oficialmed.com.br Open in urlscan Pro
2a02:4780:13:918:0:3521:4d89:1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response oficialmed.com.br/libs/img/	2 KB 1 KB	1154ms 407ms	Document text/html	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / PHP/7.4.33 Resource Hash 849e50e9e7a8e26d8258de6370a706d29f3086a0791ad7976fd92ef48f7bd6ab Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-store, no-cache, must-revalidate content-encoding br content-length 973 content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Wed, 31 May 2023 08:48:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT platform hostinger pragma no-cache server LiteSpeed vary Accept-Encoding x-powered-by PHP/7.4.33
GET H2	200	geral.css oficialmed.com.br/libs/img/estilos/	16 KB 3 KB	222ms 213ms	Stylesheet text/css	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://oficialmed.com.br/libs/img/estilos/geral.css Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 914fb25975ddb496633e4b53df26233946f8332754ca01f10bbbfac082544d6d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:12 GMT content-encoding br content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:48 GMT server LiteSpeed etag "419f-64744080-2a7ce5ff33d0c87d;br" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 3189 expires Wed, 07 Jun 2023 08:48:12 GMT
GET H2	200	jquery.js Show response oficialmed.com.br/libs/img/javascripts/	68 KB 23 KB	433ms 425ms	Script application/x-javascript	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://oficialmed.com.br/libs/img/javascripts/jquery.js Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:12 GMT content-encoding br content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:56 GMT server LiteSpeed etag "1111d-64744088-d57793568f7a15a4;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 23394 expires Wed, 07 Jun 2023 08:48:12 GMT
GET H2	200	jquery.mask.js Show response oficialmed.com.br/libs/img/javascripts/	6 KB 3 KB	433ms 425ms	Script application/x-javascript	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://oficialmed.com.br/libs/img/javascripts/jquery.mask.js Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash 3b775d6e0b0f5cff98aca4daaa7f27a7c3678f39d1f5186776bb14b63cc2f625 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:12 GMT content-encoding br content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:56 GMT server LiteSpeed etag "18ae-64744088-661bd8b904b41dc0;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 2535 expires Wed, 07 Jun 2023 08:48:12 GMT
GET H2	200	geral.js Show response oficialmed.com.br/libs/img/javascripts/	10 KB 2 KB	434ms 426ms	Script application/x-javascript	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://oficialmed.com.br/libs/img/javascripts/geral.js Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash b955ecfae598c62ddd4231f782ff35f5c5778a52e5d5aca86ba244bba1bc0f17 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:12 GMT content-encoding br content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:55 GMT server LiteSpeed etag "2832-64744087-8006f4333b6635ed;br" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 2220 expires Wed, 07 Jun 2023 08:48:12 GMT
GET H2	200	css fonts.googleapis.com/	10 KB 1 KB	115ms 36ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900 Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash bbd133aaccc627dd11acf8545f051db9b1e00f4875ff6c7e89ab3509f9871ad3 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 31 May 2023 08:48:09 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 31 May 2023 07:23:27 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 31 May 2023 08:48:09 GMT
GET H2	200	logo.png oficialmed.com.br/libs/img/imagens/	6 KB 6 KB	211ms 208ms	Image image/png	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://oficialmed.com.br/libs/img/imagens/logo.png Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash d2b7c412dd38edb67d6f12575a6b9fd7e232f18d77be0c34b835e1579776dac9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/index.php?q=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&s=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp&n=keingxz9kein-ytgp-keinytgpytgp-m6ocytgp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:13 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:52 GMT server LiteSpeed etag "18c4-64744084-4525541ff46b19ca;;;" content-type image/png cache-control public, max-age=604800 accept-ranges bytes platform hostinger content-length 6340 expires Wed, 07 Jun 2023 08:48:13 GMT
GET H3	200	background_enter.jpg oficialmed.com.br/libs/img/imagens/	354 KB 355 KB	200ms 200ms	Image image/jpeg	2a02:4780:13:918:0:3521:4d89:1 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://oficialmed.com.br/libs/img/imagens/background_enter.jpg Requested by Host: oficialmed.com.br URL: https://oficialmed.com.br/libs/img/estilos/geral.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a02:4780:13:918:0:3521:4d89:1 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY), Reverse DNS Software LiteSpeed / Resource Hash aedb0e12d88580acdff4e05415de915b7291191cf35f5966fe7ce9aa34c1449c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language fr-FR,fr;q=0.9 Referer https://oficialmed.com.br/libs/img/estilos/geral.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Wed, 31 May 2023 08:48:13 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 29 May 2023 06:04:49 GMT server LiteSpeed etag "58915-64744081-ccd211713f5b2a3f;;;" content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes platform hostinger alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 362773 expires Wed, 07 Jun 2023 08:48:13 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	89ms 26ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://oficialmed.com.br accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Mon, 29 May 2023 09:26:38 GMT x-content-type-options nosniff age 170492 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 28 May 2024 09:26:38 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	91ms 31ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://oficialmed.com.br accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 21:03:36 GMT x-content-type-options nosniff age 301474 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 26 May 2024 21:03:36 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	121ms 61ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700,900 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://oficialmed.com.br accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 17:04:15 GMT x-content-type-options nosniff age 315835 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 26 May 2024 17:04:15 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| snd_img1 function| snd_img2 function| snd_img3 function| check_cc_frente function| check_doc_frente function| check_doc_verso function| send_form_1 function| send_form_2 function| send_form_3 function| check_docs function| check_pscc function| check_enter_cc function| get_payment function| op_indisponivel function| check_login function| SomenteNumero function| checkCard function| validarCPF function| remove function| getCreditCardLabel

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			oficialmed.com.br/	1969-12-31 23:59:59	Name: PHPSESSID Value: b0559489182fde6aa005106ed206071e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
oficialmed.com.br
2a00:1450:4001:812::2003
2a00:1450:4001:82f::200a
2a02:4780:13:918:0:3521:4d89:1
3b775d6e0b0f5cff98aca4daaa7f27a7c3678f39d1f5186776bb14b63cc2f625
849e50e9e7a8e26d8258de6370a706d29f3086a0791ad7976fd92ef48f7bd6ab
914fb25975ddb496633e4b53df26233946f8332754ca01f10bbbfac082544d6d
aedb0e12d88580acdff4e05415de915b7291191cf35f5966fe7ce9aa34c1449c
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b955ecfae598c62ddd4231f782ff35f5c5778a52e5d5aca86ba244bba1bc0f17
bbd133aaccc627dd11acf8545f051db9b1e00f4875ff6c7e89ab3509f9871ad3
d2b7c412dd38edb67d6f12575a6b9fd7e232f18d77be0c34b835e1579776dac9
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615