www.roseman.tech
Open in
urlscan Pro
139.162.144.23
Malicious Activity!
Public Scan
Effective URL: https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/billing.php
Submission: On April 16 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 7th 2023. Valid for: 3 months.
This is the only time www.roseman.tech was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 69.61.26.121 69.61.26.121 | 22653 (GLOBALCOM...) (GLOBALCOMPASS) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:810::200e | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:82f::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 195.13.202.135 195.13.202.135 | 12578 (APOLLO-AS...) (APOLLO-AS Latvia) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::2002 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:831::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::2004 | 15169 (GOOGLE) (GOOGLE) | |
11 | 139.162.144.23 139.162.144.23 | 63949 (AKAMAI-AP...) (AKAMAI-AP Akamai Technologies) | |
6 | 151.101.66.137 151.101.66.137 | 54113 (FASTLY) (FASTLY) | |
1 | 162.247.243.29 162.247.243.29 | 54113 (FASTLY) (FASTLY) | |
35 | 15 |
ASN15169 (GOOGLE, US)
www.googletagservices.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net | |
adservice.google.de |
ASN15169 (GOOGLE, US)
5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG)
PTR: li1411-23.members.linode.com
www.roseman.tech |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
roseman.tech
www.roseman.tech |
63 KB |
6 |
newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 376 |
17 KB |
4 |
googlesyndication.com
5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 105 tpc.googlesyndication.com — Cisco Umbrella Rank: 138 |
26 KB |
3 |
doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 |
126 KB |
2 |
google.com
adservice.google.com — Cisco Umbrella Rank: 73 www.google.com — Cisco Umbrella Rank: 2 |
2 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 29 |
20 KB |
1 |
nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 257 |
397 B |
1 |
stomatologijasinstituts.lv
stomatologijasinstituts.lv |
183 B |
1 |
google.de
adservice.google.de — Cisco Umbrella Rank: 9047 |
531 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 48 |
44 KB |
1 |
googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 192 |
25 KB |
1 |
v.ht
v.ht |
2 KB |
35 | 12 |
Domain | Requested by | |
---|---|---|
11 | www.roseman.tech |
stomatologijasinstituts.lv
www.roseman.tech |
6 | js-agent.newrelic.com |
www.roseman.tech
|
3 | securepubads.g.doubleclick.net |
www.googletagservices.com
securepubads.g.doubleclick.net |
2 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
tpc.googlesyndication.com |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
1 | bam.nr-data.net |
js-agent.newrelic.com
|
1 | www.google.com |
tpc.googlesyndication.com
|
1 | pagead2.googlesyndication.com |
securepubads.g.doubleclick.net
tpc.googlesyndication.com |
1 | stomatologijasinstituts.lv |
v.ht
|
1 | 5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.de |
securepubads.g.doubleclick.net
|
1 | www.googletagmanager.com |
v.ht
|
1 | www.googletagservices.com |
v.ht
|
1 | v.ht | |
35 | 15 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.v.ht R3 |
2023-03-01 - 2023-05-30 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
www.stomatologijasinstituts.lv R3 |
2023-03-14 - 2023-06-12 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
www.roseman.tech R3 |
2023-04-07 - 2023-07-06 |
3 months | crt.sh |
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2 |
2023-04-13 - 2024-05-14 |
a year | crt.sh |
*.nr-data.net DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-18 - 2023-12-19 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/billing.php
Frame ID: AE1F79AFF8797C5BFE72BBB9D156FDC4
Requests: 31 HTTP requests in this frame
Frame:
https://5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: EE7E9F4B08818E43C9458472FF6BB8B4
Requests: 1 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: EBDF16E854083950952E7C9D9C8E1327
Requests: 2 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/aframe
Frame ID: A2EAC819DF71BF6E698C752E0D9C6448
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Globálna logistika | Medzinárodná doprava | DHL | PoľskoPage URL History Show full URLs
- https://v.ht/DHL-Mednarodno-Posiljanje/ Page URL
- https://stomatologijasinstituts.lv/wp-content/1hauy.php Page URL
- https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/ Page URL
- https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/billing.php Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
PHP (Programming Languages) Expand
Detected patterns
- \.php(?:$|\?)
DoubleClick for Publishers (DFP) (Advertising Networks) Expand
Detected patterns
- googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Google AdSense (Advertising Networks) Expand
Detected patterns
- googlesyndication\.com/
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://v.ht/DHL-Mednarodno-Posiljanje/ Page URL
- https://stomatologijasinstituts.lv/wp-content/1hauy.php Page URL
- https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/ Page URL
- https://www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/billing.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
v.ht/DHL-Mednarodno-Posiljanje/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
www.googletagservices.com/tag/js/ |
77 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
112 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304110101/ |
400 KB 124 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppub_config
securepubads.g.doubleclick.net/pagead/ |
26 B 572 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
1 B 198 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
107 B 531 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
107 B 456 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
securepubads.g.doubleclick.net/gampad/ |
668 B 709 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EE7E |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1hauy.php
stomatologijasinstituts.lv/wp-content/ |
94 B 183 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
pagead2.googlesyndication.com/getconfig/ |
14 KB 11 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar2.js
tpc.googlesyndication.com/sodar/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame EBDF |
13 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aframe
www.google.com/recaptcha/api2/ Frame A2EA |
783 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
qQ9mw0ckdUnCcE_fRg-2epoMaLUurlOMv3TU4-E81-A.js
pagead2.googlesyndication.com/bg/ Frame EBDF |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/ |
29 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
billing.php
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/ |
35 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.css
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/css/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-logo.svg
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
2 KB 886 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
searchloupe.svg
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
329 B 406 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
headermobile.JPG
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
saba9m.JPG
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
customer.svg
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
2 KB 921 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ssdsd.JPG
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
feedback.png
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
socials.JPG
www.roseman.tech/wp-admin/user/fullbulingsk/dhlls/images/ |
9 KB 9 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
async-api.6c072bf7-1.230.0.min.js
js-agent.newrelic.com/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lazy-loader.ff971c03-1.230.0.min.js
js-agent.newrelic.com/ |
928 B 897 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
862.9f44b58b-1.230.0.min.js
js-agent.newrelic.com/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page_view_event-aggregate.75812140-1.230.0.min.js
js-agent.newrelic.com/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page_view_timing-aggregate.9590bdab-1.230.0.min.js
js-agent.newrelic.com/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
metrics-aggregate.20a08804-1.230.0.min.js
js-agent.newrelic.com/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NRJS-618f32067df8aa541f5
bam.nr-data.net/1/ |
49 B 397 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pagead2.googlesyndication.com
- URL
- https://pagead2.googlesyndication.com/bg/qQ9mw0ckdUnCcE_fRg-2epoMaLUurlOMv3TU4-E81-A.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA function| redirect6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.v.ht/ | Name: _ga Value: GA1.2.1817249543.1681641746 |
|
.v.ht/ | Name: _gid Value: GA1.2.1775855322.1681641746 |
|
.v.ht/ | Name: _gat_gtag_UA_31510493_3 Value: 1 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.v.ht/ | Name: __gads Value: ID=ea244230fd79d4f5:T=1681641746:S=ALNI_MZyKB0unXLRmeRbz_QFvZL9y1qfIw |
|
.v.ht/ | Name: __gpi Value: UID=00000c04647ce052:T=1681641746:RT=1681641746:S=ALNI_Man7pzGSz4gY58ICuWWT9P0OS1m0g |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
5d76a6cbd71eefa44d130e38ffb2f77d.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
bam.nr-data.net
js-agent.newrelic.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
stomatologijasinstituts.lv
tpc.googlesyndication.com
v.ht
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.roseman.tech
pagead2.googlesyndication.com
139.162.144.23
151.101.66.137
162.247.243.29
195.13.202.135
2a00:1450:4001:806::2002
2a00:1450:4001:806::2008
2a00:1450:4001:80e::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:810::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2004
2a00:1450:4001:831::2001
69.61.26.121
0c3950f8653400246636960456db609af841feb691e53911e763ee282616a390
0f18044d3b5f2171b0220b0612fe3ab5d1103ff8fad6f1ba4e5575f7fe73e969
16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8
19dc99a8224767e303208b156949a2c7b99e67dbe02ef9aa078fecaa28d3616e
1ace605596027318737abeca712c7a0d6d76f753cf82affba37c3d2f44862ae4
3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
3c124e8d5cc4a724c0cc1650bbb0c64f90f6cd00807ec75353423d6cb0880390
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7dcdd04db64c3edd7e9868c6238b622d33caee1e7bdadbf2623d801109eefef1
7e5659a61eeff18afafe0eb5ec1ab7efe2eece0858b1c38e431a752482955f6f
80955dba37d8b147771079f58c319c5c8ebeaadc18bc3a0c039706f090a8da33
9b1fb531c79eb8ce9a6e9f833b9de4a43be31458e9a999dcced9147e0176d601
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b6a613ee9108f1d682a41dbf67bf48474111f09ae1b3f9610371f9e9ab310ba1
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
c600aea2fa4dad3a13560e01bedf9e6c45db0571c3257d9e53e51c4f8fbbc41f
d1b64fb7749d0d3c905c5244660a21f3d8e29699457f2889274c8a717742b6c5
d4197c2ea07edbe44219951f454888dc0d213e24a350edcf48affebb472eff0d
e06787d09c0170febea7e8d6ec75107fd88e6875072fdab051f36494e4a9784c
e0cd60b4b91620fc5ea59d9a28c2509efca95e3981ea8f52733e5ec0c6123375
f2f126ef083a1294131df7eb90ea3a7153fdf3eec218ed4f7295c06b8f4eec7e
f6859eb8f0f96a1493a47e0cab0144e6dba46b3c492042660dd5b02b6cec167b
fd85293d457b5dc514838dd7d5c7c1509a7eed60e23cb32ab9303666833eb98a
ffa12a66b77bcb1fc0cc691ed439b877e084a91bd9f5537e651306fcf6246049