strretto.com
Open in
urlscan Pro
165.22.20.191
Malicious Activity!
Public Scan
Effective URL: https://strretto.com/cases/celsius/
Submission: On November 22 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by R3 on November 21st 2023. Valid for: 3 months.
This is the only time strretto.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Stretto (Legal)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 162.221.190.194 162.221.190.194 | 33182 (DIMENOC) (DIMENOC) | |
2 5 | 5.206.227.248 5.206.227.248 | 47674 (NETSOLUTIONS) (NETSOLUTIONS) | |
1 2 | 2606:4700::68... 2606:4700::6810:7aaf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 13.32.99.103 13.32.99.103 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 165.22.20.191 165.22.20.191 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2606:4700:303... 2606:4700:3035::6815:5453 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:5714 | () () | |
1 | 192.229.233.34 192.229.233.34 | () () | |
33 | 9 |
ASN47674 (NETSOLUTIONS, MO)
PTR: ganbomarsa.com
akjzx.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-103.fra60.r.cloudfront.net
openfpcdn.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
akjzx.com
2 redirects
akjzx.com |
3 KB |
4 |
strretto.com
strretto.com |
1 MB |
4 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223 |
234 KB |
2 |
unpkg.com
1 redirects
unpkg.com — Cisco Umbrella Rank: 903 |
14 KB |
1 |
olark.com
static.olark.com |
|
1 |
jsdelivr.net
cdn.jsdelivr.net |
49 KB |
1 |
seeklogo.com
seeklogo.com — Cisco Umbrella Rank: 94979 |
10 KB |
1 |
openfpcdn.io
openfpcdn.io — Cisco Umbrella Rank: 16326 |
5 KB |
1 |
grunsa.com
1 redirects
www.grunsa.com |
282 B |
0 |
web3modal.com
Failed
api.web3modal.com Failed |
|
33 | 10 |
Domain | Requested by | |
---|---|---|
5 | akjzx.com |
2 redirects
akjzx.com
unpkg.com |
4 | strretto.com |
unpkg.com
strretto.com |
4 | cdnjs.cloudflare.com |
akjzx.com
strretto.com cdnjs.cloudflare.com |
2 | unpkg.com |
1 redirects
akjzx.com
|
1 | static.olark.com |
srcdoc
|
1 | cdn.jsdelivr.net |
strretto.com
|
1 | seeklogo.com |
strretto.com
|
1 | openfpcdn.io |
akjzx.com
|
1 | www.grunsa.com | 1 redirects |
0 | api.web3modal.com Failed |
strretto.com
|
33 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
akjzx.com R3 |
2023-10-19 - 2024-01-17 |
3 months | crt.sh |
openfpcdn.io Amazon RSA 2048 M01 |
2023-01-25 - 2024-02-24 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
strretto.com R3 |
2023-11-21 - 2024-02-19 |
3 months | crt.sh |
seeklogo.com E1 |
2023-10-06 - 2024-01-04 |
3 months | crt.sh |
static.olark.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-03-17 - 2024-04-16 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://strretto.com/cases/celsius/
Frame ID: BA167433EF1D4B7906C4754829CB9EEC
Requests: 40 HTTP requests in this frame
Frame:
https://static.olark.com/jsclient/loader0.js
Frame ID: 2D12F73F583055E12F127D37F535921D
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://www.grunsa.com/v/
HTTP 302
https://akjzx.com/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/ HTTP 302
https://akjzx.com/b-check/?next=/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/ Page URL
-
https://akjzx.com/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/
HTTP 302
https://strretto.com/cases/celsius/ Page URL
Detected technologies
jsDelivr (CDN) ExpandDetected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.grunsa.com/v/
HTTP 302
https://akjzx.com/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/ HTTP 302
https://akjzx.com/b-check/?next=/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/ Page URL
-
https://akjzx.com/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/
HTTP 302
https://strretto.com/cases/celsius/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.grunsa.com/v/ HTTP 302
- https://akjzx.com/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/ HTTP 302
- https://akjzx.com/b-check/?next=/c/c9ae9fa8-c8de-4519-a8f5-876b5ef1a2c7/
- https://unpkg.com/htmx.org@1.8.4 HTTP 302
- https://unpkg.com/htmx.org@1.8.4/dist/htmx.min.js
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
akjzx.com/b-check/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
htmx.min.js
unpkg.com/htmx.org@1.8.4/dist/ Redirect Chain
|
39 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
output.276793ffaa36.js
akjzx.com/static/CACHE/js/ |
480 B 486 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
openfpcdn.io/botd/ |
15 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner.gif
cdnjs.cloudflare.com/ajax/libs/x-editable/1.4.3/inputs/select2/lib/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
akjzx.com/b-check/ |
0 188 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
strretto.com/cases/celsius/ Redirect Chain
|
867 KB 364 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
f46e5ffd-55fd-4b4f-b656-a2e236680015.js
strretto.com/cases/celsius/ |
3 MB 564 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
metamask-logo-09EDE53DBD-seeklogo.com.png
seeklogo.com/images/M/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
line-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/line-awesome/1.3.0/line-awesome/css/ |
88 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethers.umd.min.js
cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ |
719 KB 123 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
merkletree.js
cdn.jsdelivr.net/npm/merkletreejs@latest/ |
209 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wallet-connect-v3.js
strretto.com/cases/celsius/scripts/ |
2 MB 555 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popup-6.css
strretto.com/cases/celsius/styles/ |
53 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
21 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
38 KB 38 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
la-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/line-awesome/1.3.0/line-awesome/fonts/ |
94 KB 95 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader0.js
static.olark.com/jsclient/ Frame 2D12 |
9 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
getWallets
api.web3modal.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
692ed6ba-e569-459a-556a-776476829e00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
600a9a04-c1b9-42ca-6785-9b4b6ff85200
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
30c46e53-e989-45fb-4549-be3bd4eb3b00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
93564157-2e8e-4ce7-81df-b264dbee9b00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ab781bbc-ccc6-418d-d32d-789b15da1f00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
3ff73439-a619-4894-9262-4470c773a100
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
02b53f6a-e3d4-479e-1cb4-21178987d100
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ab9c186a-c52f-464b-2906-ca59d760a400
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
41d04d42-da3b-4453-8506-668cc0727900
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b310f07f-4ef7-49f3-7073-2a0a39685800
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
7289c336-3981-4081-c5f4-efc26ac64a00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
07ba87ed-43aa-4adf-4540-9e6a2b9cae00
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ef1a1fcf-7fe8-4d69-bd6d-fda1345b4400
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
54a1aa77-d202-4f8d-0fb2-5d2bb6db0300
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0c2840c3-5b04-4c44-9661-fbd4b49e1800
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
461db637-8616-43ce-035a-d89b8a1d5800
api.web3modal.com/public/getAssetImage/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/getWallets?page=1&entries=4
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/692ed6ba-e569-459a-556a-776476829e00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/600a9a04-c1b9-42ca-6785-9b4b6ff85200
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/30c46e53-e989-45fb-4549-be3bd4eb3b00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/93564157-2e8e-4ce7-81df-b264dbee9b00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/ab781bbc-ccc6-418d-d32d-789b15da1f00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/3ff73439-a619-4894-9262-4470c773a100
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/02b53f6a-e3d4-479e-1cb4-21178987d100
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/ab9c186a-c52f-464b-2906-ca59d760a400
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/41d04d42-da3b-4453-8506-668cc0727900
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/b310f07f-4ef7-49f3-7073-2a0a39685800
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/7289c336-3981-4081-c5f4-efc26ac64a00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/07ba87ed-43aa-4adf-4540-9e6a2b9cae00
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/ef1a1fcf-7fe8-4d69-bd6d-fda1345b4400
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/54a1aa77-d202-4f8d-0fb2-5d2bb6db0300
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/0c2840c3-5b04-4c44-9661-fbd4b49e1800
- Domain
- api.web3modal.com
- URL
- https://api.web3modal.com/public/getAssetImage/461db637-8616-43ce-035a-d89b8a1d5800
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Stretto (Legal)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
akjzx.com/ | Name: csrftoken Value: 4kmEV0DiIe0pEX3nQZAjRTabYbbRMRkrV53lnk0DJzKP7GtaLF2BI6Doxefk4RXa |
|
akjzx.com/ | Name: sessionid Value: bqva19qfyto6ip2hp57qy4ipogjgmwl0 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=60; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
akjzx.com
api.web3modal.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
openfpcdn.io
seeklogo.com
static.olark.com
strretto.com
unpkg.com
www.grunsa.com
api.web3modal.com
13.32.99.103
162.221.190.194
165.22.20.191
192.229.233.34
2606:4700:3035::6815:5453
2606:4700::6810:5714
2606:4700::6810:7aaf
2606:4700::6811:190e
5.206.227.248
09213314c543aa8dae87413e2a350f562918fde39a8737dd18b42cafe818fa90
276793ffaa362fe23e6684786ea1758d3c9c0f35a2f6d8a6b44cf74276f512cb
33e43ca66a31221d702cd8d2beb675d37a7baa26622bca6bec54bfc760ecb4f6
3c675b4e8da56db009de4dadd92242078fb2361310c3e049daf34fc23be76019
5b9c7ce20975a1f47b3d26f3684736eaae86a460e677f7458317d500573f493d
8071e676fa3570448c0998bfb35f12d871ce28aea30bc4ecac2f71978ac491be
83aa5980a6776262ea538499bd6fe7ee82cfc94efd401a980a1a31447a134d8d
95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618
9d25e1a72052bda62d6ffafb635519fd563880215df7105cbb9cc77f211d0ab3
aa6c0745bcf2dbe9275297cc84efe5e6d47ca265bce27b1dc474d7f7c255241e
af00d2cec87b70e8139926da6426dd0686ff9a8207386658b6d72ee4e799c2e3
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b2943cf448795751c6a309662c5237904fcb74e31507271deb64437350274b8d
b59266bad7f02331051bb2aaaaa549959572af021018bd64ad84e9ee8746e554
ce61a18cf084f15003798340044643f329ac5f90045acb2d9e778368bd799854
de2226910ceb20f69a14f872ae61efa98c4ffa5dfd9bcabc882a4861ff605514
de3650074c7f776c60a135d44e6735b4cb71f7cf30cc8548fedd631f620306fa
df72edb141a16578945a0356c8a6a37239015251962071639b99b0184691ed1d
e12caf3a370d5cc207f7ce5836a783163a0090ba818cef742e5fda1406cfbf12
f6ecff617ec2ba7f559e6f535cad9b70a3f91120737535dab4d4548a6c83576c
f89d3f6dbf9cf96e559a28fbea3e19ec3d4960640b12b56c0e99085fb6bf3101