login.liaj728093677279898.ankura.us Open in urlscan Pro
20.125.119.255  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request msf Show response login.liaj728093677279898.ankura.us/828763/v2.0/	12 KB 13 KB	239ms 73ms	Document text/html	20.125.119.255 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.liaj728093677279898.ankura.us/828763/v2.0/msf Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.125.119.255 Phoenix, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash fcc803e2afc303283cd05930e0399920f8b4d3a7194d284694de2e992275ed4c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Connection close Content-Type text/html Transfer-Encoding chunked
GET H2	200	api.js Show response js.hcaptcha.com/1/	281 KB 79 KB	104ms 36ms	Script application/javascript	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hcaptcha.com/1/api.js Requested by Host: login.liaj728093677279898.ankura.us URL: https://login.liaj728093677279898.ankura.us/828763/v2.0/msf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c1bcc3d6ffd4b7e9424b0173ba0c2e1dc84db9ea5240a6dea8f69cc2d86249c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://login.liaj728093677279898.ankura.us/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:49 GMT via 1.1 58797424624b1a38915832c8306b47c2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 0 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag W/"84729783ded6e9166650d2e40d1556b2" vary Accept-Encoding content-type application/javascript cache-control max-age=120 x-amz-cf-pop ORD56-P5 cf-ray 74d9eaa35aa12c24-ORD x-amz-cf-id 2OfesOQxPx6_QEB6iwQQGys-N-_EW4sD348XYoAPy4kSLD9IZ9TDBQ==
GET H2	200	jquery.slim.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/	68 KB 22 KB	92ms 35ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.slim.min.js Requested by Host: login.liaj728093677279898.ankura.us URL: https://login.liaj728093677279898.ankura.us/828763/v2.0/msf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://login.liaj728093677279898.ankura.us/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:49 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 476982 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 21580 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-10fdd" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4kVSlnKMDOF0M7hE2dRdriIZhDVJR1xq0hWtxtWJobJ7VY9mPP48kz9XyUXcqcQvxuTvMvS0khAQJ%2BKVztkCzDgy7r%2FDw3kyaVH4UX51wGcgDrQ%2BUb9m4rhGYEw5HZtOIqNPYKNoa6YdVSoh26a2H8Gj"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 74d9eaa34d58e1ca-ORD expires Sun, 10 Sep 2023 10:35:49 GMT
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame 2FAB	2 KB 901 B	47ms 34ms	Document text/html	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Requested by Host: js.hcaptcha.com URL: https://js.hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://login.liaj728093677279898.ankura.us/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * age 35601 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 74d9eaa40b492c24-ORD content-encoding gzip content-type text/html date Tue, 20 Sep 2022 10:35:49 GMT last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 144b3a00ce38cccd2bd9b588cccb51d2.cloudfront.net (CloudFront) x-amz-cf-id -LfrLbnh9Xz3EEpl1xmpXIXLVHYIZyes6b-f-nHXlFvF4A64qVUMrg== x-amz-cf-pop ORD56-P5 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.html Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame 2C67	2 KB 1014 B	44ms 32ms	Document text/html	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Requested by Host: js.hcaptcha.com URL: https://js.hcaptcha.com/1/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://login.liaj728093677279898.ankura.us/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * age 35601 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=1209600 cf-cache-status HIT cf-ray 74d9eaa40b472c24-ORD content-encoding gzip content-type text/html date Tue, 20 Sep 2022 10:35:49 GMT last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via 1.1 144b3a00ce38cccd2bd9b588cccb51d2.cloudfront.net (CloudFront) x-amz-cf-id -LfrLbnh9Xz3EEpl1xmpXIXLVHYIZyes6b-f-nHXlFvF4A64qVUMrg== x-amz-cf-pop ORD56-P5 x-cache Hit from cloudfront x-content-type-options nosniff
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame 2C67	281 KB 79 KB	40ms 40ms	Script application/javascript	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:49 GMT via 1.1 58797424624b1a38915832c8306b47c2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 50436 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag W/"84729783ded6e9166650d2e40d1556b2" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 x-amz-cf-pop ORD56-P5 cf-ray 74d9eaa46bed2c24-ORD x-amz-cf-id 2OfesOQxPx6_QEB6iwQQGys-N-_EW4sD348XYoAPy4kSLD9IZ9TDBQ==
GET H2	200	hcaptcha.js Show response newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame 2FAB	281 KB 79 KB	42ms 42ms	Script application/javascript	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html Origin https://newassets.hcaptcha.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:49 GMT via 1.1 58797424624b1a38915832c8306b47c2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 50436 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Thu, 11 Aug 2022 21:59:15 GMT server cloudflare etag W/"84729783ded6e9166650d2e40d1556b2" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 x-amz-cf-pop ORD56-P5 cf-ray 74d9eaa46bee2c24-ORD x-amz-cf-id 2OfesOQxPx6_QEB6iwQQGys-N-_EW4sD348XYoAPy4kSLD9IZ9TDBQ==
GET DATA	200 OK	truncated / Frame 2C67	798 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/png
POST H2	200	checksiteconfig Show response hcaptcha.com/ Frame 2C67	543 B 819 B	68ms 56ms	XHR application/json	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hcaptcha.com/checksiteconfig?v=1f7dc62&host=login.liaj728093677279898.ankura.us&sitekey=44c7bfed-9343-4950-9d6f-9d1e4b3cba3f&sc=1&swa=1 Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 28ff9b4ed6be12d366d0309f7a6a6891c7c8161440caf31321d1b3feeecfaa0b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json Referer https://newassets.hcaptcha.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Content-Type text/plain Response headers date Tue, 20 Sep 2022 10:35:50 GMT content-encoding gzip x-content-type-options nosniff server cloudflare access-control-allow-headers Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path cf-chl-bypass 2 vary Origin, Accept-Encoding access-control-allow-methods GET, HEAD, POST, OPTIONS content-type application/json access-control-allow-origin https://newassets.hcaptcha.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 74d9eaa58d552c24-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	hsw.js Show response newassets.hcaptcha.com/c/b08e4c82/ Frame 2FAB	956 KB 358 KB	43ms 42ms	Script application/javascript	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/c/b08e4c82/hsw.js Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/hcaptcha.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ffef3f2e9efc1e758bb019d82ed23650cdead9f383f263f38e77c9b98dcd805 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:50 GMT via 1.1 239586e235dea76c82c73514f5e82d28.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 169 x-cache Hit from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Tue, 20 Sep 2022 07:51:10 GMT server cloudflare etag W/"84bdb7bd52960277ec334157278a2667" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=1209600 x-amz-cf-pop ORD56-P5 cf-ray 74d9eaa5ef16634a-ORD x-amz-cf-id 2AOIx_MBChWLvIj3Y49IPCWgA8lu0rz1DHZpq2_GCgXKbdQdtd5gjg==
GET H3	200	e Show response newassets.hcaptcha.com/i/d5ef5ba/ Frame 2FAB	113 KB 114 KB	33ms 33ms	Fetch application/octet-stream	104.16.169.131 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://newassets.hcaptcha.com/i/d5ef5ba/e Requested by Host: newassets.hcaptcha.com URL: https://newassets.hcaptcha.com/c/b08e4c82/hsw.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1b88f429e0878e43e76be34e0dba0debe8b60a4883851de1645f0e57456d21e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Tue, 20 Sep 2022 10:35:50 GMT via 1.1 841dfa6074cf4b3b0718988f088a4ac2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT age 1200072 x-cache Miss from cloudfront strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 115920 last-modified Fri, 02 Sep 2022 07:03:20 GMT server cloudflare etag "ce885833508f58ddc1f45b0d115561ea" vary Accept-Encoding content-type application/octet-stream access-control-allow-origin * cache-control max-age=1209600 x-amz-cf-pop IAD89-C1 accept-ranges bytes cf-ray 74d9eaa849e4634a-ORD x-amz-cf-id uyu0DuRFQriDHpIEs_lsdULqroQKfJHCOENJ_oErVxV8SlOugbrP-A==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery string| ai number| ind string| my_slice string| c string| final string| finalu undefined| my_email function| onSuccess string| my_email64 object| Raven object| hcaptcha object| grecaptcha

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.liaj728093677279898.ankura.us/	1970-01-20 06:07:53	Name: wVIV Value: ca0612bf20189a1118a575e404b454014e9826abe3ebe26ba804f50d18e8f4de

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html#frame=challenge&id=0za5kokrhixq&host=login.liaj728093677279898.ankura.us&sentry=true&reportapi=https%3A%2F%2Faccounts.hcaptcha.com&recaptchacompat=true&custom=false&hl=en&tplinks=on&sitekey=44c7bfed-9343-4950-9d6f-9d1e4b3cba3f&theme=light Message: [.WebGL-0x47000a0f100]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
hcaptcha.com
js.hcaptcha.com
login.liaj728093677279898.ankura.us
newassets.hcaptcha.com
104.16.169.131
20.125.119.255
2606:4700::6811:190e
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
28ff9b4ed6be12d366d0309f7a6a6891c7c8161440caf31321d1b3feeecfaa0b
4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9ffef3f2e9efc1e758bb019d82ed23650cdead9f383f263f38e77c9b98dcd805
c1bcc3d6ffd4b7e9424b0173ba0c2e1dc84db9ea5240a6dea8f69cc2d86249c9
f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21
f1b88f429e0878e43e76be34e0dba0debe8b60a4883851de1645f0e57456d21e
fcc803e2afc303283cd05930e0399920f8b4d3a7194d284694de2e992275ed4c