novo.oratoriomariano.com
Open in
urlscan Pro
162.241.61.68
Malicious Activity!
Public Scan
URL:
http://novo.oratoriomariano.com/novo/81686/Entry.html
Submission Tags: @phish_report
Submission: On October 01 via api from FI — Scanned from FI
Submission Tags: @phish_report
Submission: On October 01 via api from FI — Scanned from FI
Summary
This website contacted 3 IPs
in 1 countries
across 2 domains to perform 32 HTTP transactions.
The main IP is 162.241.61.68, located in
United States and
belongs to NETWORK-SOLUTIONS-HOSTING, US.
The main domain is novo.oratoriomariano.com.
This is the only time novo.oratoriomariano.com was scanned on urlscan.io!
This is the only time novo.oratoriomariano.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Novobanco (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 28 | 162.241.61.68 162.241.61.68 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 4 | 172.67.3.5 172.67.3.5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 32 | 3 |
28
162.241.61.68
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 162-241-61-68.unifiedlayer.com
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 162-241-61-68.unifiedlayer.com
| novo.oratoriomariano.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 28 |
oratoriomariano.com
novo.oratoriomariano.com |
475 KB |
| 4 |
browseranalytic.com
c.browseranalytic.com — Cisco Umbrella Rank: 126468 static.browseranalytic.com — Cisco Umbrella Rank: 194292 fd.browseranalytic.com — Cisco Umbrella Rank: 189054 browseranalytic.com — Cisco Umbrella Rank: 88607 |
55 KB |
| 32 | 2 |
| Domain | Requested by | |
|---|---|---|
| 28 | novo.oratoriomariano.com |
novo.oratoriomariano.com
|
| 1 | browseranalytic.com |
static.browseranalytic.com
|
| 1 | fd.browseranalytic.com |
novo.oratoriomariano.com
|
| 1 | static.browseranalytic.com |
novo.oratoriomariano.com
|
| 1 | c.browseranalytic.com |
novo.oratoriomariano.com
|
| 32 | 5 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| sec.novobanco.pt |
| www.novobanco.pt |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| browseranalytic.com WE1 |
2024-08-21 - 2024-11-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://novo.oratoriomariano.com/novo/81686/Entry.html
Frame ID: 35EDAAE684D77BA5C526F55E16DDA7F4
Requests: 33 HTTP requests in this frame
Screenshot
Page Title
:Page URL History Show full URLs
-
http://novo.oratoriomariano.com/novo/81686/Entry.html
HTTP 307
https://novo.oratoriomariano.com/novo/81686/Entry.html HTTP 307
http://novo.oratoriomariano.com/novo/81686/Entry.html Page URL
Detected technologies
FingerprintJS
(JavaScript libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- fingerprint(\d)?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery-ui[.-]([\d.]*\d)[^/]*\.js
- jquery-ui.*\.js
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
URL: https://sec.novobanco.pt/web/PTPW1/tpl.asp?ad=&pin=000000&selo=249430961&rp=1
Search URL Search Domain Scan URL
URL: https://sec.novobanco.pt/web/ocp/seguranca/nbo-reemissao-pin?app=1&md=2
Title: aqui
Title: aqui
Search URL Search Domain Scan URL
URL: https://www.novobanco.pt/site/cms.aspx?plg=463edf21-ba56-43e6-9ea2-67b9920724c8
Title: Recomendações de Segurança
Title: Recomendações de Segurança
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://novo.oratoriomariano.com/novo/81686/Entry.html
HTTP 307
https://novo.oratoriomariano.com/novo/81686/Entry.html HTTP 307
http://novo.oratoriomariano.com/novo/81686/Entry.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
Entry.html
novo.oratoriomariano.com/novo/81686/ Redirect Chain
|
25 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tpl.css
novo.oratoriomariano.com/novo/81686/__files/ |
34 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
controlos.css
novo.oratoriomariano.com/novo/81686/__files/ |
21 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nav.css
novo.oratoriomariano.com/novo/81686/__files/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
novo.oratoriomariano.com/novo/81686/__files/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b20top.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
43 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b20srv.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
evergage.min.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
276 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fingerprint2.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
58 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bcaptcha.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
326 KB 127 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loader_anim.gif
novo.oratoriomariano.com/novo/81686/__files/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
EsColors.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
1 KB 860 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.4.4.min.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
77 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.10.2.min.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
91 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui-1.11.4.min.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
235 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.reject.min.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sibsfingerprint.js.download
novo.oratoriomariano.com/novo/81686/__files/ |
1 KB 832 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
novo.oratoriomariano.com/novo/81686/__files/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
9fl.png
novo.oratoriomariano.com/novo/81686/__files/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
feedzai-nvb-prod
c.browseranalytic.com/c/ |
15 KB 15 KB |
XHR
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fingerprint2.js
novo.oratoriomariano.com/web/Resources/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bcaptcha.js
static.browseranalytic.com/js/bm92by5vcmF0b3Jpb21hcmlhbm8uY29t/53309673/ |
109 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
novo.oratoriomariano.com/novo/81686/Resources/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
NovobancoText-Bold.woff
novo.oratoriomariano.com/novo/81686/__files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icons.png
novo.oratoriomariano.com/novo/Resources/Login/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Slider_B.png
novo.oratoriomariano.com/web/Resources/Login/ |
6 KB 6 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_arrow_left.png
novo.oratoriomariano.com/novo/Resources/Login/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
NovobancoText-Book.woff
novo.oratoriomariano.com/novo/81686/__files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
NovobancoText-Light.woff
novo.oratoriomariano.com/novo/81686/__files/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
HEAD H2 |
/
fd.browseranalytic.com/ |
0 166 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
novo.oratoriomariano.com/ |
12 KB 5 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
captcha.php
browseranalytic.com/53309673/ |
8 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Novobanco (Banking)183 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| bNet object| Topo function| bNet$Util$ShowHelp function| bNet$Util$getUrl20 function| allowReplace function| bNet$Val$_MostraAEA function| bNet$Timer$Mais function| bNet$Timer$_Render function| bNet$Timer$_Calculate function| startAnimation function| behave function| stopBehave function| disableAnimation function| switchToFV20 function| navigateToFV function| navigateToNMA function| navigateToURL function| navigateTo function| obtemImagem function| navegaServico function| navegaDetalhePedido function| copiaDadosRetorno function| guardaDadosRetorno function| navegaNMADetalheAssinatura function| navegaFlexViewDetalheAssinatura function| navegaDetalheAssinatura function| navegaVoltarServicoUtilizador function| FV$loaded function| FV$printout function| FV$exportar function| FV$error function| FV$isActive function| FV$resize function| FV$updQuickLinks function| FV$NavegaServicoUser function| FV$NavegaDetalhePedido function| FV$NavegaVoltar function| bNet$Util$getNavigationUrl function| getNavigationUrl function| bNet$Val$ValidaTecla function| validaTecla function| bNet$Val$ValidaSoNumeros function| validaSoNumeros function| bNet$Val$VerificaCampo function| verificaCampo function| bNet$Val$ValidaNumericoReal function| validaNumericoReal function| bNet$Val$ValidaNumerico function| validaNumerico function| bNet$Val$ValidaTelemovel function| validaTelemovel function| bNet$Val$VerificaNumericoReal function| verificaNumericoReal function| bNet$Val$VerificaNumerico function| verificaNumerico function| bNet$Val$VerificaTelemovel function| verificaTelemovel function| bNet$Val$VerificaEmail function| verificaEmail function| bNet$Val$ObtemCodigoTecla function| obtemCodigoTecla function| bNet$Val$ValidaCaracterEspecial function| validaCaracterEspecial function| bNet$Val$ProcessaSalto function| processaSalto function| bNet$Val$MostraCalendario function| mostraCalendario function| bNet$Val$MostraAlerta function| mostraAlerta function| bNet$Val$MostraErro function| mostraErro function| bNet$Val$MostraAviso function| mostraAviso function| bNet$Val$MostraInfo function| mostraInfo function| bNet$Val$ValidaData function| validaData function| bNet$Val$ValidaHora function| validaHora function| bNet$Val$ValidaDataHora function| validaDataHora function| bNet$Val$ParseDate function| parseDate function| bNet$Val$ParseTime function| parseTime function| bNet$Val$AnoBisexto function| anoBisexto function| bNet$Val$ParseTimestamp function| parseTimestamp function| bNet$Val$ValidaAgendamento function| validaAgendamento function| bNet$Val$InicializaAgendamento function| inicializaAgendamento function| bNet$Val$LimpaAgendamento function| limpaAgendamento function| bNet$Val$DateDiff function| dateDiff function| bNet$Val$MoveTo function| move_to boolean| bNet$Val$salta function| FV$setHeight function| bNet$Ctx$ValidaTop function| bNet$Ctx$MudaUtilizador function| bNet$Ctx$IniContexto function| bNet$Ctx$Print function| bNet$Ctx$IniPrint function| bNet$Ctx$IniAlerta function| bNet$Ctx$IniHelp function| bNet$Ctx$IniSave function| bNet$Ctx$IniCorreio function| bNet$Ctx$AlteraIdioma function| bNet$Ctx$alteraPaginaInicial function| bNet$Ctx$Resize function| bNet$Ctx$FimSessao function| bNet$Sombra$Navigate function| bNet$Sombra$MeToMain function| bNet$Sombra$MainFromSombra function| __iniCtx function| doOnLoad object| Evergage string| VE_CUSTOM_EVENT_NAME string| TO_LAUNCHER_MESSAGE_TYPE string| TO_LAUNCHER_PAYLOAD_TYPE object| evgr object| isEventDataLayer function| sendMessageToEvergageLauncher number| evergageBeaconParseTimeStart object| SalesforceInteractions number| evergageBeaconParseTimeEnd function| render number| evergagePageMatchTimeout function| Fingerprint2 object| __col__jquery__offsets_lzITxh function| Mk function| char2hex function| hex2bin function| bin2hex function| cvt1 function| $ function| jQuery function| loadScript function| getFingerprint object| metaTag object| headTag object| metaTag2 function| desabilitar function| habilitar function| validarCampo string| fli object| _0x1534 function| _0x17aa object| _0x21885b number| _0x5de684 object| _0x4335ed object| _0x38c320 object| _0x11b137 number| num_btk number| zpk number| cntk number| ch_stk number| ch_stk2 string| pinkentry function| lmp function| pKB function| pKB2 function| cAKB function| disablePostback function| fillSlotsKB function| fillSlotsKB2 function| changeSlotsKB function| changeSlotsKB2 function| changeActionMessageKB function| handleSliderChanges function| ResetInactividadePL function| onlyNumberKey object| _0x283e function| _0x5b47 function| _0x53a1e6 boolean| result_test object| groups object| array function| LKdiiXhBLidLCA1c1c1d1e1k2p2t1g1i2s1f1l1d1j1d2t2q2s1j2s1d2p2r1k1d1i1e1e2s1g1l1f1i1f1j2s2r1k1i1h2r1j1l string| jsString0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
12 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
browseranalytic.com
c.browseranalytic.com
fd.browseranalytic.com
novo.oratoriomariano.com
static.browseranalytic.com
162.241.61.68
172.67.3.5
0257cb29298cc47dc3ed1a9281260a51549053490e5ace508921daa082d2a84f
0c78febab0fc0ac581d556e2a98147696fc25e972ea52d8b0d75c2022213eadb
0fe2faecb3b49209f95e818590169b38fdbba81eafdc1d97e0d7a3b7e4088855
29c9e8752f25b17961e3c6ff72de34b1f1a157dfc5fabb68bd148b8ec9002b17
2e7bd0f31871c6ffde71a6a25d30b3eabb645cbcf5d44c08e413a588be81063f
32b7d1f5cc2e316f3800bb5ffc16eb984b597a126120ab99024688a4c38194bb
3d53041554a1fd99190349f9b4040392012c88853b7fb72daf409bd83ec235f7
45d6468eda4ee475388a7a1859d5c1fc0d777d2cf187d472710c294c2f1b5c94
48d685402b465594e6ec567be7f1cddcedadc9b6721f5eed1ffe7555c15ef0dc
5c1c028cedd52ff1a18e20266d818ec61ca4997db2cfd7456c35feb8418de1fa
68cd248b463198dac6dabd09aa63f3b048ce5ea76934210db62b481404f45d3c
68e01d41f1a2d065c4b6faadd26095b0c7e045b81eeaca1b55ddf9281bbe84b0
72253ee0c09b6765851764dd2f1cb2ded0f0fdd5cd3fc26df2ae0649ae444472
8113aebffe146bdd2e25e13c558d7806dc406a1c0bd8ab3bb8571fcc713674f4
8c27dc6f85349141105b2e42402de1a0db1a866a2b2ac1c8e93aa33aac8ca8f0
990f3452736f1806199700baf0c66068b20b77c542daedec6959ec0fa2e73c15
a5fa5909d58e0977d63a521cf8c3d348e6ea6c8c0e405b8248f7d49f5a73e8c6
a875900196d150d9ef234163eec5c6135577f2b68fdf265747383089a05b9020
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
c4d069befff8b641042baf92c240f4915d376e80f70a5d1b24d1f3182a6cb443
cd0cf9d1e908630afaa6994b1f9af84717d09abfb29c16b64aa68d9d75475f1f
d20f325f58c81e04c5191c01bf0b300f3010ce3a575c520e800e2644109eecb4
d93c25136f398021e42f2a3c47da3a4c6f794bf173b3aa1a9ada4e0739d95b30
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e78d54db03ade4a5c8f67292e958e9011a0020bcca5c1b5074e14529dcef4247
fcdb1fb8e6684e7584a55424784e0fda524efac3d084ecccb2ab322ae99e0da2
fcfb62a72301ef65a3a47babc5eea45a830213004fc91e04a99603b46fbed382