![](/screenshots/b089de32-f2d9-4194-9202-295e2947db88.png)
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Effective URL: https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html
Submission: On June 24 via manual from ES — Scanned from ES
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial) Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 192.185.96.11 192.185.96.11 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
3 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.64.147.160 172.64.147.160 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 7 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 23.37.49.89 23.37.49.89 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 95.217.34.6 95.217.34.6 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 95.100.68.84 95.100.68.84 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
26 | 10 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: mazda.websitewelcome.com
indian-nepalikitchen.com |
ASN13335 (CLOUDFLARENET, US)
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev |
ASN13335 (CLOUDFLARENET, US)
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev |
ASN16625 (AKAMAI-AS, US)
PTR: a23-37-49-89.deploy.static.akamaitechnologies.com
www.aexp-static.com |
ASN16625 (AKAMAI-AS, US)
PTR: a95-100-68-84.deploy.static.akamaitechnologies.com
www.americanexpress.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
r2.dev
1 redirects
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev |
280 KB |
4 |
aexp-static.com
www.aexp-static.com — Cisco Umbrella Rank: 13568 |
4 KB |
4 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1286 |
62 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268 |
58 KB |
1 |
americanexpress.com
www.americanexpress.com — Cisco Umbrella Rank: 14970 |
2 KB |
1 |
gawa.com.do
gawa.com.do |
848 B |
1 |
pixabay.com
cdn.pixabay.com — Cisco Umbrella Rank: 51730 |
188 KB |
1 |
indian-nepalikitchen.com
indian-nepalikitchen.com |
7 KB |
0 |
microsoftapis.com
Failed
fonts.microsoftapis.com Failed |
|
26 | 9 |
Domain | Requested by | |
---|---|---|
7 | pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev |
1 redirects
indian-nepalikitchen.com
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev |
4 | www.aexp-static.com |
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
|
4 | pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev |
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
|
4 | maxcdn.bootstrapcdn.com |
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
maxcdn.bootstrapcdn.com |
3 | cdnjs.cloudflare.com |
indian-nepalikitchen.com
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev |
1 | www.americanexpress.com | |
1 | gawa.com.do |
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
|
1 | cdn.pixabay.com |
indian-nepalikitchen.com
|
1 | indian-nepalikitchen.com | |
0 | fonts.microsoftapis.com Failed |
indian-nepalikitchen.com
|
26 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
indian-nepalikitchen.com R3 |
2024-05-04 - 2024-08-02 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
pixabay.com Cloudflare Inc ECC CA-3 |
2024-02-12 - 2024-12-31 |
a year | crt.sh |
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2024-03-06 - 2025-03-06 |
a year | crt.sh |
www.gawa.com.do.comercialabreu.com R3 |
2024-04-28 - 2024-07-27 |
3 months | crt.sh |
www.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2023-08-03 - 2024-08-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html
Frame ID: 756970CA2203AB82A217BE86044F563B
Requests: 33 HTTP requests in this frame
Screenshot
![](/screenshots/b089de32-f2d9-4194-9202-295e2947db88.png)
Page Title
mnPage URL History Show full URLs
- https://indian-nepalikitchen.com/Gens/Gens2/suiteindex.html Page URL
- https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html Page URL
-
https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/cdn-cgi/phish-bypass?atok=lAYZA8waRAujlP8ErskR9qK6OLVFtnMBuLj8FuLGDDw-171921...
HTTP 301
https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/amex.png)
Detected patterns
- aexp-static\.com
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://indian-nepalikitchen.com/Gens/Gens2/suiteindex.html Page URL
- https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html Page URL
-
https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/cdn-cgi/phish-bypass?atok=lAYZA8waRAujlP8ErskR9qK6OLVFtnMBuLj8FuLGDDw-1719213120-0.0.1.1-%2Fam1.html
HTTP 301
https://pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/am1.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
suiteindex.html
indian-nepalikitchen.com/Gens/Gens2/ |
15 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
css2
fonts.microsoftapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
microsoft-1088004_1280.png
cdn.pixabay.com/photo/2015/12/11/11/43/ |
187 KB 188 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
586 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
187 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
am1.html
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/ |
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/ |
27 KB 27 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
am1.html
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/ Redirect Chain
|
41 KB 41 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap-social.min.css
cdnjs.cloudflare.com/ajax/libs/bootstrap-social/5.1.1/ |
24 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev/ |
6 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-bluebox-solid.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.8.0/package/dist/img/logos/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-stack.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.8.0/package/dist/img/logos/ |
2 KB 922 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cid.png
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev/ |
76 KB 76 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csc.png
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner2.png
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev/ |
73 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-logo-line.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/1.7.1/package/dist/img/logos/ |
2 KB 890 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dls-flag-us.svg
www.aexp-static.com/cdaas/one/statics/axp-static-assets/2.24.1/package/dist/img/flags/ |
5 KB 767 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6v.js
gawa.com.do/css/images/ |
864 B 848 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
644 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
942 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
764 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
984 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
glyphicons-halflings-regular.woff2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/ |
18 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.americanexpress.com/ |
1 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- fonts.microsoftapis.com
- URL
- https://fonts.microsoftapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial) Generic Cloudflare (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery object| Email function| sendEmail function| sendEmail2 function| sendEmail3 function| sendEmail42 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.pixabay.com/ | Name: __cf_bm Value: ._nZMCfIymo03lcUVbenQqgXI0KyyeOB2ddy1mhcwwc-1719213119-1.0.1.1-8iJSNTzACBYNgEu75It81kWrHypxfJI13CDxuCVNu8VNDc.0gIYIdv6OPOXxWSNzxUlhkxg3yZNxlCjeOepuFA |
|
.pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev/ | Name: __cf_mw_byp Value: lAYZA8waRAujlP8ErskR9qK6OLVFtnMBuLj8FuLGDDw-1719213120-0.0.1.1-/am1.html |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.pixabay.com
cdnjs.cloudflare.com
fonts.microsoftapis.com
gawa.com.do
indian-nepalikitchen.com
maxcdn.bootstrapcdn.com
pub-0c81215a90f74b8c9f18164f99ce4646.r2.dev
pub-b46d60069dd647c49e7e7cdcfff94629.r2.dev
www.aexp-static.com
www.americanexpress.com
fonts.microsoftapis.com
104.17.25.14
104.18.11.207
172.64.147.160
192.185.96.11
23.37.49.89
2606:4700::6812:223
2606:4700::6812:323
95.100.68.84
95.217.34.6
028f643755987211bf2f3add6c62ae1870a888cf2f4fe3040a4fac7dce2543ab
13b6724c8d538ef90c4c4e8e2eda8f667cfa97c40995cf2027399fa8c2cb7dd8
1985974bb54604254090ce6ac2267c7650f4cf9354edafcaaebd14ade3ce4d52
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
485f1f25d53c2c7d68c0d01052fdd9aa7ba7c28091ac7d1e3366a220f6e8a08d
49a439ce72223cc0a04ce4a47c5b14b0fcb4e174b6ae39aad4843c4ac52ce6ba
4ddc1e33de02a96249bf85fc7b16e669317a81d8e2fc403ddb1ded6c465dd578
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
5e60a20da0f769a6260d4ed755d615da930b87c62436f807a6ff32d000017d18
75c853178c2fe8c3bc4abe540d7a0c12afc76810810325f37f3009c2fe2a5130
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
964706b90cceb142d024162db0337da95f4f0a6bf6a722391023173dbc3c787f
ac530b45ba80cad0fd89cff7ed19f3af661ccbf465a71139407e7687b568219a
acf07d1efd42984fc3b2adfa31cbcef2f2a508f5105fde68bc56b3e80dcfc826
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542
c39e8554624a4b74e596d2bfa96bdd4d30dbc395532ab32e67591c0e929080e9
e5cf0014d53b47dfd3733e4be099ffe3a356ed783f7c40ac8407b7cc64dcf56e
e7e3456d0a0eea3b8ed93a20ec91293e6145f67b07e02a09d876ff7c16066223
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fa12fb8f6ec391542590fd0b159fb06e9cabdd2556950955beffa5a742b7c5ea
fc69234936c0df004440641a5df9ee1e3c3532df5780984f0f636e85e8788519
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e