok.io/PDF/javascript/	89 KB 90 KB	896ms 651ms	Script application/javascript	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/javascript/jquery-1.6.2.min.js Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:49 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "165a4-58397893f300f" Content-Length 91556 Content-Type application/javascript
GET H/1.1	200 OK	facebox.js Show response cffbf27c.ngrok.io/PDF/javascript/facebox/src/	9 KB 9 KB	811ms 548ms	Script application/javascript	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/javascript/facebox/src/facebox.js Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:50 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "2407-583978949f5dc" Content-Length 9223 Content-Type application/javascript
GET H/1.1	200 OK	jquery.watermark.js Show response cffbf27c.ngrok.io/PDF/javascript/watermark/	18 KB 18 KB	971ms 438ms	Script application/javascript	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/javascript/watermark/jquery.watermark.js Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:50 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "48ea-5839789537b54" Content-Length 18666 Content-Type application/javascript
GET H/1.1	200 OK	javascript1.js Show response cffbf27c.ngrok.io/PDF/javascript/	3 KB 3 KB	955ms 418ms	Script application/javascript	52.14.61.47 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://cffbf27c.ngrok.io/PDF/javascript/javascript1.js Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.14.61.47 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-14-61-47.us-east-2.compute.amazonaws.com Software Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 / Resource Hash `c2c9196ee861cec69e7971b0439d0d448df3328f472f226971a7d5bb5dc0ec94` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:51 GMT Last-Modified Fri, 08 Mar 2019 16:15:49 GMT Server Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 Accept-Ranges bytes ETag "c16-58397894250d3" Content-Length 3094 Content-Type application/javascript
GET H/1.1	200 OK	2082 www.freeiconspng.com/img/ Redirect Chain https://www.freeiconspng.com/ptp.php?pdf-word-icon-31 https://www.freeiconspng.com/img/2082	0 0	113ms 112ms	Image text/html	2a01:4f9:2a:f67::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.freeiconspng.com/img/2082 Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f9:2a:f67::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://cffbf27c.ngrok.io/PDF/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Redirect headers Date Wed, 01 May 2019 13:02:43 GMT Strict-Transport-Security max-age=63072000; includeSubdomains; preload Server nginx X-Powered-By PHP/5.6.40, Hetzner X-Frame-Options DENY Content-Type text/html; charset=UTF-8 location https://www.freeiconspng.com/img/2082 Transfer-Encoding chunked Connection keep-alive X-Frame-X-XSS-Protection 1
GET H/1.1	200 OK	Yyjfy0T.png i.imgur.com/	4 KB 4 KB	61ms 23ms	Image image/png	151.101.120.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL http://i.imgur.com/Yyjfy0T.png Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Server 151.101.120.193 San Francisco, United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `0cf7c2b6cecd3c1605353d7e19f982842e64388883dd3d1d1c657cf78b5cdd4b` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:43 GMT Age 10055496 X-Cache HIT, HIT Connection keep-alive Content-Length 3964 X-Served-By cache-iad2135-IAD, cache-cdg20744-CDG Last-Modified Sat, 20 Aug 2016 23:24:20 GMT Server cat factory 1.0 X-Timer S1556715763.449956,VS0,VE1 ETag "ffa8b494c982e6de1e6cb45623a403c0" Access-Control-Allow-Methods GET, OPTIONS Content-Type image/png Access-Control-Allow-Origin * cache-control public, max-age=31536000 Accept-Ranges bytes X-Cache-Hits 1, 1
GET H/1.1	200 OK	33wr6fd.png i63.tinypic.com/	43 KB 43 KB	428ms 129ms	Image image/png	209.17.68.209 PHOTOBUCKET.COM
General Check archive.org Show headers Download Go to Show image Full URL http://i63.tinypic.com/33wr6fd.png Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Server 209.17.68.209 Denver, United States, ASN14173 (PHOTOBUCKET - PHOTOBUCKET.COM, INC., US), Reverse DNS Software Apache / Resource Hash `795fb2b4c9d6719defbb87c2d30b3eb825913890301332e2c00b25db8d3fbb91` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:43 GMT Via 1.1 varnish Last-Modified Wed, 25 Jul 2018 09:14:36 GMT Server Apache Age 5791 X-Varnish-Server den2tpv64 ETag "ab05-571cf4eb6e3f8" X-Cache HIT Content-Type image/png Cache-Control max-age=21600 X-Varnish 3188180562 3186143641 Connection keep-alive Accept-Ranges bytes Content-Length 43781 Expires Wed, 01 May 2019 17:26:12 GMT
GET H/1.1	200 OK	7dHA6V2.jpg i.imgur.com/	46 KB 47 KB	25ms 24ms	Image image/jpeg	151.101.120.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL http://i.imgur.com/7dHA6V2.jpg Requested by Host: cffbf27c.ngrok.io URL: https://cffbf27c.ngrok.io/PDF/ Protocol HTTP/1.1 Server 151.101.120.193 San Francisco, United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `2d9b3835ce3a659c907acd33d613bab446a7894f108dddca2f2d1407263cd2d0` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 01 May 2019 13:02:43 GMT Age 4331360 X-Cache HIT, HIT Connection keep-alive Content-Length 47302 X-Served-By cache-bwi5120-BWI, cache-cdg20744-CDG Last-Modified Mon, 24 Jul 2017 20:28:23 GMT Server cat factory 1.0 X-Timer S1556715764.652563,VS0,VE2 ETag "c81c1d527a24c0df8f061bb682e4cc24" Access-Control-Allow-Methods GET, OPTIONS Content-Type image/jpeg Access-Control-Allow-Origin * cache-control public, max-age=31536000 Accept-Ranges bytes X-Cache-Hits 1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| jQuery16209966103515959637 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cffbf27c.ngrok.io
i.imgur.com
i63.tinypic.com
www.freeiconspng.com
151.101.120.193
209.17.68.209
2a01:4f9:2a:f67::2
52.14.61.47
051946860b04b5b64a52df8b240e4888469c4b384b4816df4974f84a0f3408f4
0cf7c2b6cecd3c1605353d7e19f982842e64388883dd3d1d1c657cf78b5cdd4b
2d9b3835ce3a659c907acd33d613bab446a7894f108dddca2f2d1407263cd2d0
795fb2b4c9d6719defbb87c2d30b3eb825913890301332e2c00b25db8d3fbb91
7df02fc6b482258e0f416f8ed8cb9fc01f3591070b84773f3bef9db57a393ce3
983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832
c2c9196ee861cec69e7971b0439d0d448df3328f472f226971a7d5bb5dc0ec94
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855