d14hmdqoeso5b5.cloudfront.net
Open in
urlscan Pro
18.161.21.35
Malicious Activity!
Public Scan
Effective URL: https://d14hmdqoeso5b5.cloudfront.net/apps/woody/index.html
Submission: On October 01 via api from CA — Scanned from CA
Summary
TLS certificate: Issued by Amazon on February 1st 2022. Valid for: a year.
This is the only time d14hmdqoeso5b5.cloudfront.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BBVA (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
21 | 18.161.21.35 18.161.21.35 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 173.223.57.45 173.223.57.45 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 52.2.16.173 52.2.16.173 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 63.140.38.226 63.140.38.226 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 23.217.32.91 23.217.32.91 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 18.161.21.59 18.161.21.59 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 34.225.198.181 34.225.198.181 | 14618 (AMAZON-AES) (AMAZON-AES) | |
32 | 8 |
ASN16509 (AMAZON-02, US)
PTR: server-18-161-21-35.bos50.r.cloudfront.net
d14hmdqoeso5b5.cloudfront.net |
ASN16625 (AKAMAI-AS, US)
PTR: a173-223-57-45.deploy.static.akamaitechnologies.com
tags.tiqcdn.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-16-173.compute-1.amazonaws.com
dpm.demdex.net |
ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-226.data.adobedc.net
smetrics.bbva.es |
ASN16625 (AKAMAI-AS, US)
PTR: a23-217-32-91.deploy.static.akamaitechnologies.com
servicios.bbva.es |
ASN16509 (AMAZON-02, US)
PTR: server-18-161-21-59.bos50.r.cloudfront.net
gam.movil.bbva.es |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-198-181.compute-1.amazonaws.com
collect.tealiumiq.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
cloudfront.net
d14hmdqoeso5b5.cloudfront.net |
3 MB |
5 |
bbva.es
smetrics.bbva.es — Cisco Umbrella Rank: 463266 servicios.bbva.es — Cisco Umbrella Rank: 796765 gam.movil.bbva.es — Cisco Umbrella Rank: 981673 |
28 KB |
4 |
tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 1002 |
123 KB |
1 |
tealiumiq.com
collect.tealiumiq.com — Cisco Umbrella Rank: 2701 |
777 B |
1 |
demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 211 |
1 KB |
32 | 5 |
Domain | Requested by | |
---|---|---|
21 | d14hmdqoeso5b5.cloudfront.net |
d14hmdqoeso5b5.cloudfront.net
tags.tiqcdn.com |
4 | tags.tiqcdn.com |
d14hmdqoeso5b5.cloudfront.net
tags.tiqcdn.com |
2 | gam.movil.bbva.es |
d14hmdqoeso5b5.cloudfront.net
|
2 | servicios.bbva.es |
d14hmdqoeso5b5.cloudfront.net
|
1 | collect.tealiumiq.com |
tags.tiqcdn.com
|
1 | smetrics.bbva.es |
tags.tiqcdn.com
|
1 | dpm.demdex.net |
tags.tiqcdn.com
|
32 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudfront.net Amazon |
2022-02-01 - 2023-01-31 |
a year | crt.sh |
*.tiqcdn.com DigiCert SHA2 Secure Server CA |
2022-02-27 - 2023-02-28 |
a year | crt.sh |
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-09-26 - 2023-10-27 |
a year | crt.sh |
smetrics.bbva.es DigiCert TLS RSA SHA256 2020 CA1 |
2021-11-10 - 2022-12-11 |
a year | crt.sh |
www.bbva.es DigiCert SHA2 Extended Validation Server CA |
2022-05-05 - 2023-05-09 |
a year | crt.sh |
gam.movil.bbva.es DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-18 - 2023-05-19 |
a year | crt.sh |
*.tealiumiq.com Amazon |
2022-08-25 - 2023-09-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://d14hmdqoeso5b5.cloudfront.net/apps/woody/index.html
Frame ID: 28FC9F3840056BD97556AC41BD07453C
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
BBVAPage URL History Show full URLs
- https://d14hmdqoeso5b5.cloudfront.net/index.html Page URL
- https://d14hmdqoeso5b5.cloudfront.net/apps/woody/index.html Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://d14hmdqoeso5b5.cloudfront.net/index.html Page URL
- https://d14hmdqoeso5b5.cloudfront.net/apps/woody/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
index.html
d14hmdqoeso5b5.cloudfront.net/ |
176 B 656 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.html
d14hmdqoeso5b5.cloudfront.net/apps/woody/ |
30 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-d24499a07e3ae984eca949fda39072dc.css
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
526 B 806 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buzz-6aea40689be9eb974fa3865d06a6eb79.css
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BentonSansBBVA-Book-dad6b6198b8254b8bce259aefda62568.woff
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/fonts/ |
69 KB 68 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BentonSansBBVA-Medium-f50002bc63bc7f6f4e68c65bd0ec40d4.woff
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/fonts/ |
71 KB 70 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BentonSansBBVA-BookItalic-c109f702b5103d7302b44179636a6b6b.woff
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/fonts/ |
71 KB 70 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BentonSansBBVA-MediumItalic-803e1fe842adc8c2e1aa001b53874f0b.woff
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/fonts/ |
72 KB 71 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-maiden-9399fd7a2da4f520da7271bb32a050c5.woff
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/iconfonts/ |
76 KB 45 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner_video_call_connection_lost-880ba74168c305a02d43d27539891191.svg
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/img/banners/ |
10 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.sync.js
tags.tiqcdn.com/utag/bbva/es-main-mobileapp/prod/ |
168 KB 53 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.min-a8bc3609a5d648c28e10ece0b8fdc6d3.css
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/ |
955 KB 122 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-06d74478e8b9b0b13b6cacd0cd925d02.js
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
8 MB 1 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk.170.19ccc21b6e48e004336932bef2348b33.js
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
489 KB 152 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk.143.224f1f50128147ae4cb7fd6123673c03.js
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buzz-f68de6abb27de27d117d754270331703.js
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
3 MB 488 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id
dpm.demdex.net/ |
213 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
smetrics.bbva.es/ |
48 B 465 B |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset-manifest-a5b0aa2d600465e71a22f283433ebb6b.json
d14hmdqoeso5b5.cloudfront.net/apps/woody/ |
75 KB 16 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
assetMap-7496970111a56d6511337d418238dfec.json
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/ |
569 KB 115 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.js
tags.tiqcdn.com/utag/bbva/es-main-mobileapp/prod/ |
139 KB 34 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-d009799aa029443329685b0d5fc6f100.json
d14hmdqoeso5b5.cloudfront.net/apps/woody/translations/eng/ |
133 KB 44 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.28.js
tags.tiqcdn.com/utag/bbva/es-main-mobileapp/prod/ |
130 KB 35 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
aklivewit
servicios.bbva.es/ |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
mobilepublicconfig1.1
gam.movil.bbva.es/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
HEAD H2 |
aklivewit
servicios.bbva.es/ |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mobilepublicconfig1.1
gam.movil.bbva.es/ |
28 KB 28 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ |
2 B 200 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-menu-a5a292edf3027c756482651a9fbb4bd3.svg
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-white-1c1c2a68cc4c755b9ebacef725dd3421.svg
d14hmdqoeso5b5.cloudfront.net/apps/woody/assets/vendor/res/img/logos/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
manifest-a616d14f0b2d391412c303288f22d4b4.json
d14hmdqoeso5b5.cloudfront.net/apps/woody/ |
952 B 1 KB |
Manifest
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
i.gif
collect.tealiumiq.com/bbva/es-main-mobileapp/2/ |
43 B 777 B |
XHR
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BBVA (Financial)126 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| digitalData function| removeElement function| getMeta function| loadLink function| loadStyles function| getAppConfig object| appConfig object| bootConfig object| sw boolean| isProduction boolean| iosInterface boolean| androidInterface function| cleanAppShell function| getGDPRCookie boolean| analitica boolean| personalizacion boolean| publicidad object| gdprCookies undefined| splittedCookie function| e object| cookieValue string| cookieValueSplit string| adobeIDValue function| targetPageParams string| logVisitorAPI object| adobe function| Visitor object| s_c_il number| s_c_in object| visitor string| TargetSDID boolean| loaded_target object| targetOffersMBoxes object| ATManager object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| loader function| define function| requireModule function| require function| requirejs boolean| runningTests object| EmberENV function| $ function| jQuery object| mainContext object| Ember object| Em function| Dexie function| setImmediate function| clearImmediate object| operationsWorkshop object| webpackChunk_ember_auto_import_ object| __ember_auto_import__ function| _eai_r function| _eai_d function| emberAutoImportDynamic function| emberAutoImportSync object| default object| regeneratorRuntime function| moment function| Hammer object| slinky_3d2f9a9c2a912f16348497435323b34a boolean| utag_condload number| cont object| utag function| getIDFormulario object| utag_data boolean| gdprTrack function| HTMLEncode function| quita_tildes function| cleanString function| getDomain function| getCookie function| setCookie function| getPosicionGEO function| VisualizacionBarraPersonalizadaSC function| VisualizacionBannerSC function| ClicBuscadorSC function| SeguimientoProcesoSC function| AbandonoProcesosContratacionSC function| envia_nombrado_pagina function| medicion_sc_operativa_privada function| SeguimientoBuscadorAxesorSC function| SeguimientoEmpresaAxesorSC function| getTrackingCode object| TagManager string| FlagCampaigns number| CampaignsCleaned function| cleanListCampaigns object| teal function| digitalChange object| tiq_ownVars boolean| loginEvent object| utag_cfg_ovrd number| timerInterval function| digitalTrack function| getProfileID function| getTimeHourData function| getTimeHourMinutesSeconds function| setAsincronosListeners string| eventHandle boolean| flagTime boolean| abortTealTrack string| eventsList boolean| productsFlag number| numProducts string| eventFlowNum string| serialString string| eventStep string| eventState object| dias number| s_loadT string| UDOvar string| udo4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.demdex.net/ | Name: demdex Value: 21686641003857350010899232664774700141 |
|
.d14hmdqoeso5b5.cloudfront.net/ | Name: AMCVS_D906879D557EE0547F000101%40AdobeOrg Value: 1 |
|
.d14hmdqoeso5b5.cloudfront.net/ | Name: AMCV_D906879D557EE0547F000101%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19267%7CMCMID%7C21681318642568062880897574957243682980%7CMCAAMLH-1665195014%7C7%7CMCAAMB-1665195014%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1664597414s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0 |
|
.tealiumiq.com/ | Name: TAPID Value: bbva/es-main-mobileapp>0183914efee90099687634def85003073003b06b00b08| |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubdomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
collect.tealiumiq.com
d14hmdqoeso5b5.cloudfront.net
dpm.demdex.net
gam.movil.bbva.es
servicios.bbva.es
smetrics.bbva.es
tags.tiqcdn.com
173.223.57.45
18.161.21.35
18.161.21.59
23.217.32.91
34.225.198.181
52.2.16.173
63.140.38.226
16a063608599c36d732862a13112bbab2da4596b688451e2c915cce40e8f6f26
321eb58a0970fb64dd4e1c185f71b67405557295dcd2b55dc2752f3138d3c10c
32b5be70164acc09cb52ed04d8e5b86b3461bb03037ce96176e5cd1030e6bee9
3715247bd682d7bf1164451a213a65fc7223701721a5b0be5f65a6779d52c2a4
499e590865240d2d2a11f06afcb517dee966a39a19e543e2c26558c96e1d5969
52936b924f694307ea8fb683a7d35de0b099263d2eeefbf4f34fc1bd01e4d1a6
58dbd83754a9ea4a16125d33c9253c08fad32f2a6b192b2de27204e643b82e7b
683f5dea1976fd4a6745667691c91dcffb2db35cf292aa17a3ed079e12f8ba7a
704524f5934f57e366b857f0f49e16dac4a2683db1edab82fe39dcad221f1252
7af3360fe39c201b1ccbe7a726a5d3c2f0253add6616b71176f0d9e7c849a732
7c30c8f974e919f054eb8242c8c25895b20273f8875f1aad08ca585b04bd236c
7df6ddd39cdc5e8a5aaeb2d1dcd56bdbdad57284204639225b5a68ce22731704
87e1f15638a9c8e269cb4ab4b5c3f36aa0acfa9011e8eaf899fad8f8ff37253f
8a88fff59253c2c3e199f075a654a3ecb86957f98edab56cbfc7d623e0a39184
8c80e6923f31b5085d3eb84330e90e7d35dc3d359275dedcecfefd96a37e9944
8d2773d3627ef45ce1d6d0bfd029a68fd6b6dadb1aa75e60b8eb9ee01ff26f23
94d0ac504031ae10b1152dc4d0000bb62e8f6a3ce93f3f0b6da90974df141f6a
995321071f4ac1e8594c721cf64676cc8f3986db0d353ffdb5af3cf5bdc23a49
9e2634d5314ad35ae833395294b8cc12d93b82d57b60534b30f261d72e19c964
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a6f190f5ede52fcacaa17b0f6a01b8d2dfaa028857d69b35f8049889ce9d522b
b626072266e4814dad7e2e5f4e749633df9897ab6a8193006f300e680a0258ca
b7d70eca754d769feffedb9f4fbb2259cea5186bddd690abcad6758d099345f7
baa07c467dda99cdb7a42095b1627ce9b2aa114245834f6ca899f8ef6175038f
d695c54e6a80f75f1de09b33bd8f2f6c349fe257e079e518d42c96f4a10a86a3
d7459c1bc0884fd6db3276850df4f6ba38348d33e65100227a5eadf2b6bbe2a5
e3602443d092b845486b7af72355dcfabe1ed8ce8483d991d713d2c69810ea27
ef45e40b0ae5cbb2bacbf452e0c016b64e5c7b64d75e1f6477a98bf8fa5ff61b
faef4c0bda0c3c95f57f42c990d7623eedb0d7f8174a6640ff4114f1091217ec