cleddaufinancial.craftmenbuilderz.com
Open in
urlscan Pro
162.253.17.80
Malicious Activity!
Public Scan
Effective URL: https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565...
Submission: On May 31 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 31st 2019. Valid for: 3 months.
This is the only time cleddaufinancial.craftmenbuilderz.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.43.221.31 104.43.221.31 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
2 30 | 162.253.17.80 162.253.17.80 | 45352 (IPSERVERO...) (IPSERVERONE-AS-AP IP ServerOne Solutions Sdn Bhd) | |
1 | 2a00:1450:400... 2a00:1450:4001:819::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
3 | 2a00:1450:400... 2a00:1450:4001:808::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
32 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
securelinks9876567887654567566.azurewebsites.net |
ASN45352 (IPSERVERONE-AS-AP IP ServerOne Solutions Sdn Bhd, MY)
PTR: ns1.egenz.com
cleddaufinancial.craftmenbuilderz.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
30 |
craftmenbuilderz.com
2 redirects
cleddaufinancial.craftmenbuilderz.com |
1 MB |
3 |
gstatic.com
fonts.gstatic.com |
47 KB |
1 |
googleapis.com
fonts.googleapis.com |
667 B |
1 |
azurewebsites.net
1 redirects
securelinks9876567887654567566.azurewebsites.net |
476 B |
32 | 4 |
Domain | Requested by | |
---|---|---|
30 | cleddaufinancial.craftmenbuilderz.com |
2 redirects
cleddaufinancial.craftmenbuilderz.com
|
3 | fonts.gstatic.com |
cleddaufinancial.craftmenbuilderz.com
|
1 | fonts.googleapis.com |
cleddaufinancial.craftmenbuilderz.com
|
1 | securelinks9876567887654567566.azurewebsites.net | 1 redirects |
32 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cleddaufinancial.craftmenbuilderz.com Let's Encrypt Authority X3 |
2019-05-31 - 2019-08-29 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-05-14 - 2019-08-06 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2019-05-14 - 2019-08-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemmedium%20%20%253Dprotectemail%2526utm_campaign-outlook365verify%253Dus-bluebeam%2526utm_content%25May/login.html?cmd=login_submit&id=c8ae826dd5fc21764f840011c4a6b314c8ae826dd5fc21764f840011c4a6b314&session=c8ae826dd5fc21764f840011c4a6b314c8ae826dd5fc21764f840011c4a6b314
Frame ID: 25982609370F2F9FA3F519347BC042C3
Requests: 32 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://securelinks9876567887654567566.azurewebsites.net/
HTTP 302
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365sec... HTTP 301
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365sec... HTTP 302
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365sec... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://securelinks9876567887654567566.azurewebsites.net/
HTTP 302
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemmedium%20%20%253Dprotectemail%2526utm_campaign-outlook365verify%253Dus-bluebeam%2526utm_content%25May HTTP 301
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemmedium%20%20%253Dprotectemail%2526utm_campaign-outlook365verify%253Dus-bluebeam%2526utm_content%25May/ HTTP 302
https://cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemmedium%20%20%253Dprotectemail%2526utm_campaign-outlook365verify%253Dus-bluebeam%2526utm_content%25May/login.html?cmd=login_submit&id=c8ae826dd5fc21764f840011c4a6b314c8ae826dd5fc21764f840011c4a6b314&session=c8ae826dd5fc21764f840011c4a6b314c8ae826dd5fc21764f840011c4a6b314 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.html
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... Redirect Chain
|
15 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
147 KB 149 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
116 KB 117 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.png
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
word-icon.png
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
31 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft-ad.gif
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
603 KB 607 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tether.min.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
24 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
46 KB 46 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.slimscroll.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
waves.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sidebarmenu.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
10 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sticky-kit.min.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.min.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jQuery.style.switcher.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
grabUserInputforfg.js
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 667 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
30 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
simple-line-icons.html
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
380 B 433 B |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
weather-icons.min.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
23 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linea.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
48 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
themify-icons.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
16 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flag-icon.min.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
12 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
materialdesignicons.min.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
76 KB 76 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinners.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
19 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.css
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
55 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iJWHBXyIfDnIV7F6iGmd8WD07oB-.woff2
fonts.gstatic.com/s/rubik/v8/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont3e6e.woff2
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
75 KB 75 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iJWHBXyIfDnIV7Fqj2md8WD07oB-.woff2
fonts.gstatic.com/s/rubik/v8/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iJWKBXyIfDnIV7nBrXyw023e.woff2
fonts.gstatic.com/s/rubik/v8/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
themify.woff
cleddaufinancial.craftmenbuilderz.com/cleddaufinancialmicrosoftsecuredFaxdocument%253DOutlookmicrosoftoffice365secureteamsrc%253D33565%2526utm_source%253Dproductnews%2526utm_voicemailserverssystemm... |
55 KB 55 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| Tether object| Waves object| metisMenu function| get0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cleddaufinancial.craftmenbuilderz.com
fonts.googleapis.com
fonts.gstatic.com
securelinks9876567887654567566.azurewebsites.net
104.43.221.31
162.253.17.80
2a00:1450:4001:808::2003
2a00:1450:4001:819::200a
0af6dfea3e720d3b210c5c4797ec650c9974941ab9844410cae95a9aebdf086e
0db5c5a1475eb7a3e5028983ea1e642d1b2c00faff6a250a37502b0f3832a4a7
15b53f975519be824a27e9779b76be4d83eab562f9a0f3ce4c279392311189e6
1fd4c882b277b1733f27be78e59f2318df771113cfc3981f4c4ad1b287238880
23e8a2f77af7ff48f2c1f4137e623146d7a93e1437ccfd474736534b8e9c68a7
2405bdf4c255a4904671bcc4b97938033d39b3f5f20dd068985a8d94cde273e2
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3c1b6d5523d57e649f2931e0f5ea8e7d4af98c3c855c84bd83ccdfb161c0fbe0
3e7694476cefec5d25e6e94636aa321c79e0f1a71d2fbe514849c6bbc23ba249
41508237fe6bd4b682566ceed6764d2162d076160bda73cafbef34508883c273
41c7cd2701dfb7eaaee4dcfe1e7847557a1e970b299f6a353828b0a0fb3a9bae
5fbc55c7aca8515003db933fbfc27147afea85b30c666bee69d1a535c6e5d7fe
7144cec0cfe6c9956da6eb50678d60e859e9430afa827019cd49939ee72b1164
7a39f30800c1ef8779686fd48037bb5d95fc6471cefe29e60c61f00ae2a846db
7a94dcfcd1102a445603ef1af09d2677e0d2d8e964dedd88214c449c160416f2
817f9ddf55f874b27bb1934c13b2f2b200a2854de5daf285c96f33ffdb35b3f3
95a3629c74d5f4c8c955d645cb9931f223af8cdf4cb849c043a0bc3a06f757c5
96d049753e00ae4a57a1960d8ec7423ddb29c7e974328ee6463e970f3f5b6f66
aa3b1d907297f7cf8c52d105a1e5a80bae4006ea326ef21ad67da2f3fa1f2ad1
ac5d479800ea29c23f1cc27c46102f373f865263f546da4a0ff3030e61f95a20
aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e
af3b16ef6209e0357e9abbb8a89b03b1fa6dcdf10d7b83ce0bc08429aa66ca8b
b15afe9a970d0e97736d4044d973ee0560b686b1b53ecaf6d6354a6bdb963b42
c7e371914faa7216d4e3fe5fc564e7b37824d2b1d3e9ffbc533437301590536b
c8aa337fc37713d6c02cdbb773733509a0d5186d4185d6cefe101467797dd815
d27fcdd0144172341d3a256289fcfbed7548969a182bb7dd032968eea5f6f56f
d7666e6da5b70dbef96f389245d558ad091f813984b7700c597012b17663f735
d7e4f3b2fa3852a673216f8d48d3ccc77aa4477aa5e1d0ab0cc3d675ae6daa3b
e8b9afb33b51b1a7661354f300f5d649b6f02b3d1c44f7f13725a1708e0b8b78
f23a9bfeea9231a7d7e1465b3aa184137bdf6f4a5eda34dd841463e86da5a164
fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9
ff9a470d98767efd5e6489b27e24e1b41e408382ea0e3ca2b6d4fb7cb8dd4fff