uczsurvey.com
Open in
urlscan Pro
139.59.108.226
Malicious Activity!
Public Scan
Effective URL: https://uczsurvey.com/feedback_au_nnwd/index_5.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5...
Submission: On August 25 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 25th 2018. Valid for: 3 months.
This is the only time uczsurvey.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 27.50.92.36 27.50.92.36 | 45671 (AS45671-N...) (AS45671-NET-AU Wholesale Services Provider) | |
1 1 | 35.160.30.112 35.160.30.112 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 1 | 18.191.57.178 18.191.57.178 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 2 | 185.181.10.57 185.181.10.57 | 47447 (TTM) (TTM) | |
1 1 | 18.184.38.55 18.184.38.55 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
24 | 139.59.108.226 139.59.108.226 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6818:131d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6818:121d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
29 | 6 |
ASN45671 (AS45671-NET-AU Wholesale Services Provider, AU)
PTR: dib.darian-brown.com
tiny.ph |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-160-30-112.us-west-2.compute.amazonaws.com
bymeadmn.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-191-57-178.us-east-2.compute.amazonaws.com
jbbrwaki.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-38-55.eu-central-1.compute.amazonaws.com
click.qualified-visitor.com |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
uczsurvey.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.foxpush.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
json.foxpush.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
uczsurvey.com
uczsurvey.com |
219 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
33 KB |
2 |
margalaxa.com
2 redirects
go.margalaxa.com |
556 B |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
foxpush.com
json.foxpush.com |
2 KB |
1 |
foxpush.net
cdn.foxpush.net |
9 KB |
1 |
qualified-visitor.com
1 redirects
click.qualified-visitor.com |
2 KB |
1 |
jbbrwaki.com
1 redirects
jbbrwaki.com |
709 B |
1 |
bymeadmn.com
1 redirects
bymeadmn.com |
261 B |
1 |
tiny.ph
1 redirects
tiny.ph |
351 B |
29 | 10 |
Domain | Requested by | |
---|---|---|
24 | uczsurvey.com |
uczsurvey.com
ajax.googleapis.com |
2 | go.margalaxa.com | 2 redirects |
1 | fonts.gstatic.com |
uczsurvey.com
|
1 | fonts.googleapis.com |
uczsurvey.com
|
1 | json.foxpush.com |
cdn.foxpush.net
|
1 | cdn.foxpush.net |
uczsurvey.com
|
1 | ajax.googleapis.com |
uczsurvey.com
|
1 | click.qualified-visitor.com | 1 redirects |
1 | jbbrwaki.com | 1 redirects |
1 | bymeadmn.com | 1 redirects |
1 | tiny.ph | 1 redirects |
29 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
nqasurvey.com Let's Encrypt Authority X3 |
2018-07-25 - 2018-10-23 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-08-07 - 2018-10-16 |
2 months | crt.sh |
foxpush.net CloudFlare Inc ECC CA-2 |
2018-02-05 - 2019-02-05 |
a year | crt.sh |
foxpush.com CloudFlare Inc ECC CA-2 |
2018-02-05 - 2019-02-05 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2018-08-07 - 2018-10-16 |
2 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://uczsurvey.com/feedback_au_nnwd/index_5.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F67.0.3396.87%20Safari%2F537.36&browserversion=Chrome%2067&city=Hofheim%20Am%20Taunus&country=DE&device=DESKTOP&isp=Hetzner%20Online%20AG&ip=148.251.45.254&os=MacOS&osversion=MacOS%2010.13%20High%20Sierra&browser=Chrome&type=&match=wl&id=3069a4f9-0440-4c4e-a2c5-8ca019494a81&cid=3ef5d8d5-27ca-464c-a350-d782b7d38e16&language=Unknown&carrier=&clickid=1535177488939&cep=XjMGTA2fjPn0hSQCAeinmBmK_RLs4yFWG_s6AjOOVAhuxvVRyNP21jPdGBEukHh1LrR3htcy4jVD4uEnuTb4-SOp2ehtU-hgUj6kgZH3ar6_UCjkdW_h85dE-loDKBDhtAnZljhbDJqUvq2CRq2ag5n4k5JC6K_3Jf3iFBrl31wXWUWotm5GzkvrTRovatSKGYGJ8l7G1kds5ufb0DvCCk-aRcumhhhvGW6BjA-geUPcSfgnri5hlcI9h6xaFu1vZMWJJl-o1bImWhVCwtGQL-awd1nvUvzUTtcXhQ1tS3_aGdxFhDo3yBcT3b4dKaEzsw684Lhyi80JKc33nEV3SpJ6O9FzAirJA2zIN3_6l8FpmJ-_Hjxcpyq-xngvf5t1SClb_WHUQ0LytaSpid8U-qE4N8nSGaKT0FuHZOrpd3Opb7i8jDkbjhUSLDehwJb6Yi66phJSEw3vJH5ofHLKVg&voluum-cid={voluum-cid}&category=&sid=139608527&revenue={revenue}&target=wl&cost=
Frame ID: 4B464F66EB355DCD2899A53110EC5C52
Requests: 29 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://tiny.ph/BZbm
HTTP 301
http://bymeadmn.com/?E=euRGhVyJCtE6pQ1PvZ2u8QvZOkeavcEx&s1= HTTP 302
https://jbbrwaki.com/?E=euRGhVyJCtE6pQ1PvZ2u8QvZOkeavcEx&s1=&ckmguid=767ef862-3e1f-483a-92a1-6d85... HTTP 302
http://go.margalaxa.com/ts60-internationalemail-general HTTP 302
http://go.margalaxa.com/ts60-internationalemail-general-revs HTTP 302
https://click.qualified-visitor.com/3ef5d8d5-27ca-464c-a350-d782b7d38e16?id={id}&voluum-cid={voluum-cid}&categor... HTTP 302
https://uczsurvey.com/feedback_au_nnwd/index_5.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Ma... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://tiny.ph/BZbm
HTTP 301
http://bymeadmn.com/?E=euRGhVyJCtE6pQ1PvZ2u8QvZOkeavcEx&s1= HTTP 302
https://jbbrwaki.com/?E=euRGhVyJCtE6pQ1PvZ2u8QvZOkeavcEx&s1=&ckmguid=767ef862-3e1f-483a-92a1-6d854c128c0a HTTP 302
http://go.margalaxa.com/ts60-internationalemail-general HTTP 302
http://go.margalaxa.com/ts60-internationalemail-general-revs HTTP 302
https://click.qualified-visitor.com/3ef5d8d5-27ca-464c-a350-d782b7d38e16?id={id}&voluum-cid={voluum-cid}&category=&sid=139608527&country={country}&revenue={revenue}&target=wl&cost=&clickid=1535177488.75-139608527-21827 HTTP 302
https://uczsurvey.com/feedback_au_nnwd/index_5.php?ua=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F67.0.3396.87%20Safari%2F537.36&browserversion=Chrome%2067&city=Hofheim%20Am%20Taunus&country=DE&device=DESKTOP&isp=Hetzner%20Online%20AG&ip=148.251.45.254&os=MacOS&osversion=MacOS%2010.13%20High%20Sierra&browser=Chrome&type=&match=wl&id=3069a4f9-0440-4c4e-a2c5-8ca019494a81&cid=3ef5d8d5-27ca-464c-a350-d782b7d38e16&language=Unknown&carrier=&clickid=1535177488939&cep=XjMGTA2fjPn0hSQCAeinmBmK_RLs4yFWG_s6AjOOVAhuxvVRyNP21jPdGBEukHh1LrR3htcy4jVD4uEnuTb4-SOp2ehtU-hgUj6kgZH3ar6_UCjkdW_h85dE-loDKBDhtAnZljhbDJqUvq2CRq2ag5n4k5JC6K_3Jf3iFBrl31wXWUWotm5GzkvrTRovatSKGYGJ8l7G1kds5ufb0DvCCk-aRcumhhhvGW6BjA-geUPcSfgnri5hlcI9h6xaFu1vZMWJJl-o1bImWhVCwtGQL-awd1nvUvzUTtcXhQ1tS3_aGdxFhDo3yBcT3b4dKaEzsw684Lhyi80JKc33nEV3SpJ6O9FzAirJA2zIN3_6l8FpmJ-_Hjxcpyq-xngvf5t1SClb_WHUQ0LytaSpid8U-qE4N8nSGaKT0FuHZOrpd3Opb7i8jDkbjhUSLDehwJb6Yi66phJSEw3vJH5ofHLKVg&voluum-cid={voluum-cid}&category=&sid=139608527&revenue={revenue}&target=wl&cost= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index_5.php
uczsurvey.com/feedback_au_nnwd/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_1_d.css
uczsurvey.com/feedback_au_nnwd/css/ |
19 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flag_au.png
uczsurvey.com/feedback_au_nnwd/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.png
uczsurvey.com/feedback_au_nnwd/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.png
uczsurvey.com/feedback_au_nnwd/img/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.png
uczsurvey.com/feedback_au_nnwd/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.png
uczsurvey.com/feedback_au_nnwd/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.png
uczsurvey.com/feedback_au_nnwd/img/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.png
uczsurvey.com/feedback_au_nnwd/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
secure_min.png
uczsurvey.com/feedback_au_nnwd/img/ |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.0/ |
90 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
redirect.js
uczsurvey.com/ |
57 B 417 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script_1_d.js
uczsurvey.com/feedback_au_nnwd/js/ |
22 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
foxpush_SDK_min.js
cdn.foxpush.net/sdk/ |
33 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
livetrendingnewscom.json
json.foxpush.com/ |
924 B 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gift_title_wl.png
uczsurvey.com/feedback_au_nnwd/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.css
uczsurvey.com/feedback_au_nnwd/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
offers_1_d.json
uczsurvey.com/feedback_au_nnwd/datas/ |
2 KB 870 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.json
uczsurvey.com/feedback_au_nnwd/datas/ |
1 KB 694 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
op_img.png
uczsurvey.com/feedback_au_nnwd/img/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
female_diet.png
uczsurvey.com/feedback_au_nnwd/img/ |
20 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moist.png
uczsurvey.com/feedback_au_nnwd/img/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
skincare_2.png
uczsurvey.com/feedback_au_nnwd/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
maleenhace.png
uczsurvey.com/feedback_au_nnwd/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
muscle.png
uczsurvey.com/feedback_au_nnwd/img/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
male_diet.png
uczsurvey.com/feedback_au_nnwd/img/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
2 KB 657 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wl.json
uczsurvey.com/feedback_au_nnwd/datas/ |
1 KB 694 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)53 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _foxpush function| $ function| jQuery number| FOXPUSH_SDK_version object| foxpush_config boolean| foxpush_popup_allowed boolean| is_foxpush_frame_loaded object| _foxpush_object function| _foxpush_removeA function| _foxpush_check_segment function| _foxpush_local_segment function| _foxpush_subscribe function| _foxpush_unsubscribe undefined| foxpush_log undefined| obj object| foxpush_browser function| fox_appendHtml function| IsJsonString function| foxpsuh_blocked function| isFacebookApp function| foxpush_window function| hexToRgb function| _foxpush_querystring string| eventMethod function| eventer string| messageEvent object| foxpush_request object| _foxpush_templates string| redirect_url function| loadingOffers function| $_GET string| targets string| titles boolean| keywordName string| message function| clickIE4 function| clickNS4 number| timerId object| mydate number| day number| month number| daym number| year object| dayarray object| montharray object| now object| newDate function| loadingData string| ua string| target string| titleOut boolean| IE object| jQuery180089476712465582750 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bymeadmn.com
cdn.foxpush.net
click.qualified-visitor.com
fonts.googleapis.com
fonts.gstatic.com
go.margalaxa.com
jbbrwaki.com
json.foxpush.com
tiny.ph
uczsurvey.com
139.59.108.226
18.184.38.55
18.191.57.178
185.181.10.57
2400:cb00:2048:1::6818:121d
2400:cb00:2048:1::6818:131d
27.50.92.36
2a00:1450:4001:81e::2003
2a00:1450:4001:81e::200a
2a00:1450:4001:821::200a
35.160.30.112
01522549a0a0a1d2b0c677a23d6bfeb299e2f19cd51ef502ca2446478c0c2aef
0c8b68cc677c86cd4917a10f85aee7802c06874b4c278b73e1914eefe60db317
153b2b99ac2597e357a7a409baa0bc540e319cc703da3129f5399557faa2c6ed
1684ea8cac825ad753d5912299e27dbf6159d3d53c0a5b99f0474e87e43969fa
1d1cbc6d11c4f33ac89fadff4ea2c39ef5f1534af5ea6f5d8d826ec8cac4b2f9
28eea8b398fa3ef334cb50f71606e83fc0e06d2077f7396facd7431354b29484
35a21333c81302e934ee42b7b85b2c6a731bfffb418fe52fe795cb1974186976
4132fb4009ca017b9bf4c84d6d7b12e7a5362bca767488f077e69ebfad9c9f19
4959d6e3d1be34605bcc60460eb0999ed9faf561db25e9d9b87ec3f37c099653
6a832966cdeb7b0dd0170ac5a5f9e713ef6214150437fde0c83935314bf434b2
70f7000b82ee8cb278257912aaf86a72505caa47f58063ed4530511c229ff8ba
7c1f3406a589a8e59e829a8459afd8f25fb8a50a27233fc8d2524e8355ebdd96
897b8c9d61053140694298388f802d70ab9ed4e0dd1ca70898e2addcdb16b47b
8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31
8dfad8e1340c7198c3f6062db35f93286351dfc99ca2ff40e65cfa02db909df3
9d0f592942c20da4994decf0cec4293c8127394e057d75a47ac6dbe37fda72b8
a7fec7d5a0475a5ff33bb103392394089a4d9b3607791bd382f87136b05e10d2
af919da82f9cdfbf3537a6647e927a33fce2bc317917773717f34060cf5e18d6
b2284cb536284aa9c29aa5c2943a2a53e8fe4457e89de12fe63ebf2ad032c8c3
ba2d312305be36489c58ddba6386a599a4b3d9181019bee7ff86e5922cdb4ba9
bcc19857d61a70683071426a9452fb4190deefd86ae0554cbd596d6960f367d8
c9d3c2d33f07f2ae6ae203c654f3ada6a56002f710c55d7e6b878e004b3143d1
d1a30d4f07bc5beea557f6ef3cbb21ae7c94c08eb0686e0f3d11518e3b676a11
dd504221f5066c57a04ecc1e0f9b77fd215c18cb24376a8f4e39aec2e57ca9e3
e3b94e6964f2ca9ae8c2a08d1b073c9bbfb33b480b7f9ed896fc2965090fff3e
f21fa6ab1d70e77de38ab033edeb6752a51f681d9b5e49018b682ef05b2593bd
f5ac7ce9c4bcbbb43958d95c37588c14e5349233ceb178288024106233337ce2
f804364bc6608265447379d9e0e2d5e6eb10e0d12c924d822d7eb92f3db9e8c7