2636.cuefoottrip.live
Open in
urlscan Pro
185.155.184.79
Malicious Activity!
Public Scan
Effective URL: https://2636.cuefoottrip.live/dranihbu/article2636.doc?u=n7rwwwl&o=at5ruqf&t=197&f=1&sid=t9~zbp2zrrorr4fs1b3o2045onv&fp=w7k1pN...
Submission: On October 26 via manual from DK — Scanned from DK
Summary
TLS certificate: Issued by R3 on October 17th 2023. Valid for: 3 months.
This is the only time 2636.cuefoottrip.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.66.108.22 192.66.108.22 | 3292 (TDC TDC AS) (TDC TDC AS) | |
1 3 | 2606:4700:303... 2606:4700:3031::6815:2cd4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 88.212.201.204 88.212.201.204 | 39134 (UNITEDNET) (UNITEDNET) | |
1 | 185.155.184.185 185.155.184.185 | 5398 (AS5398) (AS5398) | |
29 | 185.155.184.79 185.155.184.79 | 5398 (AS5398) (AS5398) | |
33 | 5 |
ASN13335 (CLOUDFLARENET, US)
xn--e1aabzcbhd0akd.xn--p1ai |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
cuefoottrip.live
2636.cuefoottrip.live |
316 KB |
3 |
1 redirects
function sub() { [native code] }. |
6 KB |
2 |
yadro.ru
1 redirects
counter.yadro.ru — Cisco Umbrella Rank: 7583 |
1 KB |
1 |
viopar.net
viopar.net |
34 KB |
1 |
esbjerg.dk
1 redirects
www.esbjerg.dk |
293 B |
33 | 5 |
Domain | Requested by | |
---|---|---|
29 | 2636.cuefoottrip.live |
viopar.net
2636.cuefoottrip.live |
3 | xn--e1aabzcbhd0akd.xn--p1ai |
1 redirects
xn--e1aabzcbhd0akd.xn--p1ai
|
2 | counter.yadro.ru |
1 redirects
xn--e1aabzcbhd0akd.xn--p1ai
|
1 | viopar.net |
xn--e1aabzcbhd0akd.xn--p1ai
|
1 | www.esbjerg.dk | 1 redirects |
33 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
viopar.net R3 |
2023-10-02 - 2023-12-31 |
3 months | crt.sh |
cuefoottrip.live R3 |
2023-10-17 - 2024-01-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://2636.cuefoottrip.live/dranihbu/article2636.doc?u=n7rwwwl&o=at5ruqf&t=197&f=1&sid=t9~zbp2zrrorr4fs1b3o2045onv&fp=w7k1pNtfmgcTJAdg5rvbJQ%3D%3D
Frame ID: 6956AEBFB9021B2B1D042DACDACE0053
Requests: 34 HTTP requests in this frame
Screenshot
Page Title
Årlig Undersøgelse Blandt Besøgende 2023Page URL History Show full URLs
-
https://www.esbjerg.dk/HttpHandlers/RedirectSocialHandler.ashx?q=http%3A%2F%2F%D0%BD%D1%83%D0%B6%D0...
HTTP 302
http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4 Page URL
-
http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4
HTTP 303
https://viopar.net/?u=n7rwwwl&o=at5ruqf&t=197 Page URL
- https://2636.cuefoottrip.live/dranihbu/article2636.doc?u=n7rwwwl&o=at5ruqf&t=197&f=1&sid=t9~zbp2zrrorr4fs1... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.esbjerg.dk/HttpHandlers/RedirectSocialHandler.ashx?q=http%3A%2F%2F%D0%BD%D1%83%D0%B6%D0%BD%D0%BE%D0%B5%D0%BC%D0%B5%D1%81%D1%82%D0%BE.%D1%80%D1%84/znYt/13oct26wwwesbjergdktp4
HTTP 302
http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4 Page URL
-
http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4
HTTP 303
https://viopar.net/?u=n7rwwwl&o=at5ruqf&t=197 Page URL
- https://2636.cuefoottrip.live/dranihbu/article2636.doc?u=n7rwwwl&o=at5ruqf&t=197&f=1&sid=t9~zbp2zrrorr4fs1b3o2045onv&fp=w7k1pNtfmgcTJAdg5rvbJQ%3D%3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.esbjerg.dk/HttpHandlers/RedirectSocialHandler.ashx?q=http%3A%2F%2F%D0%BD%D1%83%D0%B6%D0%BD%D0%BE%D0%B5%D0%BC%D0%B5%D1%81%D1%82%D0%BE.%D1%80%D1%84/znYt/13oct26wwwesbjergdktp4 HTTP 302
- http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4
- https://counter.yadro.ru/hit;refleader?t52.6;r;s1600*1200*24;uhttp%3A//xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4;hVente.;0.48437522475431916 HTTP 302
- https://counter.yadro.ru/hit;refleader?q;t52.6;r;s1600*1200*24;uhttp%3A//xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4;hVente.;0.48437522475431916
- http://xn--e1aabzcbhd0akd.xn--p1ai/znYt/13oct26wwwesbjergdktp4 HTTP 303
- https://viopar.net/?u=n7rwwwl&o=at5ruqf&t=197
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
13oct26wwwesbjergdktp4
xn--e1aabzcbhd0akd.xn--p1ai/znYt/ Redirect Chain
|
6 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
42 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hit;refleader
counter.yadro.ru/ Redirect Chain
|
362 B 848 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
ab.php
xn--e1aabzcbhd0akd.xn--p1ai/antibot/ |
72 B 1015 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
viopar.net/ Redirect Chain
|
33 KB 34 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
article2636.doc
2636.cuefoottrip.live/dranihbu/ |
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap-mini.css
2636.cuefoottrip.live/media/mainstream/all/mb/ |
10 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome-mini.css
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-like.css
2636.cuefoottrip.live/media/mainstream/all/mb/ |
7 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8.js
2636.cuefoottrip.live/media/mainstream/all/mb/dk/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
u.js
2636.cuefoottrip.live/media/mainstream/ |
25 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_f01.png
2636.cuefoottrip.live/media/mainstream/all/mb/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
15 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iphone14pro.png
2636.cuefoottrip.live/media/mainstream/all/mb/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img1.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img2.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img3.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img4.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img5.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img6.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img7.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img8.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img9.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img10.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img11.jpg
2636.cuefoottrip.live/media/mainstream/all/mb/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
6 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
11 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
28 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7.js
2636.cuefoottrip.live/media/mainstream/all/mb/ |
7 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chrome58x58.png
2636.cuefoottrip.live/media/mainstream/all/mb/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.mp3
2636.cuefoottrip.live/media/mainstream/ |
9 KB 9 KB |
XHR
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)102 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| requestLink object| geoInfo string| ip string| devInfo function| $ function| jQuery function| detect_language function| faviconPulse string| key string| key2 string| city undefined| locationJSON string| sMobile string| sDesktop function| isMobileDevice undefined| geoip_city undefined| loadJSON undefined| loadTextFileAjaxSync string| sound function| returnDate function| _0x207a1e function| getCookie function| getBackendParamsByName function| addSessionId function| returnSessionId number| exDays function| wireUpEvents boolean| PreventExitSplash function| getUrlParameter string| exitsplashpage function| getUrlWithParam function| DisplayExitSplash function| addLoadEvent function| addClickEvent function| disablelinksfunc function| disableformsfunc function| prevent function| _0x436c function| getParameterByName function| languageDetection function| writeLocation function| _0x13e1 object| geoRefData function| showLocation function| docReady function| Cookies function| _0x9782 function| _0x4f0f67 string| nAgt string| browserName undefined| nameOffset number| verOffset undefined| ix function| _0x38a1 function| _0x3d08e1 function| _0xcca8 function| _0x1bee object| g object| _0x10a5 function| _0x2652 function| C function| _0x4f4b7a function| _0x42bc8a function| _0x66c379 function| _0x5410b5 object| _0x4590 function| _0x41e833 object| canvas1 object| ctx number| W number| H number| mp undefined| deactivationTimerHandler undefined| reactivationTimerHandler number| animationHandler object| particles number| angle number| tiltAngle boolean| confettiActive boolean| animationComplete object| particleColors function| confettiParticle function| InitializeButton function| SetGlobals function| InitializeConfetti function| Draw function| _0x14b1 function| RandomFromTo function| Update function| CheckForReposition function| stepParticle function| repositionParticle function| StartConfetti function| ClearTimers function| DeactivateConfetti function| StopConfetti function| RestartConfetti function| requestAnimFrame object| _0x256b function| _0x2189 function| _0x176d6514 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_uid Value: 9d40fd8f5f91176ee97d622fab062518 |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_country Value: NO |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_lang Value: da |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_ptr Value: 2a02%3A20c8%3A3361%3A0000%3A0000%3A0000%3A0000%3A0008 |
|
.yadro.ru/ | Name: FTID Value: 1bEbr52Mb_ef1bEbr5002AAu |
|
.yadro.ru/ | Name: VID Value: 1Jcpur1m5qOf1bEbr6002TGJ |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_39e959ebadd07477d357d3e0f6042f46 Value: 868d038769d41d0cfc8d3206b1ac4e91 |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_referer Value: http%3A%2F%2Fxn--e1aabzcbhd0akd.xn--p1ai%2FznYt%2F13oct26wwwesbjergdktp4 |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_hits Value: 2 |
|
xn--e1aabzcbhd0akd.xn--p1ai/ | Name: antibot_unique_20231026 Value: 1 |
|
viopar.net/ | Name: sid Value: t9~zbp2zrrorr4fs1b3o2045onv |
|
viopar.net/ | Name: p1 Value: https://cuefoottrip.live/dranihbu/ |
|
viopar.net/ | Name: s1 Value: oawklwplmu7wwzih |
|
2636.cuefoottrip.live/ | Name: cookie1 Value: true |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2636.cuefoottrip.live
counter.yadro.ru
viopar.net
www.esbjerg.dk
xn--e1aabzcbhd0akd.xn--p1ai
185.155.184.185
185.155.184.79
192.66.108.22
2606:4700:3031::6815:2cd4
88.212.201.204
0ae7ca5355a3d9cee0731a8e1e8d26c83f8f22bd091aa09361126d59a5537b32
1ba8c670f900075cdb5f73a31e8b14a7400a913c15d0de891f884ab0673945f8
294e8322725f35c8f1c7e948c6bef3047b2c070f69c18bcb7d070b2a63cff15a
388e1eb0cb648490ea1c4913f4ea3128f3fbfbda0608bf85e471d947db905302
45f901bd7a281c73db028f014eb9196ad0297d6eaede94151bf2832946eb8f07
46b7c6b7df8e8f0888b0857b045a4e96a4cb15b37b6bf19a4ab4f3603ffcfc43
4a38335b55379462b766727785b7505320bcc608f7c9c8890b7bf70513570624
6592c5497d79980109ee577663beac8d709726a63329f893775f89083cc8858e
6aa98e3eb4f683f76064b073d18d55a89e286da10a53a0b84fafd4b7d0f0af50
84d7f0648aeba8d80bb0f47e781cba8955b8fa7425748d9830c7a8c9bc35e5e9
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
898d05a17f2cfc5120ddcdba47a885c378c0b466f30f0700e502757e24b403a1
91e5c1968eee9298437a097fd47978a077d667e086593ab0fd7988ef60d2ddf4
9831c4a7f76965486cf3c035888c334fcbff09862a5fb8e6ec9df7f2376a9024
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9fa1826a0ce98788fad2bd2bee0ab9982f773e39d8c8d5a7994da64f78b3bedf
a73d6739819ba98621e4bdb24bc2fbc2c88583479558b9878e5b986d3b59341d
a7c86ca5470f7d68b4c5f1c87f29f7daf816d1bd95353091bba8753341bb6f5f
aa05de326a8afd2a7b16c253d8c10fc41857b474f23a814ffa7684d4ef17c1a9
aea3443ffa2df4454daac365b37a61f9b9b1ba24dc0899ff3afca9f770765ce0
b7ef93d7317f06c8e58ff947d50a75482127d2d09dcd1a64ea6849654883fd53
ba858c8ecc8f498253509a9251e5070ce3b3ad9950b704a22a9a1fb1efc62541
c6cf48df501228c7113bf1342aa6a56c55e7dcff4bfbe187ff97838a6f01a19b
d79bc81189750262716692ade6cc4d6fb6c4fbc4aa01c2b9d0aa67e5788821fc
d8d2b0e0baad97e943838712911352a8c9dd0d5bf2114e78c3d1649bcc0d634a
e075018e9a06d85a147b1f0d79e8e777da51019b4f306076f8fbba751d42d566
e3da7d20be42da6e260d3085d2a3f3965a549065345ee2d139e28625104e2393
e7eb3ba41e31f5d9710bb64a87a5e9e7664143a95f68d0f357fe0d4252bb58d5
eb9fe798331b592bd8fc54d5ede3ac19e961b5aa7c2dffb3dbb17ce5fcb88e01
f2ead250f003ad44fad41af0a1554922e31ab930fa86d90a8f2df62c048c2843
f39e5853927b10c6ac0a6c7533160a90a7f08bb2a8c59eb83d7b412f525eeed6
fa07d78345204bf48b255523990b544e1b28f9a7810aaf2b8a5a356d05575205
fa917d32b1cafd1b58d1691c1338d6fbb64493159395dea4778347608b2988b4