![](/screenshots/41ccfae6-3b1d-4561-839c-3174372fab06.png)
ptpnxiv.com
Open in
urlscan Pro
118.98.75.85
Malicious Activity!
Public Scan
Effective URL: https://ptpnxiv.com/owa.summary/aspx1.php
Submission Tags: falconsandbox
Submission: On February 15 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GoGetSSL RSA DV CA on December 27th 2021. Valid for: 3 months.
This is the only time ptpnxiv.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 162.251.85.202 162.251.85.202 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
1 4 | 118.98.75.85 118.98.75.85 | 7713 (TELKOMNET...) (TELKOMNET-AS-AP PT Telekomunikasi Indonesia) | |
40 | 141.78.7.198 141.78.7.198 | 680 (DFN Verei...) (DFN Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.) | |
43 | 3 |
ASN7713 (TELKOMNET-AS-AP PT Telekomunikasi Indonesia, ID)
PTR: v8.techscape8.com
ptpnxiv.com |
ASN680 (DFN Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE)
PTR: sr-dell-r440d.ku.de
www.ku.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
40 |
ku.de
www.ku.de |
5 MB |
4 |
ptpnxiv.com
1 redirects
ptpnxiv.com |
59 KB |
1 |
mongolianski.mn
1 redirects
mongolianski.mn |
140 B |
43 | 3 |
Domain | Requested by | |
---|---|---|
40 | www.ku.de |
ptpnxiv.com
www.ku.de |
4 | ptpnxiv.com |
1 redirects
ptpnxiv.com
|
1 | mongolianski.mn | 1 redirects |
43 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ptpnxiv.com GoGetSSL RSA DV CA |
2021-12-27 - 2022-03-27 |
3 months | crt.sh |
sr-dell-r440d.ku.de DFN-Verein Global Issuing CA |
2021-11-24 - 2022-12-25 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://ptpnxiv.com/owa.summary/aspx1.php
Frame ID: 94F3160A34717DAEFDA4A2658652C661
Requests: 7 HTTP requests in this frame
Frame:
https://www.ku.de/
Frame ID: 29444A9612178835CB304F7638DB95D4
Requests: 42 HTTP requests in this frame
Screenshot
![](/screenshots/41ccfae6-3b1d-4561-839c-3174372fab06.png)
Page Title
Sign in to Ku Security and Quarantine CenterPage URL History Show full URLs
-
https://mongolianski.mn/studierendenberatung-r2ku-x1de
HTTP 302
https://ptpnxiv.com/owa.summary/?client-request-id=c3R1ZGllcmVuZGVuYmVyYXR1bmdAa3UuZGU= HTTP 302
https://ptpnxiv.com/owa.summary/aspx1.php Page URL
Detected technologies
![](/vendor/wappa/icons/Microsoft ASP.NET.png)
Detected patterns
- \.aspx?(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://mongolianski.mn/studierendenberatung-r2ku-x1de
HTTP 302
https://ptpnxiv.com/owa.summary/?client-request-id=c3R1ZGllcmVuZGVuYmVyYXR1bmdAa3UuZGU= HTTP 302
https://ptpnxiv.com/owa.summary/aspx1.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
43 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
aspx1.php
ptpnxiv.com/owa.summary/ Redirect Chain
|
51 KB 51 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
owa_logo.png
ptpnxiv.com/owa.summary/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.ku.de/ Frame 2944 |
73 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
segoeui-regular.ttf
ptpnxiv.com/owa/auth/15.1.2242/themes/resources/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
merged-666b4ae77cff5c6f823821bbf2a9a7ee-7038eef7a6c7e5c7357fb1e8aa3441fe.css
www.ku.de/typo3temp/assets/compressed/ Frame 2944 |
141 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
www.ku.de/typo3conf/ext/kuei_base/Resources/Public/Images/Assets/ Frame 2944 |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
die_ku.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
721 B 813 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
studium.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
430 B 678 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
forschung.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
602 B 728 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
international.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
transfer.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
355 B 641 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
unileben.svg
www.ku.de/fileadmin/Navigation_Icons/ Frame 2944 |
727 B 765 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Verleihung_Shalompreis_b326ae869b.jpeg
www.ku.de/fileadmin/_processed_/1/0/ Frame 2944 |
25 KB 26 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_COLOURBOX4372229_dc77dd4a00.jpg
www.ku.de/fileadmin/_processed_/c/c/ Frame 2944 |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_COLOURBOX34433504_9067b76a51.jpeg
www.ku.de/fileadmin/_processed_/d/f/ Frame 2944 |
21 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Aquarium_Juramuseum1a__Benutzerdefiniert__03e7e36987.jpg
www.ku.de/fileadmin/_processed_/a/2/ Frame 2944 |
16 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Phaenologie1_66e3856e1d.jpg
www.ku.de/fileadmin/_processed_/5/e/ Frame 2944 |
23 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EMASplus_01.png
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Fairtrade.png
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Familie.png
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Weltoffene_HS.png
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
7 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DFHS.png
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Social_Media_Facebook.jpg
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Social_Media_Instagram.jpg
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Social_Media_YouTube.jpg
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Social_Media_Linkedin.jpg
www.ku.de/fileadmin/1904/Startseite/Logos_Footer/ Frame 2944 |
49 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
merged-561ce40809c094cbaca91deacc59f49d-d68d874dfbbdeac03f393e448332abdc.js
www.ku.de/typo3temp/assets/compressed/ Frame 2944 |
131 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
merged-1b7928173594318b2e1df0e2c4dd6162-dd587755945bf65df5fc5f30c0cc7c9c.js
www.ku.de/typo3temp/assets/compressed/ Frame 2944 |
117 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
customConfig.css
www.ku.de/fileadmin/user_upload/tx_dvt3consentmanagement/ Frame 2944 |
2 KB 909 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
consentModal.css
www.ku.de/typo3conf/ext/dv_t3_consent_management/Resources/Public/Css/ Frame 2944 |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
consentModal.js
www.ku.de/typo3conf/ext/dv_t3_consent_management/Resources/Public/Js/ Frame 2944 |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 2944 |
341 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 2944 |
360 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
raleway-v14-latin-regular.woff2
www.ku.de/typo3conf/ext/kuei_base/Resources/Public/Fonts/Raleway/ Frame 2944 |
20 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Studycheck_Homepage.jpg
www.ku.de/fileadmin/1904/Pressefotos_2022/ Frame 2944 |
3 MB 3 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Montage-Titelseiten-forum-forschung-Einzelmotiv_e5f2306692.jpg
www.ku.de/fileadmin/_processed_/4/a/ Frame 2944 |
68 KB 68 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Corona_Marke_quer_5e25f94589.png
www.ku.de/fileadmin/_processed_/8/3/ Frame 2944 |
520 KB 521 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Studieren_an_der_KU_SR_4ec01d57a0.jpg
www.ku.de/fileadmin/_processed_/0/a/ Frame 2944 |
80 KB 81 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Ideenbaum_0cfe0c7edf.jpg
www.ku.de/fileadmin/_processed_/a/5/ Frame 2944 |
66 KB 66 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Klima1_76e1eeb827.jpg
www.ku.de/fileadmin/_processed_/d/5/ Frame 2944 |
61 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_Umha__nge1_b81fc46d90.jpg
www.ku.de/fileadmin/_processed_/2/b/ Frame 2944 |
46 KB 46 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
csm_UH_f91700162a.png
www.ku.de/fileadmin/_processed_/e/a/ Frame 2944 |
362 KB 363 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gelasio-latin-ext-500-normal.woff
www.ku.de/typo3conf/ext/kuei_base/Resources/Public/Fonts/Gelasio/ Frame 2944 |
50 KB 50 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
raleway-v14-latin-700.woff2
www.ku.de/typo3conf/ext/kuei_base/Resources/Public/Fonts/Raleway/ Frame 2944 |
20 KB 21 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
open-sans-v17-latin-700.woff2
www.ku.de/typo3conf/ext/kuei_base/Resources/Public/Fonts/OpenSans/ Frame 2944 |
15 KB 15 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| structuredClone function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| input2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ptpnxiv.com/owa.summary | Name: cookieTest Value: 1 |
|
ptpnxiv.com/ | Name: PHPSESSID Value: ld8e58ph0ggp46tb8rs8pnmel4 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mongolianski.mn
ptpnxiv.com
www.ku.de
118.98.75.85
141.78.7.198
162.251.85.202
043d777ba1bc921eceebce845a0883167d76868251b75bcf5da1679d051aeea2
0507d64310c869e61ee88e32f99b504ee239164f2cbc0dd29d4d33538f679c58
06af0ed7275c3e2bf0d4282a39e0bf2b3cb6e5115fb43a9c3cb26af9f60dfd02
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
086e9f3b08c55b990ed1c77423709404f992de881d026895fe11f0c4ce0234db
0a654aef5d8378e00c1a8a8e6876a8e4246b41cf46a3cabf1bf495617ca4086e
0dae1c4966796e059189e15443e30f644795b22a56be247f22bfd4ce8445e00e
0f3453c2e54f9215d1eea709b6fd898839bf801ec2044c3b22657cc2611cc124
106445fc3adc999710e9ae0040a6609221b200f2d0716d08839d6176d21f0a6c
14211a030f1aaa64f8efcefd7c13fba3b68baa05ea13ff4b66afac934c1d80ec
1727e3b0bdab64111924fd2a9da06ce043104293f4a278d52e2dc378757f8646
225f9eada2d0571e7277025728c33147ad26b035df0109f3de251bdb529b1238
27ba9a7597c19ccdec1b199f8894215b7780cf1c6d40d5b4a930ef2b6759c427
2c153d7bce868dba10dc06bdb545ad2a079790f65a92b637f1c34fa566e4ea8f
302afd44eb9d9969a8df37ecff3f31df1ea50faf500947d3450fb4c9eef551d7
3e2eebb87bc3ca4c914e0d9a45bdea624296d6148218005ba95a7b031ca2ff7e
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
4eb96dcfcf6ed589e59ccc79bc5955ba4fd5b5b1f92af644e57c3e21ac8e32df
520b96805567f57df79e16a9ed734de5ed90c2ff52c6ede416c7abcf44540f9c
52c374a2f67ff696b5b888ede19752c7a7c3bf18502a834bedfce14335bf34d0
5ff4cd10ebc85d738b53afd30ba6cd851aed2a96167ebc6a6e714fca3e9c4518
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
67504dad1da5c48aed967102062a03b07bf222da380efa7b91b6c83ce0e81a0f
6a70eaadc27d6ac44c7cda42305482eaab7655a4365989649656dcf0ea7d1810
7042e9ddf1a98bed60ce47faae205a36bc5b292be321518b96a1cecd7bc1d40a
7222106ecfec02f3b3c162415ae5b8540c30895437ccd2603159e73f0578e809
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
79377c77434a064c5c63b1d497c82f868c2cf95832755b45dcb2ffb9d6e7fc68
8d4e7ec4033cb24338184e9650ee6f89c2b97dbd52fc8466717641dfb0d99156
9cd7a85aca4a73b4d1443b595f5410ccbe148b78c3cc35be010d53ce76e18db7
a6e0f98561f4f1bdcdc755bb8eebd13b8801d57274086e7c3b30a6e1afd388bd
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
abde329a6464bd871a4b1eff5b78762b3f30616cb8b21764c303d77c930c9487
b3287a4018a220fe4a205c68bbb34a847fe5038c5dfbe575dd538df025b0497a
bd54f6e4edccc467b830b95d647676096121541e0ce4e77d0397622b4ec23d23
c2c62fa9128d676cad3887392c5a0e189a194f659952d037b5432c56ca88c85b
c46d6bcc80f046966b7bebde0a206ba2fa57582bf1f5f924aa785faa27c57828
ca2b480c1905a3b934f36c91105dc7b9c6627767032ec38254d3aed2def17f89
d14a09e59bd8164e2b574bf88024e7e0d028d680fe79aee727efbf3ae32b4a18
d39334ab85e50a3e1d669139f499bbdf853e99fb7f555f9dcbdbc9d8c0a008e3
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dd8ee08c9e3937fb4497b35b47f12a2300a3a5c6544b12294c545d35369a8af1
de50648da99296271b707135aefce8e37e67c6aad6ecd4115d8f36329718ab8c
e49688b1abc9cf19752f34e9df197af7a907fda0f13eb54dedcdf6f111a16a76
ec92afd4e58cae2731701865e42efb0ddc23b75de3e0c5060a9e738fb27238d1
ed6fb47ad25aa23ee38be76b61bfc22816d7b33daf5495f7a557a729308b342b
f0b5be098e36b7774608ad25a9e3f2028e0f408281a33859de4963c373233fb5
fb75cd0e86af57584db7862c92bbf0f07d8cb373b96d3c7945ef9f4cf3b90ebd