40-122-232-16.cprapid.com
Open in
urlscan Pro
40.122.232.16
Malicious Activity!
Public Scan
Effective URL: https://40-122-232-16.cprapid.com/office/
Submission: On June 04 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 21st 2022. Valid for: 3 months.
This is the only time 40-122-232-16.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) OneDrive (Online)Domain & IP information
ASN38283 (CHINANET-SCIDC-AS-AP CHINANET SiChuan Telecom Internet Data Center, CN)
www.siyunjiaoyu.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
40-122-232-16.cprapid.com |
ASN32748 (STEADFAST, US)
PTR: ip33.67-202-105.static.steadfastdns.net
ic.tynt.com | |
de.tynt.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-176-247-126.ap-northeast-1.compute.amazonaws.com
ps.eyeota.net |
ASN16509 (AMAZON-02, US)
PTR: server-99-84-128-95.nrt57.r.cloudfront.net
tags.crwdcntrl.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-179-185-212.ap-southeast-1.compute.amazonaws.com
bcp.crwdcntrl.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
cprapid.com
40-122-232-16.cprapid.com |
573 KB |
3 |
tynt.com
cdn.tynt.com — Cisco Umbrella Rank: 7662 ic.tynt.com — Cisco Umbrella Rank: 4320 de.tynt.com — Cisco Umbrella Rank: 1246 |
9 KB |
3 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1549 ka-f.fontawesome.com — Cisco Umbrella Rank: 2789 |
22 KB |
3 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 671 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2230 |
50 KB |
2 |
crwdcntrl.net
tags.crwdcntrl.net — Cisco Umbrella Rank: 1501 bcp.crwdcntrl.net — Cisco Umbrella Rank: 836 |
8 KB |
2 |
eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 824 |
688 B |
2 |
amung.us
widgets.amung.us — Cisco Umbrella Rank: 16048 whos.amung.us — Cisco Umbrella Rank: 14509 |
4 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 624 |
53 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 277 fonts.googleapis.com — Cisco Umbrella Rank: 42 |
31 KB |
1 |
33across.com
cdn-tc.33across.com — Cisco Umbrella Rank: 15719 |
532 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 206 |
7 KB |
1 |
siyunjiaoyu.com
www.siyunjiaoyu.com |
438 B |
0 |
dtscout.com
Failed
t.dtscout.com Failed |
|
34 | 13 |
Domain | Requested by | |
---|---|---|
11 | 40-122-232-16.cprapid.com |
www.siyunjiaoyu.com
40-122-232-16.cprapid.com |
2 | ps.eyeota.net |
40-122-232-16.cprapid.com
|
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | maxcdn.bootstrapcdn.com |
40-122-232-16.cprapid.com
|
2 | code.jquery.com |
40-122-232-16.cprapid.com
|
1 | bcp.crwdcntrl.net |
tags.crwdcntrl.net
|
1 | tags.crwdcntrl.net |
cdn-tc.33across.com
|
1 | cdn-tc.33across.com |
de.tynt.com
|
1 | de.tynt.com |
cdn.tynt.com
|
1 | ic.tynt.com |
40-122-232-16.cprapid.com
|
1 | cdn.tynt.com |
widgets.amung.us
|
1 | whos.amung.us |
widgets.amung.us
|
1 | widgets.amung.us |
40-122-232-16.cprapid.com
|
1 | stackpath.bootstrapcdn.com |
40-122-232-16.cprapid.com
|
1 | cdnjs.cloudflare.com |
40-122-232-16.cprapid.com
|
1 | kit.fontawesome.com |
40-122-232-16.cprapid.com
|
1 | fonts.googleapis.com |
40-122-232-16.cprapid.com
|
1 | ajax.googleapis.com |
40-122-232-16.cprapid.com
|
1 | www.siyunjiaoyu.com | |
0 | t.dtscout.com Failed |
widgets.amung.us
|
34 | 20 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dpdp.delivery.40-122-232-16.cprapid.com cPanel, Inc. Certification Authority |
2022-04-21 - 2022-07-20 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-05-09 - 2022-08-01 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-01 - 2023-01-01 |
a year | crt.sh |
*.amung.us Sectigo RSA Domain Validation Secure Server CA |
2022-05-18 - 2023-06-17 |
a year | crt.sh |
*.tynt.com Sectigo RSA Domain Validation Secure Server CA |
2021-09-23 - 2022-09-30 |
a year | crt.sh |
*.33across.com Sectigo RSA Domain Validation Secure Server CA |
2021-09-23 - 2022-09-30 |
a year | crt.sh |
*.eyeota.net R3 |
2022-03-08 - 2022-06-06 |
3 months | crt.sh |
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2 |
2022-05-01 - 2023-06-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://40-122-232-16.cprapid.com/office/
Frame ID: 1F64DBC341D254C8709B6618957E7B8E
Requests: 32 HTTP requests in this frame
Frame:
https://cdn-tc.33across.com/lotame-sync.html
Frame ID: E6B9FDB58D21D58D02846B3CAB436E1A
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
SharePoint OneDrive in lineaPage URL History Show full URLs
- http://www.siyunjiaoyu.com/au.php Page URL
- https://40-122-232-16.cprapid.com/office/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Popper (Miscellaneous) Expand
Detected patterns
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://www.siyunjiaoyu.com/au.php Page URL
- https://40-122-232-16.cprapid.com/office/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
au.php
www.siyunjiaoyu.com/ |
215 B 438 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
40-122-232-16.cprapid.com/office/ |
24 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 964 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hover.css
40-122-232-16.cprapid.com/office/css/ |
112 KB 112 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onedrive.png
40-122-232-16.cprapid.com/office/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onedrive-menu.webp
40-122-232-16.cprapid.com/office/images/ |
162 KB 162 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlook1.png
40-122-232-16.cprapid.com/office/images/ |
771 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aol1.png
40-122-232-16.cprapid.com/office/images/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office3651.png
40-122-232-16.cprapid.com/office/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo1.png
40-122-232-16.cprapid.com/office/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
other1.png
40-122-232-16.cprapid.com/office/images/ |
21 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gmail.png
40-122-232-16.cprapid.com/office/images/ |
65 KB 65 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onedriveside2.jpg
40-122-232-16.cprapid.com/office/images/ |
113 KB 113 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
small.js
widgets.amung.us/ |
8 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
t.dtscout.com/i/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
25 B 138 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc.js
cdn.tynt.com/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p
ic.tynt.com/b/ |
35 B 581 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
de.tynt.com/deb/ |
811 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lotame-sync.html
cdn-tc.33across.com/ Frame E6B9 |
343 B 532 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel
ps.eyeota.net/ |
0 344 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel
ps.eyeota.net/ |
0 344 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sync.min.js
tags.crwdcntrl.net/lt/c/16311/ Frame E6B9 |
23 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
map
bcp.crwdcntrl.net/6/ Frame E6B9 |
227 B 686 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- t.dtscout.com
- URL
- https://t.dtscout.com/i/?l=https%3A%2F%2F40-122-232-16.cprapid.com%2Foffice%2F&j=http%3A%2F%2Fwww.siyunjiaoyu.com%2F
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) OneDrive (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x2 object| Tynt object| _33Across function| __uspapi5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.tynt.com/ | Name: uid Value: VvzBe2KbEvtgteyQVAfEqQ== |
|
.tynt.com/ | Name: pids Value: %5B%7B%22p%22%3A%224bbb341d17%22%2C%22f%22%3A1%2C%22ts%22%3A1654330107298%7D%2C%7B%22p%22%3A%226361f7f203%22%2C%22f%22%3A2%2C%22ts%22%3A1654330107298%7D%5D |
|
.eyeota.net/ | Name: SERVERID Value: 24171~DM |
|
.crwdcntrl.net/ | Name: _cc_dc Value: 2 |
|
.crwdcntrl.net/ | Name: _cc_id Value: e3d3fe2efd583423c73a383a6aaa25a9 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
40-122-232-16.cprapid.com
ajax.googleapis.com
bcp.crwdcntrl.net
cdn-tc.33across.com
cdn.tynt.com
cdnjs.cloudflare.com
code.jquery.com
de.tynt.com
fonts.googleapis.com
ic.tynt.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
ps.eyeota.net
stackpath.bootstrapcdn.com
t.dtscout.com
tags.crwdcntrl.net
whos.amung.us
widgets.amung.us
www.siyunjiaoyu.com
t.dtscout.com
104.18.35.34
104.18.36.173
18.176.247.126
2001:4de0:ac18::1:a:2a
211.149.241.97
2404:6800:4004:824::200a
2404:6800:4004:825::200a
2606:4700:10::6816:4bab
2606:4700:3032::6815:1e29
2606:4700::6811:190e
2606:4700::6812:1734
2606:4700::6812:acf
2606:4700::6812:bcf
40.122.232.16
54.179.185.212
67.202.105.33
67.202.114.214
99.84.128.95
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2347066080fea31af55c7112dca5245ea3eea67df5f24f1daae09f0870fbce62
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
4e27daa9939e823bdcda3eda4a9db021ee3a460e3b92becd37ba40b8ef6daef1
5640e2177d8a24c6aef1d923c981591689205237b9c2fcba5215d10aa7bcf52e
56945ffbd21a04ccf48d9b75a2c06c8f48b754c61bacfce3b92fa3019dc92888
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
70170e469d8d05527acab7e3335c6fe91e2966ddbb6e9ea6211260b8f717d120
71e729939e175f4ae9d3fcc645d6b7389ec341a47a84950e047197331fdc22f1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8b646c7d791ddbb3f76ef620d2d4e39f25a6ff2aec0596f7b1ff63dcd87de27b
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a066124a6a7dedd7796a6a55f12d90ac538ed72903603c13a4fcb26099b6eddd
a3198e1e49943e1ad5daa838136f81592427342d3e98001455f00cbf2f0f0d10
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a79bf5599d8a6c93fd5358e986b7e083dda40c63187bfd60cebf47abe83c6a86
aad24ed5f36320964c515b9889cb2943bbf830b40703999ad3976fce8176e554
acf087c1757f08b0cfd53d59066544d7ef0bfcc50999e77c5813739cd9dc1479
b3ff19b9b344e02124690dd50f546342d93c6e52d409791ef853181a69d26482
bb88454962767eb6f2ddb1aabaaf844d8a57de7e8f848d7f6928f81b54998452
cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
eb30ccb0c4d8275620947780d68c61f93849c86c6085f100a7744b83328ac482
ebcc3a26916f3cc537720bee96a1b5e00186713a0e920e3aaf344bf32e69d055
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
fc723e88ed16a1783726bac4c5067f1b5da8605a492643aa87b25e207fad2d11