csgo-corona.fun
Open in
urlscan Pro
2606:4700:3035::681b:ab40
Malicious Activity!
Public Scan
Submission: On April 03 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 3rd 2020. Valid for: 6 months.
This is the only time csgo-corona.fun was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
15 | 2606:4700:303... 2606:4700:3035::681b:ab40 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:20:... 2606:4700:20::681a:84 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:5714 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 2.16.106.51 2.16.106.51 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 216.239.38.21 216.239.38.21 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
33 | 8 |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-51.deploy.static.akamaitechnologies.com
steamcommunity-a.akamaihd.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
csgo-corona.fun
csgo-corona.fun |
1013 KB |
12 |
akamaihd.net
steamcommunity-a.akamaihd.net |
669 KB |
1 |
gstatic.com
fonts.gstatic.com |
22 KB |
1 |
imgur.com
i.imgur.com |
1 MB |
1 |
ipinfo.io
ipinfo.io |
578 B |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net |
84 KB |
1 |
hellcase.com
hellcase.com |
|
33 | 8 |
Domain | Requested by | |
---|---|---|
15 | csgo-corona.fun |
csgo-corona.fun
ajax.googleapis.com |
12 | steamcommunity-a.akamaihd.net |
csgo-corona.fun
|
1 | fonts.gstatic.com |
csgo-corona.fun
|
1 | i.imgur.com |
csgo-corona.fun
|
1 | ipinfo.io |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
csgo-corona.fun
|
1 | cdn.jsdelivr.net |
csgo-corona.fun
|
1 | hellcase.com |
csgo-corona.fun
|
33 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
statcsgo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-04-03 - 2020-10-09 |
6 months | crt.sh |
hellcase.com CloudFlare Inc ECC CA-2 |
2019-08-28 - 2020-08-27 |
a year | crt.sh |
ssl363648.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2020-02-22 - 2020-08-30 |
6 months | crt.sh |
a248.e.akamai.net DigiCert Secure Site ECC CA-1 |
2019-08-13 - 2020-08-12 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
ipinfo.io GTS CA 1D2 |
2020-02-06 - 2020-05-06 |
3 months | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://csgo-corona.fun/
Frame ID: 847D92AE8D40B99A17A8DF7F9542FB74
Requests: 33 HTTP requests in this frame
Screenshot
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- script /(?:\/([\d.]+))?\/vue(?:\.min)?\.js/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: AGREED WITH USER AGREEMENT
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
csgo-corona.fun/ |
148 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
hellcase.com/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.12.4.min.js
csgo-corona.fun/Content/js/ |
139 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
csgo-corona.fun/Content/js/main.js/ |
109 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue/dist/ |
334 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
motiva_sans.css
steamcommunity-a.akamaihd.net/public/shared/css/ |
3 KB 1003 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shared_global.css
steamcommunity-a.akamaihd.net/public/shared/css/ |
69 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
friends.css
steamcommunity-a.akamaihd.net/public/css/webui/ |
800 KB 210 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpotLu8JAllx8zAaAJG6My3gL-GkvP9JrbummpD78A_27HCp9qi2Fawq... |
48 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJf1f_BYQJD_eOylY2KhPThIITZk2pH8fp9i_vG8ML0iQWy_... |
45 KB 46 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpotLu8JAllx8zJfAJF7dG7lb-PmOfkP77DqXtZ6dZ029bN_Iv9nGu4q... |
42 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJfx_LLZTRB7dCJh5C0g_bkNoTEhGlQ5vp5j-jX7LP5iUazr... |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJfw-bbeQJD_eOlgIWOm8j_PbLXk1RZ7cRnk9bN9J7yjRrk8... |
72 KB 73 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJf1ObcTi5S09i3hJCHksj4OrzZglRd6dd2j6eXoNv0jgLg_... |
44 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJf1ObcTi5S09i3hJCHksj5Nr_Yg2Zu5MRjjeyPot3zjQzi_... |
47 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJf1f_BYQJR_OOylZCbm_LLPr7Vn35c18lwmO7Eu4injgHlq... |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
360fx360f
steamcommunity-a.akamaihd.net/economy/image/-9a81dlWLwJ2UUGcVs_nsVtzdOEdtWwKGZZLQHTxDZ7I56KU0Zwwo4NUX4oFJZEHLbXH5ApeO4YmlhxYQknCRvCo04DEVlxkKgpovbSsLQJf3qr3czxb49KzgL-KmsjwPKvBmm5D19V5i_rEprP5gVO8v... |
49 KB 51 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
ipinfo.io/ |
674 B 578 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.gif
csgo-corona.fun/Content/img/ |
812 KB 813 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Mq6WbFx.png
i.imgur.com/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-login.html
csgo-corona.fun/img/ |
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
H2DMvhDLycM56KNuAtbJYA.woff2
fonts.gstatic.com/s/lato/v13/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.css
csgo-corona.fun/Content/css/ |
35 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
csgo-corona.fun/Content/js/ |
248 KB 63 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b1.png
csgo-corona.fun/Content/elmorn/ |
182 B 262 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b1_hover.png
csgo-corona.fun/Content/elmorn/ |
190 B 262 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b2.png
csgo-corona.fun/Content/elmorn/ |
198 B 271 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b2_hover.png
csgo-corona.fun/Content/elmorn/ |
206 B 277 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b3.png
csgo-corona.fun/Content/elmorn/ |
247 B 320 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b3_hover.png
csgo-corona.fun/Content/elmorn/ |
342 B 415 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https1.png
csgo-corona.fun/Content/elmorn/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https2.png
csgo-corona.fun/Content/elmorn/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| AC8Hf2iVOktmJ6HgOcBkp0fNn8135 object| sK1ENpDbX2OGJscPzgOTfmhz0758f function| $ function| jQuery object| _0x4c3a object| _0x7a74 object| _0xaba4 function| debug322 object| devtools object| _0x1325 object| _0xcc18 object| _0x2920 string| nYg5FdvOp7Gbw32hBvDfEv6s6U string| nYg5FdvOp7Gbw32hBvDfEv6s6U1 string| nYg5FdvOp7Gbw32hBvDfEv6s6U2 string| iuHy6d6Yhhdyh82hHgthjd29Uh8 object| d802933cfe4b2d8e6c8f157aa5fd4d29 object| a457cd30eb466b190b0cfb58480b293f object| rjfis3455 function| rjfis5345 function| Vue function| makeid string| language undefined| jQuery21109013806522434866_15859532514403 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
csgo-corona.fun/ | Name: ae80d0624ef2e943517e7246d0b83dde Value: 8102be90774865be9df78d00d54fac64 |
|
csgo-corona.fun/ | Name: 2ca460d36a5b98b8b388ed936bbfe407 Value: 8EBDH3IGt7 |
|
.csgo-corona.fun/ | Name: __cfduid Value: d1fdbdf6f83f6b9abb4d8d5aa90af61f71585953250 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.jsdelivr.net
csgo-corona.fun
fonts.gstatic.com
hellcase.com
i.imgur.com
ipinfo.io
steamcommunity-a.akamaihd.net
151.101.112.193
2.16.106.51
216.239.38.21
2606:4700:20::681a:84
2606:4700:3035::681b:ab40
2606:4700::6810:5714
2a00:1450:4001:814::2003
2a00:1450:4001:81d::200a
099baa3865b253513ad293b1265b38afd78b695b02bca4588da940bdd6d21f73
0dca534b3f0ce17f7b003b9869b0ffc79e974e59310eb6d3b51c02caa6b7c3eb
13a4b2e4c11b0528fb79ba21918b7dce33b04defbfde676c556c295732cf4c5b
1ba754db8a182e9848b30c1fa9dd447272415601c9bb20495081eb876be1e37f
1ed578ce4277b69c8c1220a3350090b07029420cab6849e914e8d7c5db64b81b
1f65c35ba697a5dca01a6a1f027985aeb3c4b2173db3c9cacfcf05d985996d9c
24b44c02f3951bf9f8705cee0141e776e12ea2c9b9380292cde5220b088f026f
2528281e51d4291266fdbd49b1c956ac751b325ea44874b62be984db46c7d13a
352baa818da109925437a8433057ddc6f91ec48efe88bc5741b2f9e34450fdce
44f8a56d427917b5fa0dd7933ba545679be5e6b3b93099e64a4e29c2159f57c0
47a03cdb40941ed9bb87178d34076aa70d7c8a21c2645d9a71e7edb02f94a4c2
4891538bccfe83292a5922a523a84f5e4f89d9a84192238fcb62598a17b2fb42
4b5599a8718cc6df8d6f042e7988b79746c5ee0e6434e72ca9923028cc90b759
5517f3b0d61890ed5ea17d8dd79c1c8ee22cc636d32f7a9f7748d0ed9705d7ae
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
593337618021dbf439e0293661b1ddafeb22aacd9f848424f554e71b182566d9
67e918bb61fc6c3027ad332a4dfb23aee39eb71f18ba4febb57525a3eb18645a
6a3245575841f0be7fa7547404d627799af384ae5c46559b0d52adf7ffdded04
7af864e281fce273fd0e381d034d796f85db9d4a1ce9df518900979186e2a846
7e3f74a3e576347bd791b13f4fcb4a339f6ce163a3783e54d76f4afce66143e2
805bf80e5f90e9f5700846b29ead135b8931d242d1b54c46cc83c8c0d3b5b7cd
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
9d78282fc9dff39581f92b71ddb3b6233760330aba4a6baaa4635edac78a2a47
a16f5f3ae3f6fdc9af203b7778208215c834bf14d439701c72d0a5323390c257
b38e565cd440ad95e72c0661d2ae7e750aac64910d440d0c74f043be9419e297
d987006c1dd501553e67b8377bca2efe665f6dd0d0d8e8884e6c1199ded43f19
de98d3e4f83cf8b188db1f176a595d965d1cbd76b4e4458721f3453710cad3e9
e0e8c3f32872eabfe3c405c13ea5c463339188212ecea1d9660b735c1a1af16e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2feac559dac6b7a9cfe7631c04a85deac49a1b022bf7b1bce3f1a8e21f3b762
f357c6f62b6a3d86c15ab0c5d31d7695a77b7882a26f42a0b5399c1f0901c1e9
f7616847e31b18c88a9225dfdbc38bcfd079302f3a6e68cc9f31b0a5a34b1b27