bigprizefx.com
Open in
urlscan Pro
2606:4700:3032::6818:6df4
Malicious Activity!
Public Scan
Effective URL: https://bigprizefx.com/sb1/?city=Islington&brand=Desktop&model=Desktop&isp=Venus%20Business%20Communications%20Limited&...
Submission: On March 29 via api from BE
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on July 10th 2019. Valid for: a year.
This is the only time bigprizefx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3030::681b:a0c7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3035::681f:4791 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 52.72.49.79 52.72.49.79 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 2 | 191.101.164.106 191.101.164.106 | 61317 (ASDETUK h...) (ASDETUK http://www.heficed.com) | |
1 1 | 52.29.223.183 52.29.223.183 | 16509 (AMAZON-02) (AMAZON-02) | |
27 | 2606:4700:303... 2606:4700:3032::6818:6df4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:f48:2000... 2a00:f48:2000:1023::3 | 47447 (TTM) (TTM) | |
1 | 193.70.47.201 193.70.47.201 | 16276 (OVH) (OVH) | |
3 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
34 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-49-79.compute-1.amazonaws.com
t.clkitgo.com |
ASN61317 (ASDETUK http://www.heficed.com, GB)
go.strionmi.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-223-183.eu-central-1.compute.amazonaws.com
track.duvallo.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
bigprizefx.com
bigprizefx.com |
1 MB |
3 |
gstatic.com
fonts.gstatic.com |
72 KB |
2 |
perpello.io
cdn.perpello.io api.perpello.io |
3 KB |
2 |
strionmi.com
1 redirects
go.strionmi.com |
887 B |
1 |
duvallo.com
1 redirects
track.duvallo.com |
2 KB |
1 |
clkitgo.com
1 redirects
t.clkitgo.com |
299 B |
1 |
lnkit.club
www.lnkit.club |
1 KB |
1 |
lnkclik.com
1 redirects
lnkclik.com |
608 B |
34 | 8 |
Domain | Requested by | |
---|---|---|
27 | bigprizefx.com |
go.strionmi.com
bigprizefx.com |
3 | fonts.gstatic.com |
bigprizefx.com
|
2 | go.strionmi.com | 1 redirects |
1 | api.perpello.io |
cdn.perpello.io
|
1 | cdn.perpello.io |
bigprizefx.com
|
1 | track.duvallo.com | 1 redirects |
1 | t.clkitgo.com | 1 redirects |
1 | www.lnkit.club | |
1 | lnkclik.com | 1 redirects |
34 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
track.duvallo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-01-30 - 2020-10-09 |
8 months | crt.sh |
cdn.perpello.io Let's Encrypt Authority X3 |
2020-03-23 - 2020-06-21 |
3 months | crt.sh |
api.perpello.io Let's Encrypt Authority X3 |
2020-02-17 - 2020-05-17 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bigprizefx.com/sb1/?city=Islington&brand=Desktop&model=Desktop&isp=Venus%20Business%20Communications%20Limited®ion=Islington&td=track.duvallo.com&browser=Chrome&cep=8y0tmSAUrAzJajj_cCqm9clMBvK1dxRdnXec3J6Mh9FSWcsBR-g5WNfqys4HvhsARXaraJp-t6MpAqRSVneWXHLrrd5aWOB7xDFhlsHc0EyY5xwEyoGUwyxXuwaVgFb0SOTCGnYAzbLlDPSR2o1HnUVdpH9KpU3nTdvR4i2ClgIGtMkUpg2ruopbdPnt-hKCR7xoF9yp55PrS0ZObWyJh5sAUzSFnKERwF-A-ZW2liDaIBblgH2-ARKlNeIBACkofVbdDT1vyZxyXnSiQouUz9mu0cpdY1S-KmPlsEOpXFARGTJ8T8UUm9t_rzZcidy_ve194bQtiddZigza_qRRFI9WHlHlQdGob-WYHK2HwPm3db8_gLAgiS6w3ukJcN_qJ3cxvrOYb9V0wJMEdtda3UFNNs8ULbvsMCOpUH3pmdwBKZL1XjAMNcJt5buiVz2lprkCyCt-f12cvprNxN5yqscOMrw8UimipnpPkQlL92sImFiC_YE5c7CcAV2p5tRRY8Lnu13QerpC74z_2nez4g&lptoken=156685c9493b53bd1154&category=&keyword=&sid=ts3219-international-general&cid=38951&target=ts3219-international-general&offer=%7Boffer%7D&cpv=0.1&clickid=1585493511.63-92451887-38951
Frame ID: 38F27BD9845FE1CAD17130FFCC71E833
Requests: 34 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://lnkclik.com/8F2c
HTTP 301
https://www.lnkit.club/go.php?camp=29961&pub=178767&sid= Page URL
-
https://t.clkitgo.com/clk?thru=178767
HTTP 301
http://go.strionmi.com/ts3219-international-general?thru=178767 Page URL
-
http://go.strionmi.com/match-5347/38951/92451887/1585493511/mf_3c102163-6e45-4223-9fc2-a925a879b090...
HTTP 302
https://track.duvallo.com/3cc1f716-f3ab-4f74-aa3a-e17b97d653cd?category=&keyword=&sid=ts3219-internati... HTTP 302
https://bigprizefx.com/sb1/?city=Islington&brand=Desktop&model=Desktop&isp=Venus%20Business%20Commu... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://lnkclik.com/8F2c
HTTP 301
https://www.lnkit.club/go.php?camp=29961&pub=178767&sid= Page URL
-
https://t.clkitgo.com/clk?thru=178767
HTTP 301
http://go.strionmi.com/ts3219-international-general?thru=178767 Page URL
-
http://go.strionmi.com/match-5347/38951/92451887/1585493511/mf_3c102163-6e45-4223-9fc2-a925a879b090/dHMzMjE5LWludGVybmF0aW9uYWwtZ2VuZXJhbA==/?thru=178767
HTTP 302
https://track.duvallo.com/3cc1f716-f3ab-4f74-aa3a-e17b97d653cd?category=&keyword=&sid=ts3219-international-general&cid=38951&target=ts3219-international-general&offer={offer}&cpv=0.1&clickid=1585493511.63-92451887-38951 HTTP 302
https://bigprizefx.com/sb1/?city=Islington&brand=Desktop&model=Desktop&isp=Venus%20Business%20Communications%20Limited®ion=Islington&td=track.duvallo.com&browser=Chrome&cep=8y0tmSAUrAzJajj_cCqm9clMBvK1dxRdnXec3J6Mh9FSWcsBR-g5WNfqys4HvhsARXaraJp-t6MpAqRSVneWXHLrrd5aWOB7xDFhlsHc0EyY5xwEyoGUwyxXuwaVgFb0SOTCGnYAzbLlDPSR2o1HnUVdpH9KpU3nTdvR4i2ClgIGtMkUpg2ruopbdPnt-hKCR7xoF9yp55PrS0ZObWyJh5sAUzSFnKERwF-A-ZW2liDaIBblgH2-ARKlNeIBACkofVbdDT1vyZxyXnSiQouUz9mu0cpdY1S-KmPlsEOpXFARGTJ8T8UUm9t_rzZcidy_ve194bQtiddZigza_qRRFI9WHlHlQdGob-WYHK2HwPm3db8_gLAgiS6w3ukJcN_qJ3cxvrOYb9V0wJMEdtda3UFNNs8ULbvsMCOpUH3pmdwBKZL1XjAMNcJt5buiVz2lprkCyCt-f12cvprNxN5yqscOMrw8UimipnpPkQlL92sImFiC_YE5c7CcAV2p5tRRY8Lnu13QerpC74z_2nez4g&lptoken=156685c9493b53bd1154&category=&keyword=&sid=ts3219-international-general&cid=38951&target=ts3219-international-general&offer=%7Boffer%7D&cpv=0.1&clickid=1585493511.63-92451887-38951 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://lnkclik.com/8F2c HTTP 301
- https://www.lnkit.club/go.php?camp=29961&pub=178767&sid=
- https://t.clkitgo.com/clk?thru=178767 HTTP 301
- http://go.strionmi.com/ts3219-international-general?thru=178767
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
go.php
www.lnkit.club/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ts3219-international-general
go.strionmi.com/ Redirect Chain
|
443 B 528 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
bigprizefx.com/sb1/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
perpello.js
cdn.perpello.io/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
bigprizefx.com/sb1/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ml.css
bigprizefx.com/sb1/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
bigprizefx.com/sb1/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
coupon2.png
bigprizefx.com/sb1/ |
64 KB 64 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
winners.jpg
bigprizefx.com/sb1/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
21.jpg
bigprizefx.com/sb1/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2
bigprizefx.com/sb1/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
bigprizefx.com/sb1/ |
918 B 303 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
api.perpello.io/log/ |
3 B 171 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-icon-fb.png
bigprizefx.com/sb1/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-icon-tw.png
bigprizefx.com/sb1/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.jpg
bigprizefx.com/sb1/ |
582 KB 583 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
coupon.png
bigprizefx.com/sb1/ |
605 KB 606 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.png
bigprizefx.com/sb1/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
bigprizefx.com/sb1/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like.png
bigprizefx.com/sb1/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.jpg
bigprizefx.com/sb1/ |
875 B 981 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_c5H3gnD-w.ttf
fonts.gstatic.com/s/montserrat/v13/ |
46 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhzg.ttf
fonts.gstatic.com/s/montserrat/v13/ |
45 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_bZF3gnD-w.ttf
fonts.gstatic.com/s/montserrat/v13/ |
46 KB 24 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.jpg
bigprizefx.com/sb1/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.jpg
bigprizefx.com/sb1/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.jpg
bigprizefx.com/sb1/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.jpg
bigprizefx.com/sb1/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.jpg
bigprizefx.com/sb1/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.jpg
bigprizefx.com/sb1/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9.jpg
bigprizefx.com/sb1/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
10.jpg
bigprizefx.com/sb1/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11.jpg
bigprizefx.com/sb1/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2
bigprizefx.com/sb1/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Perpello function| $ function| jQuery function| getUrlParameter string| city function| getURLParameter object| dayNames object| monthNames object| now string| today function| get_date function| funcc1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.bigprizefx.com/ | Name: __cfduid Value: d939b9998c136d9323d44c06bbf2d8e481585493512 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.perpello.io
bigprizefx.com
cdn.perpello.io
fonts.gstatic.com
go.strionmi.com
lnkclik.com
t.clkitgo.com
track.duvallo.com
www.lnkit.club
191.101.164.106
193.70.47.201
2606:4700:3030::681b:a0c7
2606:4700:3032::6818:6df4
2606:4700:3035::681f:4791
2a00:1450:4001:80b::2003
2a00:f48:2000:1023::3
52.29.223.183
52.72.49.79
07ae7cf9c7f3bfc4bc63842bb07e5846837c0071f8d96042de9d0f4a3cc997b6
0e4c3d99efa3b2c5bc62e7e9775f6df76aedb4439717f62dea63e33855dfac92
0f7476367287cf4091b0ab6504a2dadc508a8f7dfe86970bc8435f9161b1229a
214d8ff702a247c2dedf773cd2ba0981095cfe5d9382ef9b9a576ae5c65b017b
32656fa09a39ed404af119d605b129a4fb669333b94598b16e7325a0820aec6c
3f4f746c80e27c660c9e6df3da619301ae93bb83793446892405d113ec28979f
44d2eeecf761994a1f02eb33d5e0242210b131e555821f89c09e88326e5cfb96
47d6a7f88459e04a04ea84cb47dc42c63a31363686db768e5e18b2b65bce374f
4d52b2fa6c5c1f04781bd68da07c9e2d7002dd0c8cb79ff7604a7b11f6c3c0d2
56205168d373cb37b1870db837e74e2675593b7f930d00b2ff85c83bf886b484
64ef066211b7218254295043e0e7bffe0962943446af423f64752c80004b65b1
65221e0933b16cf0a0fb505b53c1d79cca42225504cd25f68f917ffc26b3d665
6ccec2a72904c3be965d43718371c6eca4f3e6f722e88671e732d3fb40fbb242
712ca3801cc4aebf31a69d4c7832e0b19c1271dab039592178c0b894737f2cc9
73cb358bf47ed149f8fd7e3eada678166cfab77538c313ba72cb6e38d13253fa
73e8432f31cf5d6e1ce0a0125008190b64a3bebc844e3c7599cec24e3eaa7434
7668b88d78338e99521a43c3d42ae2999fcba76b96a484dff191bf037ab1d177
8139e77d4ab5daf3abbc88977bea8dfb8b24fa1b13087ec6962b3fb425005b41
831e0371523bbe5d818f9037c53b9c0957f4aa48b415f28081d9168a1e7a390b
8e3e1a234b0682e2cdbf00177b41a9b7fba259619295113545b365ec83a2879a
8faa2373bb49912f7d74e626c6fa9cc959c1e75496accc6fa5658a67f0082b73
9860f4ce37af4594415edd7ff4b0a83d5fb72e9175cfd748e2254133a86cf17e
9b17d1bc53a49edcab5f29c232dde056d8ad18b6c948ad908134b64130eb2606
9d425d2ee401fde3ddf7481b9df7ce8f724b7e1f2166fedda4ba0e6a94da85f5
bef126b43617b05142dc3bc7f66a01821c7a8565bf26bb4ada6eda99e1ae2d61
bfb06b57f7a1feb8e51ab29aa757ba952ed36fc93f2446445aa2ad2fac96d444
c3ba4b8f1b708bf9fb64f6b530ffea5feb0ec53711ea00cd58ac7fa295e528ce
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d27231ecca08b0f7cad6b09b074eaa2a9e9ba54ee6fb01c9dc59a5052134f804
d59184d19acac5e205e0dd8dbead7cf1e39ed3dbc2eb0707fea809ff78d7e391
f550ef086bbf028f3d3435f5dfee182475ae509d4e6e2c3214b25f8c0881aa0b
fba1dafda080b2bf2c0074fc8eb29203c48f2afa916065df41a0a76e48f63987