![](/screenshots/66d7c163-7a0a-4b6b-ba20-fe3f855c8cb9.png)
www.cexpr.es
Open in
urlscan Pro
52.84.106.98
Malicious Activity!
Public Scan
Effective URL: https://www.cexpr.es/c?n=9340029021580955
Submission: On December 29 via manual from IN — Scanned from ES
Summary
TLS certificate: Issued by Entrust Certification Authority - L1K on January 7th 2022. Valid for: a year.
This is the only time www.cexpr.es was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Correos Express (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 52.84.106.98 52.84.106.98 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 65.9.66.50 65.9.66.50 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:400d:80d::200a | 15169 (GOOGLE) (GOOGLE) | |
35 | 4 |
ASN16509 (AMAZON-02, US)
PTR: server-52-84-106-98.bud50.r.cloudfront.net
www.cexpr.es |
ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-50.fra56.r.cloudfront.net
s.correosexpress.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
cexpr.es
1 redirects
www.cexpr.es |
481 KB |
16 |
correosexpress.com
s.correosexpress.com — Cisco Umbrella Rank: 243358 |
693 KB |
2 |
googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 559 |
53 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 356 |
6 KB |
35 | 4 |
Domain | Requested by | |
---|---|---|
17 | www.cexpr.es |
1 redirects
www.cexpr.es
|
16 | s.correosexpress.com |
www.cexpr.es
s.correosexpress.com |
2 | maps.googleapis.com |
www.cexpr.es
maps.googleapis.com |
1 | cdnjs.cloudflare.com |
www.cexpr.es
|
35 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.correosexpress.com |
www.correos.es |
correostelecom.es |
www.nexea.es |
twitter.com |
www.youtube.com |
www.linkedin.com |
apps.apple.com |
play.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
s.correosexpress.com Entrust Certification Authority - L1K |
2022-01-07 - 2023-02-06 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.cexpr.es/c?n=9340029021580955
Frame ID: 982736CFF5D38ECC88DB5981723D008D
Requests: 35 HTTP requests in this frame
Screenshot
![](/screenshots/66d7c163-7a0a-4b6b-ba20-fe3f855c8cb9.png)
Page Title
Sigue tu envío- correosexpress.comPage URL History Show full URLs
-
http://www.cexpr.es/c?n=9340029021580955
HTTP 301
https://www.cexpr.es/c?n=9340029021580955 Page URL
Detected technologies
![](/vendor/wappa/icons/Google Maps.png)
Detected patterns
- //maps\.google(?:apis)?\.com/maps/api/js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery-ui.*\.js
Page Statistics
36 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Envíos
Search URL Search Domain Scan URL
Title: Servicios
Search URL Search Domain Scan URL
Title: Contacto
Search URL Search Domain Scan URL
Title: Productos
Search URL Search Domain Scan URL
Title: Servicios
Search URL Search Domain Scan URL
Title: E-Commerce
Search URL Search Domain Scan URL
Title: Condiciones y tramitaciones
Search URL Search Domain Scan URL
Title: �Cómo ser cliente?
Search URL Search Domain Scan URL
Title: ¿Quiénes somos?
Search URL Search Domain Scan URL
Title: Preguntas frecuentes
Search URL Search Domain Scan URL
Title: Delegaciones
Search URL Search Domain Scan URL
Title: Trabaja con nosotros
Search URL Search Domain Scan URL
Title: Convocatoria de empleo
Search URL Search Domain Scan URL
Title: Envíos nacionales
Search URL Search Domain Scan URL
Title: Envíos internacionales
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Portal de empleado
Search URL Search Domain Scan URL
Title: Ley de Transparencia
Search URL Search Domain Scan URL
Title: Partners
Search URL Search Domain Scan URL
Title: Contrataciones
Search URL Search Domain Scan URL
Title: Cumplimiento Normativo
Search URL Search Domain Scan URL
Title: Sala de prensa
Search URL Search Domain Scan URL
Title: [Twitter]
Search URL Search Domain Scan URL
Title: [Youtube]
Search URL Search Domain Scan URL
Title: [Linkedin]
Search URL Search Domain Scan URL
Title: IOS
Search URL Search Domain Scan URL
Title: ANDROID
Search URL Search Domain Scan URL
Title: Aviso Legal
Search URL Search Domain Scan URL
Title: Política de Protección de datos
Search URL Search Domain Scan URL
Title: Política de Privacidad
Search URL Search Domain Scan URL
Title: Política de Cookies
Search URL Search Domain Scan URL
Title: Copyright
Search URL Search Domain Scan URL
Title: Política de cookies.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.cexpr.es/c?n=9340029021580955
HTTP 301
https://www.cexpr.es/c?n=9340029021580955 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
c
www.cexpr.es/ Redirect Chain
|
41 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
www.cexpr.es/SeguimientoSinCP/css/ |
853 KB 184 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
www.cexpr.es/SeguimientoSinCP/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datepicker.css
www.cexpr.es/SeguimientoSinCP/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
public_styles.css
s.correosexpress.com/webpublica/resources/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
www.cexpr.es/SeguimientoSinCP/css/ |
13 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_correos_express.png
s.correosexpress.com/webpublica/resources/images/ |
52 KB 53 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paquete.png
www.cexpr.es/SeguimientoSinCP/images/ |
53 KB 54 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_correos_footer.png
s.correosexpress.com/webpublica/resources/images/footer/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_cex.png
s.correosexpress.com/webpublica/resources/images/footer/ |
193 KB 194 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_telecom.png
s.correosexpress.com/webpublica/resources/images/footer/ |
191 KB 192 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_nexea.png
s.correosexpress.com/webpublica/resources/images/footer/ |
194 KB 194 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_visa.png
s.correosexpress.com/webpublica/resources/images/footer/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_mastercard.png
s.correosexpress.com/webpublica/resources/images/footer/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_maestro.png
s.correosexpress.com/webpublica/resources/images/footer/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_apple.png
s.correosexpress.com/webpublica/resources/images/footer/ |
489 B 891 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_android.png
s.correosexpress.com/webpublica/resources/images/footer/ |
516 B 918 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.js
www.cexpr.es/SeguimientoSinCP/js/ |
359 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
resources.js
www.cexpr.es/SeguimientoSinCP/js/ |
35 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tablePagination.js
www.cexpr.es/SeguimientoSinCP/js/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
entregaCartaFunctions.js
www.cexpr.es/SeguimientoSinCP/js/ |
53 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datepicker.packed.min.js
www.cexpr.es/SeguimientoSinCP/js/ |
39 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datepicker.min.js
www.cexpr.es/SeguimientoSinCP/js/ |
1 KB 910 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
www.cexpr.es/SeguimientoSinCP/js/ |
248 KB 67 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
maps.googleapis.com/maps/api/ |
160 KB 53 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
markerclusterer.js
www.cexpr.es/js/ |
33 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en.js
www.cexpr.es/SeguimientoSinCP/js/lang/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CarteroW01-Light.woff
www.cexpr.es/SeguimientoSinCP/css/fonts/Cartero/ |
20 KB 20 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_rrss_twitter.png
s.correosexpress.com/webpublica/resources/images/footer/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_rrss_youtube.png
s.correosexpress.com/webpublica/resources/images/footer/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_rrss_linkedin.png
s.correosexpress.com/webpublica/resources/images/footer/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CarteroW01-Light.woff
s.correosexpress.com/webpublica/resources/css/fonts/Cartero/ |
20 KB 20 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CarteroW01-Regular.woff
s.correosexpress.com/webpublica/resources/css/fonts/Cartero/ |
19 KB 20 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen_204
maps.googleapis.com/maps/api/mapsjs/ |
3 B 45 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Correos Express (Transportation)107 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange string| cookie_key_google_analytics function| existsCookie function| activarAnalytics function| scrollConf function| navDefaultConfig function| heightMenuConf function| activeLevelHamburger function| toggleThreeLevel function| activeLevelTwo function| reorderMenu function| activeLevelThree object| headertext object| headers object| tablebody object| current undefined| row number| j undefined| col function| $ function| jQuery function| moment object| jQuery1123045488776955804533 function| Cookies object| CHX number| currentScrollValueDest number| startScrollDest number| endScrollDest number| currentScrollValueAddrDest number| startScrollAddrDest number| endScrollAddrDest number| currentScrollValueOffice number| startScrollOffice number| endScrollOffice function| showAndHideDescription function| goToManageShipping function| isNumberKey function| isNumeric function| validarEmail function| isMovil function| onBlurCPDest function| shiftTab function| selectorKeyUpDown function| selectCp function| manageUp function| manageDown function| edValueKeyUpCP function| responseValidationCP function| updateDatesConcertada function| selectAddress function| selectorKeyUpDownAddress function| manageUpAddress function| manageDownAddress function| edValueKeyUpAddress function| responseValidationAddress function| limpiarField function| limpiarCamposDireccion function| mostrarBoton string| currentLocale function| validarFecha function| obtenerHoras function| solonumeros number| reintentosTelefono boolean| telefonoValido function| mostrarInputCitypaq function| mostrarListadoCitypaq function| finalizarCitypaq function| seleccionarCitypaq function| paintcitypaqMap function| initCitypaqMap function| refreshAddress function| getOfficesData function| loadOfficesList function| officeListRowSelected function| fillOfficeInfoFromCp function| setOfficeData function| validateCPOffice function| onBlurCPOffice function| selectorKeyUpDownOffice function| manageUpOffice function| manageDownOffice function| edValueKeyUpCPOffice function| responseValidationCPOffice function| limpiarFieldOffice function| cerrarPopUp function| abrirPopUp function| initMap function| PostalCodeControl function| infowindow function| busqueda function| restriccionesInputBuscar function| comportamientoFocus number| pulseBoton function| displayAllGestionEnvio function| hiddenAllGestionEnvio function| loadPopUpPOD function| activarPantallaRefresco function| desactivarPantallaRefresco object| datePickerController function| MarkerClusterer function| Cluster function| ClusterIcon string| cookie_key_msg function| acceptCookie function| acceptAllCookies object| google object| module$contents$mapsapi$overlay$overlayView_OverlayView1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.cexpr.es/SeguimientoSinCP | Name: JSESSIONID Value: X5a0LDF4eaS1dlXGg7-A2QopxgKE6W0VGhRkD4yY.seguimientosincp-cex-677dc6d959-7nh27 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
maps.googleapis.com
s.correosexpress.com
www.cexpr.es
2606:4700::6811:180e
2a00:1450:400d:80d::200a
52.84.106.98
65.9.66.50
00d15623ba07744573b43a803b2941627ad909078f9026b182127024f18fd303
02a57157775080958f248c1d0a42d147e386025d4bd8d0fff87dbc2ceeb1522b
0b69c197d880811d9fdb6ed58f2c3c6abdb1b17ae48c5c5f25d72c32db8f0380
14c0e71a41f3252a93770c009b1bd81abd8337b565091b71291d925f44f92422
25b52d20492c64eec99f8c103c1dbf427a9a24ea3c992ee586882e872d395263
25da3bfce283d962ae3e1e538f7465c8bccb2dd9c8137643e7a817e66cff166f
30d27af3b6871506139bf93442871ad43572e39a290cb79bedb95cb1db1c6d15
32e2194639f59b70768fc92f990dd7cc25e530c58acc05042be92b5ece825bdd
3448338bb4885d817f8e0ca9fbda0f1cae2d9b8541a40e3fc3ddf9395b99d25d
3c415a4c6b17ce801d67d04d4e0f6eefbcc9f288423edd82bc527029b4ddfd84
429fa9d22824abe07dbe5b7f0c87edb1a5c87d0f90cc9c41fbce70b2e1907f60
474d167d200a556e3ab5a7967da3f6b65a3e841ac719191ac510b59eae7d2a70
5afeaac4de714087572d89e26e9e45f03e85dd35637442f212d38736201d0f6a
5e234b2bad32b3b0308e07a1af53335c0eee3f9f9527202b8f5d1bbb994ea882
5f2b27bde9d819c6514762be1f24c7058a774b07280d8f52c6a04d1816ae983a
60475d04965256bc3220c24e18f3e92d5f9d409036cb0f2c8fc1c58e522f6d38
656b7b67796e9f70966e26a007652552d54c4d66eb02ae832f97aa3bd6ef9491
761a64ededbe13d165e957da68d0ec37ab4f5ceb33c0c642774037c97bcd0de7
76dbcd41904b665ad09c7660630ed3349956d6aa2a820f5e3fa9931257eed4ae
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8168c41c6b26693502f95215ae75c7b1a9d4a2bf06a76cc1ecf254913044f63b
8c04b8744a2bf6c7131db5f963b27fdaf4f6d6df4291bf60ba20e614efc63f75
af426107bed7db078b46cf6b8be9d2af34cb1f84a05bf9cedea73183057eb910
b4ee118bf3ff0c4e76bbd11a15786ee85f230bf9489ce32beb5a9c0061fe5a28
bce212f7e14df89787ef7312edd157badeddec5992bac005077db7298f4776c7
c7d36d98ee15947e2b98a537947f351fbaa569668dd5cabc4d64393196e39e17
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cddbc9b1e9a791af5606e15792fba89e8cd669a54110aa02293847b14d6b4c2e
d4de06bd905b8ecde76dcb159ef57a36cc1c7c396c74578f7c0683748933250e
eb0996523b66324a29825841a59ba84da2515cac3923be0098a1ee70835ae762
ecf014f075b8403c319b76edc6de25bd3c67f1abd2c2f8d28aaae7a9b373e570
ede15906dfd053fa42e9f2abc3730f119deaff253323205f9600da2962913f49
f3d95e70da8a1b026f87a73b7ae9df2ffe03a49d5eb0aa9dbb34568cb372f435