![](/screenshots/b81dbfb6-7db3-4c50-b7f3-ad793ea74cf8.png)
www.funletters.net
Open in
urlscan Pro
216.177.153.14
Public Scan
Submission: On March 07 via automatic, source urlhaus
Summary
This is the only time www.funletters.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.177.153.14 216.177.153.14 | 40015 (MOVECLICKLLC) (MOVECLICKLLC) | |
1 12 | 65.175.104.35 65.175.104.35 | 7393 (CYBERCON) (CYBERCON) | |
2 | 2a00:1450:400... 2a00:1450:4001:816::2002 | 15169 (GOOGLE) (GOOGLE) | |
10 | 2a00:1450:400... 2a00:1450:4001:819::2002 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:800::2001 | 15169 (GOOGLE) (GOOGLE) | |
26 | 5 |
ASN40015 (MOVECLICKLLC, US)
PTR: wilson.simplecom.net
www.funletters.net |
ASN7393 (CYBERCON, US)
PTR: v193000s.m3xs.net
thundercloud.net |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
adservice.google.de | |
adservice.google.com | |
pagead2.googlesyndication.com | |
googleads.g.doubleclick.net | |
www.googletagservices.com |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
thundercloud.net
1 redirects
thundercloud.net |
115 KB |
6 |
googlesyndication.com
pagead2.googlesyndication.com tpc.googlesyndication.com |
133 KB |
5 |
doubleclick.net
googleads.g.doubleclick.net |
|
1 |
googletagservices.com
www.googletagservices.com |
27 KB |
1 |
google.com
adservice.google.com |
171 B |
1 |
google.de
adservice.google.de |
171 B |
1 |
funletters.net
www.funletters.net |
15 KB |
26 | 7 |
Domain | Requested by | |
---|---|---|
12 | thundercloud.net |
1 redirects
www.funletters.net
|
5 | googleads.g.doubleclick.net |
pagead2.googlesyndication.com
|
4 | pagead2.googlesyndication.com |
www.funletters.net
pagead2.googlesyndication.com |
2 | tpc.googlesyndication.com |
pagead2.googlesyndication.com
tpc.googlesyndication.com |
1 | www.googletagservices.com |
pagead2.googlesyndication.com
|
1 | adservice.google.com |
pagead2.googlesyndication.com
|
1 | adservice.google.de |
pagead2.googlesyndication.com
|
1 | www.funletters.net | |
26 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
thundercloud.net |
notoverthehill.com |
foldermagic.com |
calendarpal.com |
smileycons.com |
infoave.ipbhost.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1O1 |
2020-02-12 - 2020-05-06 |
3 months | crt.sh |
This page contains 7 frames:
Primary Page:
http://www.funletters.net/
Frame ID: 39B7521D21BC0276686F2DF1C3BC6B7D
Requests: 20 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/html/r20200303/r20190131/zrt_lookup.html
Frame ID: 6DFD52B8DD29C025D3E27EC743DC084D
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0926893595949110&output=html&h=90&slotname=4919167392&adk=3428009182&adf=2994382090&w=728&lmt=1455018219&psa=0&guci=1.2.0.0.2.2.0.0&format=728x90&url=http%3A%2F%2Fwww.funletters.net%2F&flash=0&wgl=1&adsid=NT&dt=1583605832996&bpp=15&bdt=54&fdt=48&idt=49&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=3916465135484&frm=20&pv=2&ga_vid=1664623797.1583605833&ga_sid=1583605833&ga_hid=473876886&ga_fc=0&iag=0&icsg=2730&dssz=9&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=426&ady=231&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3118887871384383&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=1&uci=a!1&fsb=1&xpc=3ZIsF03CJC&p=http%3A//www.funletters.net&dtd=107
Frame ID: D904433B84E36B499F52520E30DF5175
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0926893595949110&output=html&h=250&slotname=7872633792&adk=1612495507&adf=993112697&w=250&lmt=1455018219&psa=0&guci=1.2.0.0.2.2.0.0&format=250x250&url=http%3A%2F%2Fwww.funletters.net%2F&flash=0&wgl=1&adsid=NT&dt=1583605833011&bpp=4&bdt=70&fdt=118&idt=119&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90&correlator=3916465135484&frm=20&pv=1&ga_vid=1664623797.1583605833&ga_sid=1583605833&ga_hid=473876886&ga_fc=0&iag=0&icsg=10922&dssz=10&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=665&ady=348&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3118887871384383&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=2&uci=a!2&fsb=1&xpc=K2t8uu6UL5&p=http%3A//www.funletters.net&dtd=121
Frame ID: D4A14A152A41F337B5CDF74AF5EC9678
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0926893595949110&output=html&h=250&slotname=7872633792&adk=1612495507&adf=473232773&w=250&lmt=1455018219&psa=0&guci=1.2.0.0.2.2.0.0&format=250x250&url=http%3A%2F%2Fwww.funletters.net%2F&flash=0&wgl=1&adsid=NT&dt=1583605833015&bpp=3&bdt=74&fdt=121&idt=121&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C250x250&correlator=3916465135484&frm=20&pv=1&ga_vid=1664623797.1583605833&ga_sid=1583605833&ga_hid=473876886&ga_fc=0&iag=0&icsg=10922&dssz=10&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=665&ady=607&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3118887871384383&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=16&bc=23&ifi=3&uci=a!3&fsb=1&xpc=tjc5oevUdR&p=http%3A//www.funletters.net&dtd=123
Frame ID: 111A861640C8D398BA74256FA4E5D043
Requests: 1 HTTP requests in this frame
Frame:
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0926893595949110&output=html&adk=1812271804&adf=3025194257&lmt=1455018219&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=http%3A%2F%2Fwww.funletters.net%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1583605833018&bpp=3&bdt=77&fdt=124&idt=124&shv=r20200303&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=728x90%2C250x250%2C250x250&nras=1&correlator=3916465135484&frm=20&pv=1&ga_vid=1664623797.1583605833&ga_sid=1583605833&ga_hid=473876886&ga_fc=0&iag=0&icsg=10922&dssz=10&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3118887871384383&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=23&ifi=3&uci=a!3&fsb=1&dtd=129
Frame ID: 3F5ADF7FA0050E8FA9B46F42B161B554
Requests: 1 HTTP requests in this frame
Frame:
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 79DF9514B5A6DF8942732D4E3B6449F3
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/b81dbfb6-7db3-4c50-b7f3-ad793ea74cf8.png)
Detected technologies
![](/vendor/wappa/icons/CentOS.png)
Detected patterns
- headers server /CentOS/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /googlesyndication\.com\//i
Page Statistics
16 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: click here
Search URL Search Domain Scan URL
Title: click here
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Cloudeight InfoAve Forum
Search URL Search Domain Scan URL
Title: Cloudeight InfoAve Daily Computer Tips Newsletter
Search URL Search Domain Scan URL
Title: Get protected! We'll wipe all malware from your computer, swap your current antivirus for the best - Emsisoft - and set it up for you for one great price!Learn more here
Search URL Search Domain Scan URL
Title: Looking for a start page? Use ours!
Search URL Search Domain Scan URL
Title: Cloudeight Direct Mailware removal
Search URL Search Domain Scan URL
Title: Cloudeight Direct Windows Mail Set-up Sevice
Search URL Search Domain Scan URL
Title: Please contact us.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://thundercloud.net/infoave/images/2014/mainheader-2014.png HTTP 301
- http://thundercloud.net/infoave/images/2014/mainheader2014.png
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.funletters.net/ |
15 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mainheader2014.png
thundercloud.net/infoave/images/2014/ Redirect Chain
|
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
emsi-banner.png
thundercloud.net/infoave/images/2014/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ |
105 KB 38 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexstationery.png
thundercloud.net/infoave/images/2013/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexdirect.png
thundercloud.net/infoave/images/2013/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexnotoverthehill.png
thundercloud.net/infoave/images/2013/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexinfoavenews.png
thundercloud.net/infoave/images/2013/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexfoldermagic.png
thundercloud.net/infoave/images/2013/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexcalendarpal.png
thundercloud.net/infoave/images/2013/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newindexsmileycons.png
thundercloud.net/infoave/images/2013/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tippy.png
thundercloud.net/infoave/images/2015/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2013-repair2.png
thundercloud.net/infoave/images/2013/ |
31 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
109 B 171 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20200303/r20190131/ |
222 KB 83 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200303/r20190131/ Frame 6DFD |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame D904 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
osd.js
www.googletagservices.com/activeview/js/current/ |
73 KB 27 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame D4A1 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame 111A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
googleads.g.doubleclick.net/pagead/ Frame 3F5A |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sodar
pagead2.googlesyndication.com/getconfig/ |
7 KB 6 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sodar2.js
tpc.googlesyndication.com/sodar/ |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 79DF |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gen_204
pagead2.googlesyndication.com/pagead/ |
0 61 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
44 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| adsbygoogle object| google_js_reporting_queue number| google_srt object| google_ad_modifications object| google_logging_queue object| ggeac boolean| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad boolean| _gfp_p_ function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| google_t12n_vars function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms object| google_image_requests1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adservice.google.com
adservice.google.de
googleads.g.doubleclick.net
pagead2.googlesyndication.com
thundercloud.net
tpc.googlesyndication.com
www.funletters.net
www.googletagservices.com
216.177.153.14
2a00:1450:4001:800::2001
2a00:1450:4001:816::2002
2a00:1450:4001:819::2002
65.175.104.35
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0963371e40da070b4816b156bf1c4092291f4b28db9dc3583bc6e00c55fa7037
1f2040efbbf55b6a0e7b446915530f18eb562fa8693362cd0371051e7c8114c5
265877e9b845f44e5c73cb38ce0125c0cf094828fecdfffb53f2083e123cc2e3
42e04187d1d4600cef7e3745c047906a28ca88795a695e7ce7163e56c587c7e8
4c356615c050cbf5981624018698049ddb3cd9cef1deeb0ee9c0a3e4e420a657
984b50b44ade35d903bbfa50129e85a46a2247060ae69b55e7e595fd1f7dadde
9adc795980c10b0870bf1a125281c21a27983f6e5bee68b419acd533e695a13c
9d45e08ff36316ed56cff6d37f7c6946c168906020136e50fce2ade9ada13ee8
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
b8b7d1f10441c7349e88ed2a168e0635836f6724999f91ea8d15ecd4811dad38
c826469ca6b3279b655158184d05bb08f46779322293226315e382024572aa4b
cb4cb20fddd52a3c4ae0f479e9c7d5f61da863948cbe9a39ec92710976218e0a
d69c904440f4cdd98c5a84cf967d66a3243f1c9afd55ed6538c94eeab269b724
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e412f71549e8fb61546bd249cf82e8dda148c816208404f83fc05cee821740b6
e6f6537de5f830349286615362735afdb764febe9dd560bb90a4696ff33c3932
f7cac3aa783c115cd13804f312deaf663a115495b4dfde50b061c772173559ae
f8a223fa4b1d6f4b6e6be72b5764d46b9094782a315887dd9a28a3b3c5bdc10b