![](/screenshots/d8a05eb4-0c0a-4e07-964d-21c35d7ab31b.png)
sites.google.com
Open in
urlscan Pro
2a00:1450:4001:82b::200e
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On April 30 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by GTS CA 1C3 on April 11th 2022. Valid for: 3 months.
This is the only time sites.google.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Land Bank of the Philippines (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:1450:400... 2a00:1450:4001:82b::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
8 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
7 | 2a00:1450:400... 2a00:1450:4001:801::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 18.66.128.229 18.66.128.229 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:200... 2a04:4e42:200::272 | 54113 (FASTLY) (FASTLY) | |
1 | 104.92.81.33 104.92.81.33 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 104.111.240.149 104.111.240.149 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
26 | 9 |
ASN15169 (GOOGLE, US)
559568706-atari-embeds.googleusercontent.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-66-128-229.fra60.r.cloudfront.net
www.amazon.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-92-81-33.deploy.static.akamaitechnologies.com
www.lbpiaccess.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-240-149.deploy.static.akamaitechnologies.com
ofbank.com.ph |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
728 KB |
9 |
google.com
sites.google.com — Cisco Umbrella Rank: 2679 apis.google.com — Cisco Umbrella Rank: 91 |
171 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39 |
2 KB |
1 |
ofbank.com.ph
ofbank.com.ph |
22 KB |
1 |
lbpiaccess.com
www.lbpiaccess.com |
442 KB |
1 |
ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 816 |
382 B |
1 |
amazon.com
1 redirects
www.amazon.com — Cisco Umbrella Rank: 617 |
541 B |
1 |
googleusercontent.com
559568706-atari-embeds.googleusercontent.com |
1 KB |
26 | 8 |
Domain | Requested by | |
---|---|---|
8 | www.gstatic.com |
sites.google.com
www.gstatic.com |
7 | apis.google.com |
sites.google.com
apis.google.com www.gstatic.com 559568706-atari-embeds.googleusercontent.com |
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
sites.google.com
|
2 | sites.google.com |
www.gstatic.com
|
1 | ofbank.com.ph |
559568706-atari-embeds.googleusercontent.com
|
1 | www.lbpiaccess.com |
559568706-atari-embeds.googleusercontent.com
|
1 | images-na.ssl-images-amazon.com |
559568706-atari-embeds.googleusercontent.com
|
1 | www.amazon.com | 1 redirects |
1 | 559568706-atari-embeds.googleusercontent.com |
www.gstatic.com
|
26 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.apis.google.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
www.landbank.com R3 |
2022-04-27 - 2022-07-26 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://sites.google.com/view/redirectpagebank/home/
Frame ID: 73EA8689183F9A1BEE4E32068F347521
Requests: 17 HTTP requests in this frame
Frame:
https://www.gstatic.com/atari/embeds/7925c5f8e01bacb9b4b0a3783ae0b867/intermediate-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.fi.C1AypaSWm10.O%2Fd%3D1%2Frs%3DAHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ%2Fm%3D__features__&r=760696806
Frame ID: 5953F0993A8FC8738442806EFD17C71E
Requests: 3 HTTP requests in this frame
Frame:
https://559568706-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/inner-frame-minified.html?jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.fi.C1AypaSWm10.O%2Fd%3D1%2Frs%3DAHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ%2Fm%3D__features__
Frame ID: 74600F5F77A8EBC73DBA4E413D395D8A
Requests: 3 HTTP requests in this frame
Frame:
https://images-na.ssl-images-amazon.com/images/G/01/nav/transp.gif
Frame ID: 5C34261A7D773C7767E7C7DF109A0E46
Requests: 3 HTTP requests in this frame
Screenshot
![](/screenshots/d8a05eb4-0c0a-4e07-964d-21c35d7ab31b.png)
Page Title
HomeDetected technologies
![](/vendor/wappa/icons/Google Sites.png)
Detected patterns
- ^https?://sites\.google\.com
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- apis\.google\.com/js/[a-z]*\.js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Lisätietoja
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 22- https://www.amazon.com/gp/r.html?C=3IEUZBO845Z3Y&K=121YVFD9DQICL&M=urn:rtn:msg:20200509233333049b4396cef64bea9c474ebddf30p0na&R=268BKPMZCQMAP&T=O&U=https://images-na.ssl-images-amazon.com/images/G/01/nav/transp.gif&H=ZZJX8QHTG7ZY3AXA7U1EZZIHNJAA&ref_=pe_2617090_407789620_opens HTTP 302
- https://images-na.ssl-images-amazon.com/images/G/01/nav/transp.gif
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
sites.google.com/view/redirectpagebank/home/ |
76 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1015 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
22 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rs=AGEqA5nCR3zKtCf-YGsUZ3IxqNlpkUwBaw
www.gstatic.com/_/atari/_/ss/k=atari.vw.SShJCsbSyPM.L.W.O/d=1/ |
717 KB 95 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.js
apis.google.com/js/ |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=view
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=1/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
499 KB 169 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.fi.C1AypaSWm10.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ/ |
313 KB 106 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ |
28 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=sy16,sy17,sy18,sy15,FoQBg
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=0/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
36 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=sy2h,TRvtze
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=0/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
823 B 536 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=MpJwZc,n73qwf,A4UTCb,qAKInc,sy10,TGYpv,syv,X85Uvc,HIeYee,QxOCld,sy2k,abQiW,W26a5e,syx,syy,sy12,sy11,syz,fuVYe,hJUyqe,syj,ruhlUe,KUM7Z,XDKZTc,syw,qkPXAf,sy14,zPx2U,qEW1W,oNFsLb,sy3j,yxTchf,sy3k,sy...
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=0/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
1 MB 371 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=sy3a,IZT63,vfuNJf,sy33,sy37,sy3b,sy3m,sy3n,siKnQd,sy31,sy39,sy3d,YNjGDd,sy3c,sy3e,PrPYRd,iFQyKf,hc6Ubd,sy3o,SpsfSb,sy28,sy2j,sy34,sy36,zbML3c
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=0/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
26 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=m9oV,sy3f,NTMZac,RAnnUd,sy2o,uu7UOe,nAFL3,sy2g,gJzDyc,sy2p,sy3p,soHxf,syp,syr,HYv29e,sy2q,uY3Nvd
www.gstatic.com/_/atari/_/js/k=atari.vw.fi.ISzPRfbZlws.O/d=0/rs=AGEqA5no2ki57rurn3umCqippeS1qvQTQw/ |
33 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
logImpressions
sites.google.com/_/view/ |
16 B 64 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cb=gapi.loaded_1
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.fi.C1AypaSWm10.O/m=gapi_rpc/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ/ |
262 B 205 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
intermediate-frame-minified.html
www.gstatic.com/atari/embeds/7925c5f8e01bacb9b4b0a3783ae0b867/ Frame 5953 |
2 KB 947 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
apis.google.com/js/ Frame 5953 |
14 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.fi.C1AypaSWm10.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ/ Frame 5953 |
46 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inner-frame-minified.html
559568706-atari-embeds.googleusercontent.com/embeds/16cb204cf3a9d4d223a0a3fd8b0eec5d/ Frame 7460 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
apis.google.com/js/ Frame 7460 |
14 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.fi.C1AypaSWm10.O/m=gapi_rpc/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_BDFqo3ueJx1x0sg_O0LWOT0N4oQ/ Frame 7460 |
46 KB 16 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transp.gif
images-na.ssl-images-amazon.com/images/G/01/nav/ Frame 5C34 Redirect Chain
|
43 B 382 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lbpiaccess.jpg
www.lbpiaccess.com/resources/images/ Frame 5C34 |
441 KB 442 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
globalsign.png
ofbank.com.ph/images/ Frame 5C34 |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Land Bank of the Philippines (Banking)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| DOCS_timing function| _DumpException object| _docs_flag_initialData object| _docs_flag_cek function| gapiLoaded object| _at_config object| globals object| messages object| gapi object| ___jsl function| bgImgLoaded object| default_vw object| _bind object| closure_lm_601159 object| osapi object| gadgets object| iframer object| __gapi_jstiming__ object| shindig function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| googleapis function| _getTimingInstance function| _docsTiming function| MicroscopeImageMetadata object| MicroscopeMaximizeMode object| MicroscopeBackgroundStyle function| MicroscopeState function| MicroscopeSize object| MicroscopeResizeMode object| MicroscopeZoomWidgetMode function| Microscope number| closure_uid_6008827441 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.google.com/ | Name: NID Value: 511=H0MQoXzK7Qb3GvyQoqNH5JAzWKIMKt6UUK0PJF7vLF1Zf0gZOaPUOnAOvQX3L1KlSY8p-pkt46tE-f0z8sagzp2Aifv8at68daq7ghMBcycc2EIq7gqirmJEfMxwO0fSSY8vByGZVQDg8V6PsRb_qXyppNIPMT1XZs77zu4dA6E |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | base-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-SfYKnstvkSE1icFoh6IrfA' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://google-admin.corp.google.com/ |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
559568706-atari-embeds.googleusercontent.com
apis.google.com
fonts.googleapis.com
fonts.gstatic.com
images-na.ssl-images-amazon.com
ofbank.com.ph
sites.google.com
www.amazon.com
www.gstatic.com
www.lbpiaccess.com
104.111.240.149
104.92.81.33
18.66.128.229
2a00:1450:4001:801::200a
2a00:1450:4001:801::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:831::2001
2a00:1450:4001:831::2003
2a04:4e42:200::272
13b6aff6e09494259b0f9cdaa32c9b72c552e40b323413e9964d92f6b6e7a006
254fddc643f0c188af7ec4914fb355f535c0b8f540b83f90562ebe1189c27fe0
274d14a96c9c0d07f6f32fc250686f12111c8462b57412c3d66ea4458e91fc72
2e5d4be918200081673a10df00301d8f01706f51d1947bf78e98e8b5bbea2f01
3704afefd25c94315efcbcb4513deedbd292002ec51691e6cffe69d2262d7927
39bd61712e80a7f661569c06339793dbff4157e81a4929ea19a85e5116ebc1fc
3c2bf9feaada58f8e51e54f81e34d559670715f48928c9edc4688c871257dc4c
49e6bac14c20b7b9dbce66ccc8de30efef89733355ba385bef382b32593f4a27
57ab7a20e842e766c5091ad86d946fd9feee6d8c79cc1fe5812da1afdeebb83e
62be99238a49de1ae04763113c4024256166b1b82e23caecff5d5cdbdfc6b201
6cc20e97a2ad701bb8d2d72b0436fcc39248c279a9e04a2f9f0dc2a88a861962
6e3c7e6f6791aaa3b3983250396f596ce06da2b88a0f645961268c70c4527bd9
71d80b9331caa4b7df65ff2960d633269290203ff175f0e5aec2a3b209b89d1b
7bedd38060b64d53ad5c2ad1e2f330970cc61069f65d3d28a32809d329bfce23
7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16
80e142904c9feeca9d8c64af55dabfda8032b2ac29fc26ca11d59aa1abddc6ab
8d47b4a1cc0393424720bded5988a28f4e9146fd265ecb416b79cf0d6ac81f6d
a52c7470b71ee6db018791820f62f297b5f36d4ac2781fa6f14d5b9864da17a0
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
c8cf484cc79012eb0f9602ff0eb48c2a51cb6626f10fa4fe2aa04cfaa20f5404
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d6f011dd8aeec820d290bf5ba77e318941683f28068b00a069a67d2462647e03
f30ab56432d273a8356cebf11a9382688f784ed4de44511eb0abcaddf6be95af