google-qpm.xyz
Open in
urlscan Pro
2606:4700:3032::6815:278c
Malicious Activity!
Public Scan
Effective URL: https://google-qpm.xyz/?id=s7
Submission: On November 11 via api from US — Scanned from US
Summary
TLS certificate: Issued by WE1 on November 8th 2024. Valid for: 3 months.
This is the only time google-qpm.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3032::6815:278c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 2606:4700:303... 2606:4700:3037::6815:2a35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 52.95.177.0 52.95.177.0 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c06::84 | 15169 (GOOGLE) (GOOGLE) | |
5 | 2607:f8b0:400... 2607:f8b0:4004:c21::5e | 15169 (GOOGLE) (GOOGLE) | |
8 | 2607:f8b0:400... 2607:f8b0:4004:c09::77 | 15169 (GOOGLE) (GOOGLE) | |
2 | 240e:cf:8800:... 240e:cf:8800:53:3::7ea | 134238 (CT-JIANGX...) (CT-JIANGXI-IDC CHINANET Jiangx province IDC network) | |
1 | 2409:8c20:5c6... 2409:8c20:5c64:2000::5 | 56046 (CMNET-JIA...) (CMNET-JIANGSU-AP China Mobile communications corporation) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c08::5e | 15169 (GOOGLE) (GOOGLE) | |
46 | 9 |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.ap-southeast-3.amazonaws.com
appdv76.s3.ap-southeast-3.amazonaws.com |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
ASN15169 (GOOGLE, US)
play-lh.googleusercontent.com |
ASN134238 (CT-JIANGXI-IDC CHINANET Jiangx province IDC network, CN)
s4.cnzz.com | |
c.cnzz.com |
ASN56046 (CMNET-JIANGSU-AP China Mobile communications corporation, CN)
z3.cnzz.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
vofzhq.com
www.vofzhq.com |
22 MB |
9 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 47 play-lh.googleusercontent.com — Cisco Umbrella Rank: 573 |
6 KB |
6 |
gstatic.com
fonts.gstatic.com www.gstatic.com |
442 KB |
3 |
cnzz.com
s4.cnzz.com — Cisco Umbrella Rank: 136451 z3.cnzz.com — Cisco Umbrella Rank: 241732 c.cnzz.com — Cisco Umbrella Rank: 101023 |
12 KB |
2 |
amazonaws.com
appdv76.s3.ap-southeast-3.amazonaws.com |
10 KB |
1 |
google-qpm.xyz
google-qpm.xyz |
321 KB |
46 | 6 |
Domain | Requested by | |
---|---|---|
25 | www.vofzhq.com |
google-qpm.xyz
|
8 | play-lh.googleusercontent.com |
google-qpm.xyz
|
5 | fonts.gstatic.com |
www.vofzhq.com
|
2 | appdv76.s3.ap-southeast-3.amazonaws.com |
google-qpm.xyz
|
1 | www.gstatic.com | |
1 | c.cnzz.com |
s4.cnzz.com
|
1 | z3.cnzz.com |
s4.cnzz.com
|
1 | s4.cnzz.com |
google-qpm.xyz
|
1 | lh3.googleusercontent.com |
google-qpm.xyz
|
1 | google-qpm.xyz | |
46 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
google-qpm.xyz WE1 |
2024-11-08 - 2025-02-06 |
3 months | crt.sh |
vofzhq.com WE1 |
2024-10-19 - 2025-01-17 |
3 months | crt.sh |
*.s3.ap-southeast-3.amazonaws.com Amazon RSA 2048 M01 |
2024-10-20 - 2025-09-30 |
a year | crt.sh |
*.googleusercontent.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
edgestatic.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
*.cnzz.com GlobalSign Organization Validation CA - SHA256 - G3 |
2024-02-17 - 2025-03-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://google-qpm.xyz/?id=s7
Frame ID: F3E982996EC2B3063F0A9A70D21C74B0
Requests: 46 HTTP requests in this frame
Screenshot
Page Title
7276 – Apps on Google PlayPage URL History Show full URLs
-
http://google-qpm.xyz/?id=s7
HTTP 307
https://google-qpm.xyz/?id=s7 Page URL
Detected technologies
Clipboard.js (Miscellaneous) ExpandDetected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://google-qpm.xyz/?id=s7
HTTP 307
https://google-qpm.xyz/?id=s7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
46 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
google-qpm.xyz/ Redirect Chain
|
699 KB 321 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
www.vofzhq.com/resource/save12/assets/css/ |
658 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
clipboard.min.js
www.vofzhq.com/resource/save12/assets/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qrcode.min.js
www.vofzhq.com/resource/save12/assets/js/ |
19 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
import-scripts.js
appdv76.s3.ap-southeast-3.amazonaws.com/adjust/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ACg8ocIViwTDhpGxCyQsQwqTKli-MfAWlNQcq6b_czIEjrBAFA=s32-c-k-cc-mo
lh3.googleusercontent.com/a/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4UaRrENHsxJlGDuGo1OIlJfC6mGS6vhAK1YobMu2vgCI.woff2
fonts.gstatic.com/s/googlesans/v29/ |
24 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Gw6kwdfw6UnXLJCcmafZyFRXb3BL9rvi0QZG3Q.woff2
fonts.gstatic.com/s/googlematerialicons/v137/ |
227 KB 227 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_KiRouu_G6J_2jwePzQ_i5_FMc_SVKT3mI7d7KKq9zca-Nr8bj2bPasawLvk6ajzASQS-90a8hYXeAh0lQ=w96-h32-rw
play-lh.googleusercontent.com/ |
222 B 521 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-1.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-2.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-3.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-4.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-5.png
www.vofzhq.com/resource/save12/assets/image/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iFstqoxDElUVv4T3KxkxP3OTcuFvWF5ZQQjT7aIxy4n2uaVigCCykxeG6EZV9FQ10X1itPj1oORm=s20-rw
play-lh.googleusercontent.com/ |
200 B 259 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
12USW7aflgz466ifDehKTnMoAep_VHxDmKJ6jEBoDZWCSefOC-ThRX14Mqe0r8KF9XCzrpMqJts=s20-rw
play-lh.googleusercontent.com/ |
244 B 307 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
W5DPtvB8Fhmkn5LbFZki_OHL3ZI1Rdc-AFul19UK4f7np2NMjLE5QquD6H0HAeEJ977u3WH4yaQ=s20-rw
play-lh.googleusercontent.com/ |
200 B 289 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ohRyQRA9rNfhp7xLW0MtW1soD8SEX45Oec7MyH3FaxtukWUG_6GKVpvh3JiugzryLi7Bia02HPw=s20-rw
play-lh.googleusercontent.com/ |
164 B 227 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvJ.woff2
fonts.gstatic.com/s/materialiconsextended/v149/ |
159 KB 159 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ALV-UjV_vZlNPeSM8EdEYzgKxLHGyLIFmXLJDagbIrmNlEZzDA=s32-rw
play-lh.googleusercontent.com/a-/ |
454 B 531 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ACg8ocJmEhycReUrpF1BW4XaKBAC8HxR6QECHaiw1oA42jSD=s32-rw-mo
play-lh.googleusercontent.com/a/ |
302 B 377 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ALV-UjVMwRXok34XAALEWtNe_yinuUDme1ecfXKMbhzsc1a8=s64-rw
play-lh.googleusercontent.com/a-/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
indonesia.png
www.vofzhq.com/resource/save12/assets/image/ |
192 B 846 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
www.vofzhq.com/resource/save12/assets/js/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb7276.js
appdv76.s3.ap-southeast-3.amazonaws.com/download-app/ |
191 B 613 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fbti-advertise.v1.10.27.6.js
www.vofzhq.com/resource/common/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
servers.js
www.vofzhq.com/resource/common/ |
477 B 925 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
06-targetInstall.js
www.vofzhq.com/resource/common/ |
463 B 999 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
z.js
s4.cnzz.com/ |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7.png
www.vofzhq.com//resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-1.png
www.vofzhq.com//resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-2.png
www.vofzhq.com//resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-3.png
www.vofzhq.com//resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-4.png
www.vofzhq.com//resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s7-5.png
www.vofzhq.com//resource/save12/assets/image/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s1.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s2.png
www.vofzhq.com/resource/save12/assets/image/ |
798 KB 798 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s3.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s4.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s5.png
www.vofzhq.com/resource/save12/assets/image/ |
959 KB 959 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s6.png
www.vofzhq.com/resource/save12/assets/image/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
stat.htm
z3.cnzz.com/ |
2 B 123 B |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c.js
c.cnzz.com/ |
906 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon_v3.ico
www.gstatic.com/android/market_images/web/ |
4 KB 866 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| ClipboardJS function| QRCode object| urlParams function| similarGamesClick object| _czc object| downloadLink function| copyText object| servers string| apklink string| ioslink object| data object| _cz_loaded string| _cz_account object| _CNZZDbridge_12813374202 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.google-qpm.xyz/ | Name: UM_distinctid Value: 19319d5c2252db-0473bc492e89e9-17462c6e-1d4c00-19319d5c226d1 |
|
google-qpm.xyz/ | Name: CNZZDATA1281337420 Value: 1427196431-1731305260-%7C1731305260 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
appdv76.s3.ap-southeast-3.amazonaws.com
c.cnzz.com
fonts.gstatic.com
google-qpm.xyz
lh3.googleusercontent.com
play-lh.googleusercontent.com
s4.cnzz.com
www.gstatic.com
www.vofzhq.com
z3.cnzz.com
2409:8c20:5c64:2000::5
240e:cf:8800:53:3::7ea
2606:4700:3032::6815:278c
2606:4700:3037::6815:2a35
2607:f8b0:4004:c06::84
2607:f8b0:4004:c08::5e
2607:f8b0:4004:c09::77
2607:f8b0:4004:c21::5e
52.95.177.0
0d6c0f25b9c430100e7803868cf85c71bc2891d1d0ca66254404b9fb0eaa46e1
1899a841d86f48016031006062751e6fe16b1761b7f6a10df87c534d5e07f480
1b5ee6050597da17ef7b52fdb5cc1b0774e02b43a26decff105058829150b566
1ce1470cb40d5dfbef2dbe66f7464951029d4a7e0ff13195681af931fd4a2717
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2a6f5e2046caa772b90a394704f692b794c42c9e54f8a2aee713218d1be16670
2e3b557647e1f5656fbda70233ff1a292f49877847bd2ee59dc1b8674092cb0c
329ad3c7ac436f964c7a8cfcc6a74c859b51cdabd8974a65f0836410b11f2dc5
3575ac0087b76854e36690ae29a45b5c0cefdf6a0a9de6e38516a0fddfc08689
36e292c656dfc39b7b93f5ac7190641df28f3408ee93fe1edd01d49776f3fec4
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4ca6122030dea2d2e66cde8f69cc201e27169e9d96380e736e9224c9e320a4f6
4e40caec07450755166c40ba51099f2807b4b2efc3d6252f59d26bc0be325e9e
4fa2af63b6e4f64d8cd88261bf024d37508989058bdda3626c605f3ab1cd556a
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
6cd9fdd3b8fdb2df17d4d09fb17006c8eb39a3df753d04d541472a4c8e708284
713b3e348807bb868088ddb77ae4eb8ab8c379fb74db0927c68dc2d13abe96e2
7163ed07fc099c1d8eb7ad4ea82ab3ac04b9062613a22e0a6b9f9f9943383118
756a1b499398b76c97d37d91b7350ce0e7332b36cfb1a6a505c7ca6937a5da6b
7bd4b121beb0944b91d1d56897d785ed7f0f87cb0f05d090c6f78952f506e565
7f80c4c91054b3d6c80721939242c2d4f68f15e41f251e12641f695d78eb2f35
829c7590400a8379cbf6a495409c0870b63adf848a7e06bbab690f005e5941ae
857726437435447dd7f9970ac0ddf672c69889f1e3c087b1d84f009cf1edeeba
89b9444fa3a554de0694fc69ea67ea030af61f4f65dfd6e741f573bca8133b94
8c66b3cb207515328ac21bdbbda1b90a74d7cac66267352048bfd7e4e1efe627
9a0782a9b3c97cbe256803fd198d86427e2b1b40b85c93bc3a8e34a1be6d37bf
9f70e3c2c02e408381d133d8ca95db7fd92c153d7303cd9c5f727b742f0e9ad4
a4ceb917e6fd8bff1a6e90fb001c5feea2f1b6a386f821431af448eb64f2209a
ad3cdec003769d4cbd315cea2101de3254d8b7415b7809b03d0c4186e9f6df16
b663eefc2573840ef8bf69844bdda7b37da2b1d116f4fac6c05baa941bd414d6
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
caeddda7eda7f1e46ca3158f3aee127ac02e60a9e414d0eaa4ba169d0173a4c6
d00f8f8d12d95cf71a1cdf36ea7e8e01f661a98cfd9486a996cd11eaae20f8db
d16ced5c8c5083cda8d752e3fe55b5b57ef459d0e1ee60c88e688ce03fdbfe8b
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
ddead68641b4994eb750365cd1012393abc56596cc37235063351b78d17e6061
de88165fa4d58b4ad531b6f8d8facbc5dc00f73e96b617e503d36fee29c53cec
e42529e3ee6dfd5039a3b676c4c6c9c78fcdc284c84562a12d15b18ba96302af
f2582ba55ec07d7ae8bfe3ee0b769103e8870156ad832faf74324d1ec75355d1
f343b3015d0545a7d5b719a434135bcae2ac766ed459aeea671e3688b79d1875