getshopperonline.com
Open in
urlscan Pro
103.28.32.15
Malicious Activity!
Public Scan
Effective URL: https://getshopperonline.com/onlinevisitor_be_d/index_1.php?device_name=Desktop&browser_name=Chrome&language=Unknown&city=Bru...
Submission: On January 26 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on January 15th 2020. Valid for: 3 months.
This is the only time getshopperonline.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 47.254.144.66 47.254.144.66 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
1 2 | 23.95.82.226 23.95.82.226 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 1 | 103.28.32.25 103.28.32.25 | 135918 (DVS-AS-VN...) (DVS-AS-VN VIET DIGITAL TECHNOLOGY LIABILITY COMPANY) | |
11 | 103.28.32.15 103.28.32.15 | 135918 (DVS-AS-VN...) (DVS-AS-VN VIET DIGITAL TECHNOLOGY LIABILITY COMPANY) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::200a | 15169 (GOOGLE) (GOOGLE) | |
16 | 2600:9000:205... 2600:9000:2057:4600:b:4623:cac0:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 52.55.141.88 52.55.141.88 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
33 | 8 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
france-gratuit.tk |
ASN36352 (AS-COLOCROSSING, US)
PTR: host.dreamlineit.com
soileetch.com |
ASN135918 (DVS-AS-VN VIET DIGITAL TECHNOLOGY LIABILITY COMPANY, VN)
rxtbin.com |
ASN135918 (DVS-AS-VN VIET DIGITAL TECHNOLOGY LIABILITY COMPANY, VN)
getshopperonline.com |
ASN16509 (AMAZON-02, US)
d3e1y4kxkqljcb.cloudfront.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-141-88.compute-1.amazonaws.com
pushpal.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
cloudfront.net
d3e1y4kxkqljcb.cloudfront.net |
128 KB |
11 |
getshopperonline.com
getshopperonline.com |
39 KB |
2 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
233 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
33 KB |
2 |
soileetch.com
1 redirects
soileetch.com |
1 KB |
1 |
pushpal.net
pushpal.net |
2 KB |
1 |
rxtbin.com
1 redirects
rxtbin.com |
731 B |
1 |
france-gratuit.tk
1 redirects
france-gratuit.tk |
466 B |
33 | 8 |
Domain | Requested by | |
---|---|---|
16 | d3e1y4kxkqljcb.cloudfront.net |
getshopperonline.com
|
11 | getshopperonline.com |
soileetch.com
getshopperonline.com ajax.googleapis.com |
2 | soileetch.com | 1 redirects |
1 | fonts.gstatic.com |
getshopperonline.com
|
1 | fonts.googleapis.com |
getshopperonline.com
|
1 | pushpal.net |
getshopperonline.com
|
1 | www.gstatic.com |
getshopperonline.com
|
1 | ajax.googleapis.com |
getshopperonline.com
|
1 | rxtbin.com | 1 redirects |
1 | france-gratuit.tk | 1 redirects |
33 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
exclusiveshoppr.com Let's Encrypt Authority X3 |
2020-01-15 - 2020-04-14 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2019-07-17 - 2020-07-05 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
pushpal.net Amazon |
2019-10-08 - 2020-11-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://getshopperonline.com/onlinevisitor_be_d/index_1.php?device_name=Desktop&browser_name=Chrome&language=Unknown&city=Brussels&clickid=98a94h9hom7a30b2&campaign=242&user_id=1&trafficsource_name=Mint%20New&clickcost=0&lander=17&domain=rxtbin.com&referer=http://soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986&time=1580034164&browser_version=79&device_model=Desktop&device_brand=Desktop&resolution=800x600&os_name=Mac%20OS%20X&os_version=10.14&country=Belgium&country_code=BE&isp=M247%20Europe%20SRL&ip=185.210.217.121&user_agent=Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_14_6)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/79.0.3945.88%20Safari/537.36&lpkey=154580450527247764&target=al&device=DESKTOP&uclick=h9hom7a3
Frame ID: E3B5D793904DA57C40727320EDC6E8E7
Requests: 33 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://france-gratuit.tk/c/L7wW9xWv1114892hFs02L7V0/6CSm950mj2105947986IYcZ2kCm2/6Nq58sUm217565nKBXPx...
HTTP 302
http://soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986 Page URL
-
https://soileetch.com/r2/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986/faad7132-2267...
HTTP 302
https://rxtbin.com/click.php?key=9k2xpid2sh5s4a9e6nkv&externalid=faad7132-2267-4066-b692-4e2402... HTTP 302
https://getshopperonline.com/onlinevisitor_be_d/index_1.php?device_name=Desktop&browser_name=Chrome&langu... Page URL
Detected technologies
Firebase (Databases) ExpandDetected patterns
- script /\/(?:([\d.]+)\/)?firebase(?:\.min)?\.js/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://france-gratuit.tk/c/L7wW9xWv1114892hFs02L7V0/6CSm950mj2105947986IYcZ2kCm2/6Nq58sUm217565nKBXPx7R/8vlk5Y52207bg616/6928590O45hp/
HTTP 302
http://soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986 Page URL
-
https://soileetch.com/r2/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986/faad7132-2267-4066-b692-4e24023ab475/?fctr=0
HTTP 302
https://rxtbin.com/click.php?key=9k2xpid2sh5s4a9e6nkv&externalid=faad7132-2267-4066-b692-4e24023ab475&cost=&subid=15A&target=al HTTP 302
https://getshopperonline.com/onlinevisitor_be_d/index_1.php?device_name=Desktop&browser_name=Chrome&language=Unknown&city=Brussels&clickid=98a94h9hom7a30b2&campaign=242&user_id=1&trafficsource_name=Mint%20New&clickcost=0&lander=17&domain=rxtbin.com&referer=http://soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986&time=1580034164&browser_version=79&device_model=Desktop&device_brand=Desktop&resolution=800x600&os_name=Mac%20OS%20X&os_version=10.14&country=Belgium&country_code=BE&isp=M247%20Europe%20SRL&ip=185.210.217.121&user_agent=Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_14_6)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/79.0.3945.88%20Safari/537.36&lpkey=154580450527247764&target=al&device=DESKTOP&uclick=h9hom7a3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://france-gratuit.tk/c/L7wW9xWv1114892hFs02L7V0/6CSm950mj2105947986IYcZ2kCm2/6Nq58sUm217565nKBXPx7R/8vlk5Y52207bg616/6928590O45hp/ HTTP 302
- http://soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/105947986
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
105947986
soileetch.com/r/0c0595ae-25ec-426c-9a94-08c9193ad6f3/99/14892_0_5/ Redirect Chain
|
699 B 864 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index_1.php
getshopperonline.com/onlinevisitor_be_d/ Redirect Chain
|
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common_1_d.css
getshopperonline.com/onlinevisitor_be_d/css/ |
24 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.0/ |
90 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
push.js
getshopperonline.com/ |
908 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
be_flag.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
user.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ssl_img_new.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
block_logo.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
redirect_bin.js
getshopperonline.com/ |
294 B 428 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
back_link.js
getshopperonline.com/ |
41 B 174 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script_1_d.js
getshopperonline.com/onlinevisitor_be_d/js/ |
47 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firebase.js
www.gstatic.com/firebasejs/5.5.1/ |
837 KB 219 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pushpal.js
pushpal.net/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gift_title_al.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/gift/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
be.json
getshopperonline.com/onlinevisitor_be_d/lang/ |
2 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
al.css
getshopperonline.com/onlinevisitor_be_d/css/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
offers_1.json
getshopperonline.com/onlinevisitor_be_d/datas/ |
2 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
al.json
getshopperonline.com/onlinevisitor_be_d/datas/ |
1 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 547 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone_11pro.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_fr/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
samsung_s10.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone_xs.jpg
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oral_b.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phone_x.png
d3e1y4kxkqljcb.cloudfront.net/survey_be/ |
29 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7cHrv4okm5zmbt6TDvs7wH8Dnzcj.woff2
fonts.gstatic.com/s/exo2/v7/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
al.json
getshopperonline.com/onlinevisitor_be_d/datas/ |
1 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)77 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| loadScript string| redirect_url string| back_url_link object| core object| __core-js_shared__ object| firebase function| $_GET string| targets boolean| keywordName string| lang string| message function| clickIE4 function| clickNS4 number| timerId object| mydate number| day number| month number| daym number| year object| dayarray object| montharray object| now object| newDate function| loadingData function| loadingOffers function| get_browser function| randomInteger number| randIn number| randIn1 number| randIn2 number| randIn3 number| randIn4 number| randIn5 number| randIn6 number| randIn7 function| move boolean| ua string| target string| titleOut boolean| IE object| jQuery18004494389536338086 object| config undefined| token_iid undefined| gender undefined| age undefined| messaging undefined| API_URL undefined| user_id undefined| urlParams undefined| refer_url undefined| country undefined| language undefined| device undefined| interest undefined| source undefined| source2 undefined| browserversion undefined| city undefined| region undefined| brand undefined| model undefined| isp undefined| os undefined| osversion undefined| browser undefined| carrier undefined| hostname undefined| _id undefined| suvey_gender_age_drip_able function| ppGetGender function| ppGetAge function| interactAPI function| saveToken0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
d3e1y4kxkqljcb.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
france-gratuit.tk
getshopperonline.com
pushpal.net
rxtbin.com
soileetch.com
www.gstatic.com
103.28.32.15
103.28.32.25
23.95.82.226
2600:9000:2057:4600:b:4623:cac0:21
2a00:1450:4001:806::200a
2a00:1450:4001:81c::2003
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::200a
47.254.144.66
52.55.141.88
01522549a0a0a1d2b0c677a23d6bfeb299e2f19cd51ef502ca2446478c0c2aef
0fd32d14bccc23287c56143e7ad12ea61819ca7e3e231c0a0986e171d9358cad
2a7b18dfc4613c85a5a6b1ee744762cc286e872743831baf15b1a9a02a3176d8
2d07dc950069456f7216f32a6f5d5d299948b021d64035edca161089bf8edc1d
33ff4b6d1c8fd0a10c0f734a9df644ab4f664e8a31d1288bfa5ceed15791d86a
35a5d8045d48b8e15d91848729bce9e507bae9d14fb6d4206369cedeb8ade2c3
38def9b0f94acd2b6f698362bdd19bedc96ac3ccb1a3bd1e3df4182d717ccb6f
4959d6e3d1be34605bcc60460eb0999ed9faf561db25e9d9b87ec3f37c099653
52625eb5c94d0d268cda935ccc2b592d87ae5cd1ee156fa2ecf0703d52ca3785
6385fe0c7cf4984e36076cb7e6e1b23d40659ca91409ce4e2ca02dda93f9cfd7
699b484c6187f3b2ab0d3f84ea5b1a5f92ec276a4e14d4bd757a01a7c7586deb
795507f461be03a5b216130b66daa941e16bd1717ada067a0e82469e20098231
7e9229c4eee8aaf53dce28d1e774de9d881a46b1e4e4bd1d654ce82842189c11
82d1c4806c6b3747c36f35cbcf93aad66d9ed8b16e0f1b0dccd3184dbb5c8928
8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31
9e2e32bb90558883f4b10e1efae839216cc13b3f45ddf2c5be61318e7956c04c
9ff23748b3f5ee1165dbc02da335d2590e7e6487fb399bd3e5027108508845a4
aa18261cd97247584cf77464d839acc082e25ec733c3a65e35cd4ebd072ccdc8
b2284cb536284aa9c29aa5c2943a2a53e8fe4457e89de12fe63ebf2ad032c8c3
ba2d312305be36489c58ddba6386a599a4b3d9181019bee7ff86e5922cdb4ba9
bcc19857d61a70683071426a9452fb4190deefd86ae0554cbd596d6960f367d8
bdab029c9128265a2bee41d326e775dc68fab232bccb8f4472ce5af6ffdc2afa
c61a5fcde0aeaa2bfc800d9225378d3583200c5175ed923d6b2337e3e1dc71aa
d182b34fb2638edc683e672dcde27f15eaec1861b9619df090937eda27435ec5
d64a6c8dff13dc643ac3093a429f0b2fc38df71f321707ee8cc12bd52dc9c6b4
dd504221f5066c57a04ecc1e0f9b77fd215c18cb24376a8f4e39aec2e57ca9e3
e28da12c0cee66d1ba34c29dc96fc923635b371732b663b107c1507230936207
f12187959c0a57f09582f696d2a5dacf145c381b8252e23ef762b54cb0477338
f782a620f19b1476cc555cbb6e176d69aac1aea96208480add5cf9414ce1eb8c
fc8e1e62a8d73e9b06a3731b641223f00ecd9afb146619a186b92060d129983e
fd2dda7485a9fef032f36694a1168141fbd485f1704eabca64e4a02d3ae14c9a
fd7ca55b769c5f9856e8f0a39dc3c7d96df5d716261f890381ea03c3d92dd7b0