![](/screenshots/f234f37e-3255-411a-a315-4fdc15a98cd7.png)
auswidegroup.net
Open in
urlscan Pro
203.114.76.76
Malicious Activity!
Public Scan
Effective URL: https://auswidegroup.net/user/aspx1.php
Submission: On September 14 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 15th 2021. Valid for: 3 months.
This is the only time auswidegroup.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 103.92.235.130 103.92.235.130 | 135822 (HOSRAJA-A...) (HOSRAJA-AS Ovi Hosting Pvt Ltd) | |
1 3 | 203.114.76.76 203.114.76.76 | 9268 (OVERTHEWI...) (OVERTHEWIRE-AS-AP Over The Wire Pty Ltd) | |
1 | 13.32.22.98 13.32.22.98 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 107.162.177.30 107.162.177.30 | 55002 (DEFENSE-NET) (DEFENSE-NET) | |
20 | 94.31.29.64 94.31.29.64 | 6461 (ZAYO-6461) (ZAYO-6461) | |
1 | 142.250.200.40 142.250.200.40 | 15169 (GOOGLE) (GOOGLE) | |
4 | 104.19.147.8 104.19.147.8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.10.26 104.17.10.26 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 216.58.213.14 216.58.213.14 | 15169 (GOOGLE) (GOOGLE) | |
1 | 34.249.212.247 34.249.212.247 | 16509 (AMAZON-02) (AMAZON-02) | |
34 | 10 |
ASN135822 (HOSRAJA-AS Ovi Hosting Pvt Ltd, IN)
PTR: server51a.hostingraja.org
wishbrick.com |
ASN9268 (OVERTHEWIRE-AS-AP Over The Wire Pty Ltd, AU)
PTR: plutoweb.auswideservices.net
auswidegroup.net |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-22-98.fra56.r.cloudfront.net
logo.clearbit.com |
ASN6461 (ZAYO-6461, US)
PTR: 94.31.29.64.IPYX-077437-ZYO.above.net
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com |
ASN15169 (GOOGLE, US)
PTR: lhr48s30-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: ber01s14-in-f14.1e100.net
www.google-analytics.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-212-247.eu-west-1.compute.amazonaws.com
tracking.crazyegg.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
netdna-ssl.com
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com |
742 KB |
5 |
crazyegg.com
script.crazyegg.com tracking.crazyegg.com |
25 KB |
3 |
auswidegroup.net
1 redirects
auswidegroup.net |
20 KB |
2 |
vitol.com
www.vitol.com |
40 KB |
1 |
google-analytics.com
www.google-analytics.com |
20 KB |
1 |
instant.page
instant.page |
1 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
41 KB |
1 |
clearbit.com
logo.clearbit.com |
4 KB |
1 |
wishbrick.com
1 redirects
wishbrick.com |
320 B |
34 | 9 |
Domain | Requested by | |
---|---|---|
20 | 3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com |
www.vitol.com
|
4 | script.crazyegg.com |
www.vitol.com
script.crazyegg.com |
3 | auswidegroup.net |
1 redirects
auswidegroup.net
|
2 | www.vitol.com |
auswidegroup.net
www.vitol.com |
1 | tracking.crazyegg.com |
script.crazyegg.com
|
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | instant.page |
www.vitol.com
|
1 | www.googletagmanager.com |
www.vitol.com
|
1 | logo.clearbit.com |
auswidegroup.net
|
1 | wishbrick.com | 1 redirects |
34 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.auswidegroup.net cPanel, Inc. Certification Authority |
2021-07-15 - 2021-10-13 |
3 months | crt.sh |
clearbit.com Amazon |
2021-04-22 - 2022-05-21 |
a year | crt.sh |
www.vitol.com Go Daddy Secure Certificate Authority - G2 |
2021-06-27 - 2022-07-29 |
a year | crt.sh |
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA |
2021-02-22 - 2022-03-18 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-08-23 - 2021-11-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-05-09 - 2022-05-08 |
a year | crt.sh |
*.crazyegg.com DigiCert SHA2 Secure Server CA |
2020-07-26 - 2022-07-23 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://auswidegroup.net/user/aspx1.php
Frame ID: C3308C757D2BF2EC6EF3CE16D001F848
Requests: 7 HTTP requests in this frame
Frame:
https://www.vitol.com/
Frame ID: FB0897053FB85D5BEF78413A09DDD585
Requests: 31 HTTP requests in this frame
Screenshot
![](/screenshots/f234f37e-3255-411a-a315-4fdc15a98cd7.png)
Page Title
Sign in to Vitol Security and Quarantine CenterPage URL History Show full URLs
-
https://wishbrick.com/sa-8e-0dalexp-0drts-e8vit-0dl-9a-8e-0dm
HTTP 302
https://auswidegroup.net/user/?client-request-id=c2Fjb2FsZXhwb3J0c0B2aXRvbC5jb20= HTTP 302
https://auswidegroup.net/user/aspx1.php Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
![](/vendor/wappa/icons/Microsoft ASP.NET.png)
Detected patterns
- \.aspx?(?:$|\?)
![](/vendor/wappa/icons/Crazy Egg.png)
Detected patterns
- script\.crazyegg\.com/pages/scripts/\d+/\d+\.js
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://wishbrick.com/sa-8e-0dalexp-0drts-e8vit-0dl-9a-8e-0dm
HTTP 302
https://auswidegroup.net/user/?client-request-id=c2Fjb2FsZXhwb3J0c0B2aXRvbC5jb20= HTTP 302
https://auswidegroup.net/user/aspx1.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
aspx1.php
auswidegroup.net/user/ Redirect Chain
|
51 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vitol.com
logo.clearbit.com/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.vitol.com/ Frame FB08 |
165 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
segoeui-regular.ttf
auswidegroup.net/owa/auth/15.1.2242/themes/resources/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lato-v16-latin-regular.woff2
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/fonts/ Frame FB08 |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lato-v16-latin-300.woff2
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/fonts/ Frame FB08 |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lato-v16-latin-700.woff2
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/fonts/ Frame FB08 |
22 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
autoptimize_single_2f772fed444d5489079f275bd01e26cc.js
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/cache/autoptimize/js/ Frame FB08 |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
autoptimize_single_94a3eafaf4a1f334768fde89d9eaeaa5.js
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/cache/autoptimize/js/ Frame FB08 |
1 KB 710 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ Frame FB08 |
101 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2764.js
script.crazyegg.com/pages/scripts/0107/ Frame FB08 |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-website.png
www.vitol.com/vitol-logo/ Frame FB08 |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
search-icon.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/images/ Frame FB08 |
871 B 616 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
VTTI_ETA-ship-terminals-Jun12.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/07/ Frame FB08 |
211 KB 212 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CHP_0446.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/07/ Frame FB08 |
64 KB 64 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
160310_397-e1595848838796.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/07/ Frame FB08 |
209 KB 209 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JMP_1378-1.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/07/ Frame FB08 |
33 KB 34 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Elandra-Maple_Vitol-Group-Viva-Energy_CraigMoodiePhoto_0068-2.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ Frame FB08 |
27 KB 27 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CHP_0236-Pano.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ Frame FB08 |
34 KB 34 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
K8A1491.jpg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ Frame FB08 |
32 KB 32 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twitter-icon.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/02/ Frame FB08 |
774 B 693 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
linkedin-icon.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/02/ Frame FB08 |
757 B 656 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
film-icon.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/uploads/2020/02/ Frame FB08 |
2 KB 641 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global-scripts.min.js
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/js/ Frame FB08 |
95 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.0.0
instant.page/ Frame FB08 |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home.min.js
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/js/ Frame FB08 |
60 B 294 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-blue.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/images/ Frame FB08 |
415 B 540 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-white.svg
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com/wp-content/themes/rouge-wp-start-theme/assets/images/ Frame FB08 |
415 B 538 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2764.json
script.crazyegg.com/pages/data-scripts/0107/ Frame FB08 |
4 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame FB08 |
48 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11.1.331.js
script.crazyegg.com/pages/versioned/common-scripts/ Frame FB08 |
64 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2764.json
script.crazyegg.com/pages/sampling-data-scripts/0107/ Frame FB08 |
154 B 238 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clock
tracking.crazyegg.com/ Frame FB08 |
28 B 135 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
7829e4b6-93cb-460e-9959-acfac9a9e5b5
https://www.vitol.com/ Frame FB08 |
218 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect boolean| originAgentCluster function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| input3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auswidegroup.net/user | Name: cookieTest Value: 1 |
|
auswidegroup.net/ | Name: PHPSESSID Value: df60fe6ff1bb648ba9ae2577fbadbd9f |
|
.vitol.com/ | Name: _ce.s Value: v11.rlc~1631643493026 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3wy4t48t53n2zjure2oko7k3-wpengine.netdna-ssl.com
auswidegroup.net
instant.page
logo.clearbit.com
script.crazyegg.com
tracking.crazyegg.com
wishbrick.com
www.google-analytics.com
www.googletagmanager.com
www.vitol.com
103.92.235.130
104.17.10.26
104.19.147.8
107.162.177.30
13.32.22.98
142.250.200.40
203.114.76.76
216.58.213.14
34.249.212.247
94.31.29.64
0541dc7017e9362d6246865e46348f6649e1a1e5d9706c7caed11c4bf825ac6e
0578d51e36ef893bce95cfeafbbf44686883d802f35a65058b66a5127cafac20
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
136b3c1b743c1519dff6e0e10481e459bc703a336e2b85ef8d46b86f6dad6194
162914b8f16919d9749b1f870d810579c8a1189387f1d95ccc4b089578208b3f
1882996e48b3b800108df06670df431af4a6f9b18eb54f4a74c0d601af52c641
27c4a025ac33fc9a29bcd3fb1a3fd70f4114de102fc0f2a7cb43abc37daf1017
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
524547bc0849455b8b57ada6c9dd86ea110a51753350ac922e7bc241cb94deb7
58510a15747bded71f57fba96d07a38ac5b2d7f78bf24e75ea9ccde827e51540
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6f0ad9f3ff31904d6a4962296240ac2afa342ab957442389db0d04a33b40ef78
71c83228c8dad42850a6c09a2d66c03146a2958b2cf24d4c533b14f11943a7c4
7d99801d4ef636aade91d142a11ba2d8cd3630c1144d93bc2e35378f5cfa4014
8328700fdcec1ef8a6847ebb958e3643b1a8567399f2c433e13bc5e14dad607f
8cb83d347be2ad7402bab87039ad5a3aef41ef8b85bd5c754be263d369b731be
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
912a84fc1b77d7ce1d480a979bb20052a259d1ddb4901afb1bf91d9ff87cc7af
9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a
929986419a083c4c42d01dd1c5071ebb656e339a398bcbf53494e7cd3cbbe292
99c98daa271ade698386e06c0cc9d8add2ef474b925c7823538c9ad631906914
a1e5e92cb88ff75d2046b2de20785850b4b17714cca621833dad458a820712f9
b62fc679c9f9f1d018bf64e635a592c6453af440c9fd7131d783de4b9670037e
ba79f37e80139c5d3fda98a5841e908fe0c91f4ee5353432b3317804ae7e1d9e
c2667b2a35fc4bbe1358e2604369da89ffcc0229a40d842a2c388452f3e18c87
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c568007cdf58e44af01bf5c3e70206f0bffd0ee4ef89d7d354c9ecfef163554e
c69caafd2d72bd569c7b4e1a152d0d0bee3bb24714822092934a272bd67b333c
ce993c02363a88c4e141e35317c5df704683e4d59b0b67dec2bec88f63dba01b
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e4625f1f082b9b659dbcadd7f07ea81797a4c6aabe183ea0501ab6bad494bdc0
e61168f100a4fabe6a84017bcb9c74a38ea0c5cde38c39ec681f939aa9aaf50a
ea2bbd96661211895308014f77234acea8f911752f9ca28bb654b50ea6bd8d20
eac1fe4bfa63d14f52b045e54a24fb11ce58c175415eb4652daf6a8620eccc75
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
ff6d6746b69a47e6a5829108e83638fa6624e5bf2d6dea6d693365c7962197b8