![](/screenshots/81161d55-b3c9-40a4-bdc5-f379213e5d01.png)
royal-flower-0de9.ylr2144t.workers.dev
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://royal-flower-0de9.ylr2144t.workers.dev/026fac39-797d-41a7-a96c-bb29882099c2
Submission: On December 02 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on November 29th 2022. Valid for: 3 months.
This is the only time royal-flower-0de9.ylr2144t.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer) Generic (Online) OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.167.76.23 35.167.76.23 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 2606:4700:10:... 2606:4700:10::ac43:1e1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6812:672 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | () () | ||
1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:1634 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2620:0:890::100 2620:0:890::100 | 54113 (FASTLY) (FASTLY) | |
1 | 162.19.58.157 162.19.58.157 | 16276 (OVH) (OVH) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:e4:... 2606:4700:e4::ac40:a816 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 13 |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-167-76-23.us-west-2.compute.amazonaws.com
api.ffm.to |
ASN13335 (CLOUDFLARENET, US)
royal-flower-0de9.ylr2144t.workers.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1564 ka-f.fontawesome.com — Cisco Umbrella Rank: 3068 |
22 KB |
3 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 680 |
83 KB |
3 |
codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 78378 |
48 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 728 |
35 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 296 fonts.googleapis.com — Cisco Umbrella Rank: 37 |
85 KB |
2 |
workers.dev
royal-flower-0de9.ylr2144t.workers.dev |
3 MB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 203 |
7 KB |
1 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 12849 |
1 KB |
1 |
web.app
pastukalmau.web.app |
6 KB |
1 |
tinyurl.com
1 redirects
tinyurl.com — Cisco Umbrella Rank: 15710 |
382 B |
1 |
ffm.to
1 redirects
api.ffm.to — Cisco Umbrella Rank: 299461 |
209 B |
19 | 11 |
Domain | Requested by | |
---|---|---|
3 | code.jquery.com |
royal-flower-0de9.ylr2144t.workers.dev
|
3 | codesandbox.io |
royal-flower-0de9.ylr2144t.workers.dev
codesandbox.io |
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | maxcdn.bootstrapcdn.com |
royal-flower-0de9.ylr2144t.workers.dev
|
2 | royal-flower-0de9.ylr2144t.workers.dev |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | cdnjs.cloudflare.com |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | i.ibb.co |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | pastukalmau.web.app |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | kit.fontawesome.com |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | fonts.googleapis.com |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | ajax.googleapis.com |
royal-flower-0de9.ylr2144t.workers.dev
|
1 | tinyurl.com | 1 redirects |
1 | api.ffm.to | 1 redirects |
19 | 13 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ylr2144t.workers.dev GTS CA 1P5 |
2022-11-29 - 2023-02-27 |
3 months | crt.sh |
*.nodebox.codesandbox.io E1 |
2022-11-10 - 2023-02-08 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-22 - 2023-12-23 |
a year | crt.sh |
web.app GTS CA 1D4 |
2022-10-19 - 2023-01-17 |
3 months | crt.sh |
ibb.co R3 |
2022-10-09 - 2023-01-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://royal-flower-0de9.ylr2144t.workers.dev/026fac39-797d-41a7-a96c-bb29882099c2
Frame ID: B45125B3DA866DE82118FCBC9E649270
Requests: 24 HTTP requests in this frame
Screenshot
![](/screenshots/81161d55-b3c9-40a4-bdc5-f379213e5d01.png)
Page Title
Share Point OnlinePage URL History Show full URLs
-
https://api.ffm.to/bl/e/c/krzqgap?cd=eyJ1YSI6eyJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IF...
HTTP 302
http://tinyurl.com/batashoe HTTP 307
https://tinyurl.com/batashoe HTTP 301
https://royal-flower-0de9.ylr2144t.workers.dev/026fac39-797d-41a7-a96c-bb29882099c2 Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://api.ffm.to/bl/e/c/krzqgap?cd=eyJ1YSI6eyJ1YSI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDguMC41MzU5LjcxIFNhZmFyaS81MzcuMzYiLCJicm93c2VyIjp7Im5hbWUiOiJDaHJvbWUiLCJ2ZXJzaW9uIjoiMTA4LjAuNTM1OS43MSIsIm1ham9yIjoiMTA4In0sImVuZ2luZSI6eyJuYW1lIjoiQmxpbmsiLCJ2ZXJzaW9uIjoiMTA4LjAuNTM1OS43MSJ9LCJvcyI6eyJuYW1lIjoiV2luZG93cyIsInZlcnNpb24iOiIxMCJ9LCJkZXZpY2UiOnt9LCJjcHUiOnsiYXJjaGl0ZWN0dXJlIjoiYW1kNjQifX0sImNsaWVudCI6eyJyaWQiOiJhM2JiOTUzZC0zYWQxLTRlZWItODczYy1kNTJkMzJhM2IxNzYiLCJzaWQiOiI2NDg5YmFjMi1jNTMwLTRiZTgtYjI5YS1iMDBmMWEzYTk3OGEiLCJpcCI6IjIxNy42NC4xNTEuMzAiLCJyZWYiOiIiLCJob3N0IjoiZmZtLmJpbyIsImxhbmciOiJkZS1ERSIsImlwQ291bnRyeSI6IlNFIn0sImlzV2VicFN1cHBvcnRlZCI6dHJ1ZSwiaXNGcm9tRVUiOnRydWUsImNvdW50cnlDb2RlIjoiU0UiLCJ1c2VBZmYiOiJzZWxmIiwiaWQiOiI2Mzg5ODM1MjNkMDAwMDRmNzhjMDhkNzYiLCJ0em8iOm51bGwsImFuIjpudWxsLCJjaCI6bnVsbCwiZGVzdFVybCI6InRpbnl1cmwuY29tL2JhdGFzaG9lIiwidmlkIjoiYmEzM2RhMjItODIzOS00MDAzLWI2MTMtODMzOTE5ZDkzZjllIiwic3J2YyI6bnVsbCwicHJvZHVjdCI6ImJpb2xpbmsiLCJzaG9ydElkIjoia3J6cWdhcCIsImlzQXV0aG9yaXphdGlvblJlcXVpcmVkIjpmYWxzZSwib3duZXIiOiI2Mzg5ODMzNjI4MDAwMDBkMDA2YmY0MjIiLCJhciI6IjYzODk4MzRjMjgwMDAwM2I2ZjY4MTI1NSIsImJsa190eXBlIjoidmlzaXQiLCJibGtfaWQiOiJVTERyRm0tc0F6In0
HTTP 302
http://tinyurl.com/batashoe HTTP 307
https://tinyurl.com/batashoe HTTP 301
https://royal-flower-0de9.ylr2144t.workers.dev/026fac39-797d-41a7-a96c-bb29882099c2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
026fac39-797d-41a7-a96c-bb29882099c2
royal-flower-0de9.ylr2144t.workers.dev/ Redirect Chain
|
13 MB 3 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sse-hooks.f742b80f43c5a2e0e619b0d97b5886cd.js
codesandbox.io/public/sse-hooks/ |
172 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.be879265d.js
codesandbox.io/static/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
code.jquery.com/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
phishing
codesandbox.io/api/v1/sandboxes/royal-flower-0de9/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
watermark-button.be960f43b.js
codesandbox.io/static/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
ca260fb0-1d74-41d4-b06f-3a0632d996f1
https://royal-flower-0de9.ylr2144t.workers.dev/ |
10 MB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 84 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
398 B 816 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
boostyles.css
pastukalmau.web.app/ |
112 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail1.png
i.ibb.co/1Rvzzk8/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 4 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
30 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
771 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
18 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
157 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- codesandbox.io
- URL
- https://codesandbox.io/api/v1/sandboxes/royal-flower-0de9/phishing
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer) Generic (Online) OneDrive (Online)140 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery object| FontAwesomeKitConfig string| _0xod8 number| _0xod8_ object| _0x31ed function| _0x3d69 string| s string| m string| _0xoda number| _0xoda_ object| _0x2a55 function| _0x293b string| _0xodS number| _0xodS_ object| _0x3011 function| _0x7eaa function| Popper object| bootstrap function| LLli6y4cA56nC1o2nfu6se6iiii function| Iiii6y4cA56nC1o2nfu6se6iiii string| lxtgu4 object| vw3CuI function| gW1dy6 object| qNpxioS number| Ugwxg9 object| U5OEuR string| HGRIYWC string| yukPHt string| PhhC9uQ string| HdaYUbi string| Sk3uUG string| kH18JHI string| LBGYsgO string| lCsoFNA string| _KS2Wz string| f8fiSv string| K7_UQh string| l2AWr4H string| xgJP4j2 string| K40EgB string| V5T8Z5 string| _fVNYK string| drEhAR string| Kremt6W string| ZgC8NE string| FIvzIHr string| S8F3jd string| Q3BRZ4u string| sR7tWz string| m21rPy string| C8yLGS string| SYcjLO string| sUxSczT string| wosS4ZE string| S5VGex string| uDebZC string| G0U5Ast string| Z8Dw5p string| K8WFjIp string| stwb0U string| kfCroLD string| g0SnJN7 string| uizLp_ string| aLvkxy string| HMTcOnw string| ZVFvnCo string| yzhdcxI string| qVeuR8e string| mQk24f9 string| Oftk6Mt string| ivCG8gE string| valz_Km string| _YYiAyt string| P_2OrO7 string| iK7gmui string| GPT2GR string| d_AZOaH string| _OtxRF string| elfbdFj string| ZREg0O string| QM0fx3T string| h8XjtT string| h42BAAz string| elJWM9 string| TlCH2d string| ZzidA6 string| bz_001D string| XCaghR7 string| UCNr3k string| fxjUOl string| fG_pGlL string| OtrDme string| R5a3lh string| k0bf21 string| K9tCxxz string| MmAFcn string| DywMBQ string| sM8_FZ string| leDcYI string| aLGILI string| KnvjfY string| I7rpD7 string| sqcRrm string| Xj9Udm string| CB_MRZ string| PIny2j string| RVWEn1 string| zJSppad string| kRxvMj string| avH_YrD string| iflkQ_n string| WZzSKqm string| MtolWr string| DjmtEjP string| Fjz3uLJ string| E2ArOoB string| VIAOUT6 function| llli6y4ca56nc1o2nfu6se6iiii string| sjFzIBt string| n3kKn19 object| c36RkG object| ac7bph object| chWRCTm object| a90VwzY function| Lt6p6w function| wDwt4B function| llll6y4ca56nc1o2nfu6se6iii undefined| BvL8CIF function| p6hPJD8 function| hEbaDHl function| jiDMvZX function| HHQo_1 function| KozDJ5o function| GuuGFb function| liii6y4ca56nc1o2nfu6se6iiii function| prPrKmK function| bU9k0Kr function| lllll6y4ca56nc1o2nfu6se6llll0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
11 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ffm.to
cdnjs.cloudflare.com
code.jquery.com
codesandbox.io
fonts.googleapis.com
i.ibb.co
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
pastukalmau.web.app
royal-flower-0de9.ylr2144t.workers.dev
tinyurl.com
codesandbox.io
162.19.58.157
2001:4de0:ac18::1:a:2a
2606:4700:10::ac43:1e1
2606:4700::6811:190e
2606:4700::6812:1634
2606:4700::6812:672
2606:4700::6812:acf
2606:4700:e4::ac40:a816
2620:0:890::100
2a00:1450:4001:830::200a
2a00:1450:4001:831::200a
2a06:98c1:3120::3
35.167.76.23
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
63e3696c5e5e8b037e28e8fbef871184b0d1d60a7314c965b1426d9cce84dd69
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7829f065e0e10c8466f3d57766e0719421b7b652f6a1082f21b98702f1b28a30
7b792d9cff94a4f92d164ec7233833c903b4fdbaef13e37a0dc4258b8312ca83
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a2f26b68a6c8810c1aeb4048c938f835a86ba83756a7a440f989b967e78f3ba8
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b1cefc60fdfae6ec2b1fccb76fed899987517c7a8485a2e3bbce85e73de4bf7b
c54e3596ca5bc23af15d182227beffe1fd11ae7b1f114a224a1aebc229df88eb
cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4
d3313ef22afbf2e1b708ceef5e824ef12a338d51e497390376ec78f487021ae3
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda