urlscan.io logo urlscan.io
SecurityTrails logo

www.payaftercure.com Open in urlscan Pro
193.201.82.174  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://payaftercure.com/lvt/qakbot.zip
Effective URL: https://www.payaftercure.com/lvt/qakbot.zip
Submission: On June 15 via api from RU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 4 countries across 9 domains to perform 35 HTTP transactions. The main IP is 193.201.82.174, located in Romania and belongs to THCPROJECTS, RO. The main domain is www.payaftercure.com.
TLS certificate: Issued by R3 on May 5th 2024. Valid for: 3 months.
This is the only time www.payaftercure.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 21 193.201.82.174 51177 (THCPROJECTS)
4 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 192.0.77.48 2635 (AUTOMATTIC)
2 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.67 15169 (GOOGLE)
2 2606:4700:440... 13335 (CLOUDFLAR...)
1 142.250.184.200 15169 (GOOGLE)
35 10
21    193.201.82.174 (Romania)

ASN51177 (THCPROJECTS, RO)
PTR: payaftercure.com
payaftercure.com
www.payaftercure.com
4    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:4400::ac40:9af8 (United States)

ASN13335 (CLOUDFLARENET, US)
nitroscripts.com
1    192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org
s.w.org
2    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
region1.analytics.google.com
1    2a00:1450:400c:c02::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    142.250.186.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f3.1e100.net
www.google.de
2    2606:4700:4400::6812:255d (United States)

ASN13335 (CLOUDFLARENET, US)
to.getnitropack.com
1    142.250.184.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f8.1e100.net
www.googletagmanager.com
Apex Domain
Subdomains		 Transfer
21 payaftercure.com
payaftercure.com
www.payaftercure.com
231 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 79
369 KB
2 getnitropack.com
to.getnitropack.com — Cisco Umbrella Rank: 12612
273 B
1 google.de
www.google.de — Cisco Umbrella Rank: 8196
63 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 132
258 B
1 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3078
54 B
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2347
258 B
1 w.org
s.w.org — Cisco Umbrella Rank: 3918
639 B
1 nitroscripts.com
nitroscripts.com — Cisco Umbrella Rank: 19255
18 KB
35 9
Domain Requested by
20 www.payaftercure.com www.payaftercure.com
5 www.googletagmanager.com www.payaftercure.com
www.googletagmanager.com
2 to.getnitropack.com nitroscripts.com
1 www.google.de www.payaftercure.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 region1.google-analytics.com www.googletagmanager.com
1 s.w.org www.payaftercure.com
1 nitroscripts.com www.payaftercure.com
1 payaftercure.com 1 redirects
35 10

This site contains links to these domains. Also see Links.

Domain
www.anarieldesign.com
Subject Issuer Validity Valid
payaftercure.com
R3		 2024-05-05 -
2024-08-03		 3 months crt.sh
*.google-analytics.com
WR2		 2024-05-27 -
2024-08-19		 3 months crt.sh
nitroscripts.com
GTS CA 1P5		 2024-05-01 -
2024-07-30		 3 months crt.sh
*.w.org
Sectigo ECC Domain Validation Secure Server CA		 2023-12-18 -
2025-01-17		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2024-05-27 -
2024-08-19		 3 months crt.sh
*.google.de
WR2		 2024-05-27 -
2024-08-19		 3 months crt.sh
getnitropack.com
Cloudflare Inc ECC CA-3		 2024-01-13 -
2024-12-31		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.payaftercure.com/lvt/qakbot.zip
Frame ID: F7CA91D3A9B86DE8EF5C834281013D9F
Requests: 35 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Page not found -

Page URL History Show full URLs

  1. https://payaftercure.com/lvt/qakbot.zip HTTP 301
    https://www.payaftercure.com/lvt/qakbot.zip Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

35
Requests

94 %
HTTPS

56 %
IPv6

9
Domains

10
Subdomains

10
IPs

4
Countries

619 kB
Transfer

1727 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://payaftercure.com/lvt/qakbot.zip HTTP 301
    https://www.payaftercure.com/lvt/qakbot.zip Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

35 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request qakbot.zip
www.payaftercure.com/lvt/
Redirect Chain
  • https://payaftercure.com/lvt/qakbot.zip
  • https://www.payaftercure.com/lvt/qakbot.zip
45 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed / PHP/7.4.33
Resource Hash
dbce0348b7dc46f71d101212000ac4180c3a46f55f8f530aa5f9292b7fef0af9

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache, must-revalidate, max-age=0
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 15 Jun 2024 00:01:45 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
link
<https://www.payaftercure.com/wp-json/>; rel="https://api.w.org/"
server
LiteSpeed
vary
Accept-Encoding
x-litespeed-cache-control
no-cache
x-litespeed-tag
uri=0846be7c11088b7802d2d672aca49813
x-litespeed-vary
cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop
x-nitro-cache
MISS
x-nitro-disabled
1
x-nitro-disabled-reason
404
x-powered-by
PHP/7.4.33

Redirect headers

alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-24=":443"; ma=2592000, h3-25=":443"; ma=2592000
cache-control
no-cache, must-revalidate, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Sat, 15 Jun 2024 00:01:44 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
location
https://www.payaftercure.com/lvt/qakbot.zip
server
LiteSpeed
x-litespeed-cache-control
no-cache
x-litespeed-tag
uri=0846be7c11088b7802d2d672aca49813
x-litespeed-vary
cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop
x-nitro-cache
MISS
x-nitro-disabled
1
x-nitro-disabled-reason
404
x-powered-by
PHP/7.4.33
x-redirect-by
WordPress
style.min.css
www.payaftercure.com/wp-includes/css/dist/block-library/ 		111 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-includes/css/dist/block-library/style.min.css?ver=1d435ddb150980e793bca1b3fb73f0ad
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 02 Apr 2024 22:43:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
14071
expires
Sat, 22 Jun 2024 00:01:46 GMT
polls-css.css
www.payaftercure.com/wp-content/plugins/wp-polls/ 		3 KB
721 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/plugins/wp-polls/polls-css.css?ver=2.77.2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
4d956a758ca48121e4434c413596334c6b0f3cda0e622ada0d73c41d39eda526

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Wed, 09 Aug 2023 10:35:47 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
640
expires
Sat, 22 Jun 2024 00:01:46 GMT
style.css
www.payaftercure.com/wp-content/themes/veggie-lite/ 		60 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite/style.css?ver=1d435ddb150980e793bca1b3fb73f0ad
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
0e5de0266909e0b8193ce1bf1beded3fa841107946bdf3783cad0239b7617177

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 22:36:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
11385
expires
Sat, 22 Jun 2024 00:01:46 GMT
7c7050fec4a12cacbf7c7ce705500bce.css
www.payaftercure.com/wp-content/fonts/ 		71 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
5d6fab55c4e170d68df13b27e656591c79fd6faca74640803bf8a57846153886

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Sat, 01 Jun 2024 17:09:24 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1870
expires
Sat, 22 Jun 2024 00:01:46 GMT
style.css
www.payaftercure.com/wp-content/themes/veggie-lite-child/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite-child/style.css?ver=1d435ddb150980e793bca1b3fb73f0ad
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
af151a8bc1feea6038b4b6d8e74b57d376c2dbfe195340437db999792a5eb38f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 20:08:16 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4837
expires
Sat, 22 Jun 2024 00:01:46 GMT
genericons.css
www.payaftercure.com/wp-content/themes/veggie-lite/genericons/ 		27 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite/genericons/genericons.css?ver=3.2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
e1dd4857cf68611937202e97ed063f7f3bd401d5300f807795ee504aa5e98450

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 22:36:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
16209
expires
Sat, 22 Jun 2024 00:01:46 GMT
jquery.min.js
www.payaftercure.com/wp-includes/js/jquery/ 		86 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 07 Nov 2023 22:42:26 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29744
expires
Sat, 22 Jun 2024 00:01:46 GMT
jquery-migrate.min.js
www.payaftercure.com/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 08 Aug 2023 22:40:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4678
expires
Sat, 22 Jun 2024 00:01:46 GMT
js
www.googletagmanager.com/gtag/ 		288 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-R7NQFYCESC
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1c08a6a41c0b03b908bf09942c29fd907ce0f5018eea4545088fd1bc232ee1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
100063
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 15 Jun 2024 00:01:46 GMT
cropped-logo1.png
www.payaftercure.com/wp-content/uploads/2015/04/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.payaftercure.com/wp-content/uploads/2015/04/cropped-logo1.png
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
6fe7c5119fc3957eb7ac4e18f00ac9cf74185c2f8840362a94278786b563d4f0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
last-modified
Tue, 03 Aug 2021 21:40:08 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
3707
expires
Sat, 22 Jun 2024 00:01:46 GMT
polls-js.js
www.payaftercure.com/wp-content/plugins/wp-polls/ 		3 KB
630 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/plugins/wp-polls/polls-js.js?ver=2.77.2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
03d87f337bb68d971d9fdb8ed746c0ab6f4008e6060e63ed67057f444a05a6a6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Wed, 09 Aug 2023 10:35:47 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
572
expires
Sat, 22 Jun 2024 00:01:46 GMT
search.js
www.payaftercure.com/wp-content/themes/veggie-lite/js/ 		677 B
343 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite/js/search.js?ver=1.0
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
edf23a9c2fe1fd705890839fe8c94d5dd6224c3f26874aea62f53ab40985f46c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 22:36:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
310
expires
Sat, 22 Jun 2024 00:01:46 GMT
navigation.js
www.payaftercure.com/wp-content/themes/veggie-lite/js/ 		2 KB
776 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite/js/navigation.js?ver=20120206
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 22:36:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
742
expires
Sat, 22 Jun 2024 00:01:46 GMT
skip-link-focus-fix.js
www.payaftercure.com/wp-content/themes/veggie-lite/js/ 		751 B
330 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/themes/veggie-lite/js/skip-link-focus-fix.js?ver=20130115
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 14 May 2024 22:36:17 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
296
expires
Sat, 22 Jun 2024 00:01:46 GMT
97b635e5-445b-459b-8571-3089385fa803
https://www.payaftercure.com/ 		1 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.payaftercure.com/97b635e5-445b-459b-8571-3089385fa803
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
1185
Content-Type
text/javascript
gotkOWXQHfuUjrmouzhQHrfAgLXwUfua
nitroscripts.com/ 		53 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nitroscripts.com/gotkOWXQHfuUjrmouzhQHrfAgLXwUfua
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9af8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf873c2d15a7b7dfc1595e8ee76cc97fd8e8d1c4deff9d2a2a56328a8f8d91a8
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-request-timestamp
1718409706
date
Sat, 15 Jun 2024 00:01:46 GMT
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Fri, 14 Jun 2024 20:05:24 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-expose-headers
X-Request-Timestamp
cache-control
max-age=600, stale-while-revalidate=31536000
cf-ray
893e4998f9753a79-FRA
gtm.js
www.googletagmanager.com/ 		190 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-N5RCXC2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8f9c1c036e51c5a5fd7ba80909b5752ad0186618c4624f6a148bf56d04d2b817
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
69361
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 15 Jun 2024 00:01:46 GMT
qakbot.zip
www.payaftercure.com/lvt/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/lvt/qakbot.zip
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed / PHP/7.4.33
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryYN0btUBJ2LuHvzJI

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
server
LiteSpeed
x-powered-by
PHP/7.4.33
content-type
text/html; charset=UTF-8
x-litespeed-cache-control
no-cache
cache-control
no-cache
x-litespeed-vary
cookie=np_wc_currency,cookie=np_wc_currency_language,cookie=_icl_current_language, value=nitrodesktop
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-24=":443"; ma=2592000, h3-25=":443"; ma=2592000
content-length
0
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
www.payaftercure.com/wp-content/fonts/open-sans/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/fonts/open-sans/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Origin
https://www.payaftercure.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
last-modified
Sat, 01 Jun 2024 17:09:24 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
48236
expires
Sat, 22 Jun 2024 00:01:46 GMT
Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2
www.payaftercure.com/wp-content/fonts/josefin-sans/ 		28 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/fonts/josefin-sans/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
c94f080a550a1f2d4fe07d371969b7a40c01606bd5624e8c03c976cbf5e06058

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Origin
https://www.payaftercure.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
last-modified
Sat, 01 Jun 2024 17:09:18 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
28600
expires
Sat, 22 Jun 2024 00:01:46 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
www.payaftercure.com/wp-content/fonts/open-sans/ 		49 KB
49 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/fonts/open-sans/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/wp-content/fonts/7c7050fec4a12cacbf7c7ce705500bce.css
Origin
https://www.payaftercure.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
last-modified
Sat, 01 Jun 2024 17:09:21 GMT
server
LiteSpeed
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
50296
expires
Sat, 22 Jun 2024 00:01:46 GMT
wp-emoji-release.min.js
www.payaftercure.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-includes/js/wp-emoji-release.min.js?ver=1d435ddb150980e793bca1b3fb73f0ad
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
last-modified
Tue, 02 Apr 2024 22:43:09 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
4676
expires
Sat, 22 Jun 2024 00:01:46 GMT
1f642.svg
s.w.org/images/core/emoji/15.0.3/svg/ 		525 B
639 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/15.0.3/svg/1f642.svg
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
943c44a0f3dc1aba84f5fbe8465baadbb90af66cd7be9f37ca07a39260357ad2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-nc
HIT hhn 2
date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Tue, 30 Jan 2024 01:15:39 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
alt-svc
h3=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
8d5effa8-9f78-4b4f-bf83-c13a4b4ec5c3
https://www.payaftercure.com/ 		256 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.payaftercure.com/8d5effa8-9f78-4b4f-bf83-c13a4b4ec5c3
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4dcabb967a6a348a2508cb74415e86cabe70f4c921e9d36581047e0e89f20555

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length
256
Content-Type
application/javascript
js
www.googletagmanager.com/gtag/ 		314 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-QSDY7CEECH&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N5RCXC2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9545b6ec9a6326618c326c19e07f26daface84c51356be0aa2cdb77b66700491
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
107496
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 15 Jun 2024 00:01:46 GMT
js
www.googletagmanager.com/gtag/ 		288 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-R7NQFYCESC&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N5RCXC2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c271b9c5c4b7495f005384e79d4c9e42b12d17d996c5973963cdee667cb599e1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
100158
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 15 Jun 2024 00:01:46 GMT
collect
region1.google-analytics.com/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-R7NQFYCESC&gtm=45je46c0v880972421za200zb861425757&_p=1718409706282&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&gdid=dZTNiMT&cid=1689845971.1718409707&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.61%7CGoogle%2520Chrome%3B126.0.6478.61&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1718409706&sct=1&seg=0&dl=https%3A%2F%2Fwww.payaftercure.com%2Flvt%2Fqakbot.zip&dt=Page%20not%20found%20-&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=3869
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-R7NQFYCESC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 15 Jun 2024 00:01:46 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.payaftercure.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-QSDY7CEECH&gtm=45je46c0v884074416z8861425757za200zb861425757&_p=1718409706282&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&tag_exp=0&cid=1689845971.1718409707&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.61%7CGoogle%2520Chrome%3B126.0.6478.61&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1718409706&sct=1&seg=0&dl=https%3A%2F%2Fwww.payaftercure.com%2Flvt%2Fqakbot.zip&dt=Page%20not%20found%20-&en=page_view&_fv=1&_ss=1&tfd=3976&_z=sendBeacon
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QSDY7CEECH&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 15 Jun 2024 00:01:46 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.payaftercure.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QSDY7CEECH&cid=1689845971.1718409707&gtm=45je46c0v884074416z8861425757za200zb861425757&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QSDY7CEECH&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 15 Jun 2024 00:01:46 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.payaftercure.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QSDY7CEECH&cid=1689845971.1718409707&gtm=45je46c0v884074416z8861425757za200zb861425757&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=575769757
Requested by
Host: www.payaftercure.com
URL: https://www.payaftercure.com/lvt/qakbot.zip
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 15 Jun 2024 00:01:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ub
to.getnitropack.com/ 		20 B
178 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://to.getnitropack.com/ub?v=3
Requested by
Host: nitroscripts.com
URL: https://nitroscripts.com/gotkOWXQHfuUjrmouzhQHrfAgLXwUfua
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:255d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4d2b5c10747a9a02c401ece039329ec75c8a8f1dc4de0c7fb53a4ebde5555e4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
893e499c2aad2bdd-FRA
content-length
20
content-type
text/plain; charset=utf-8
a
www.googletagmanager.com/ 		0
11 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googletagmanager.com/a?v=3&t=l&pid=1348575264&rv=46c0&u=AAAAAAAAAAAAACA&ut=Ag&h=Ag&gtm=45je46c0v884074416za200zb861425757&ccid=84074416&cid=G-QSDY7CEECH&l=L3570.S22.B18.E122.I3650.EC5.TC20.HTC0~gtm.init_consent.S1.V0.E18~gtm.init.S0.V0.E20.TS5ogt1pdatav2.TI10.TE0.TS5ccdgalast.TI12.TE0.TS5ccdautoredact.TI13.TE0.TS5ogteventcreate.TI14.TE0.TS5ogteventcreate.TI15.TE0.TS5ogteventcreate.TI16.TE0.TS5ogteventcreate.TI17.TE0.TS5ccdconversionmarking.TI18.TE0.TS5ccdemvideo.TI19.TE0.TS5ccdemsitesearch.TI20.TE0.TS5ccdemscroll.TI21.TE0.TS5ccdempageview.TI22.TE0.TS5ccdemoutboundclick.TI23.TE0.TS5ccdemdownload.TI24.TE0.TS5ccdgaregscope.TI25.TE1.TS5ogtgooglesignals.TI26.TE0.TS5ccdgaadslink.TI27.TE0.TS5setproductsettings.TI28.TE0.TS5ccdgafirst.TI29.TE0~gtm.js.S0.V0.E14.TS5gct.TI7.TE0~gtm.dom.S0.V0.E3~gtm.load.S0.V0.E1~GA405
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.200 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
logo1.png
www.payaftercure.com/wp-content/uploads/2015/04/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.payaftercure.com/wp-content/uploads/2015/04/logo1.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
193.201.82.174 , Romania, ASN51177 (THCPROJECTS, RO),
Reverse DNS
payaftercure.com
Software
LiteSpeed /
Resource Hash
b2dac46045333dc7a12a49a714e8f53b66197272695393600ba440ce4d2b531c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.payaftercure.com/lvt/qakbot.zip
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 15 Jun 2024 00:01:46 GMT
last-modified
Tue, 03 Aug 2021 21:35:22 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
3726
expires
Sat, 22 Jun 2024 00:01:46 GMT
ux
to.getnitropack.com/ 		20 B
95 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://to.getnitropack.com/ux?v=4
Requested by
Host: nitroscripts.com
URL: https://nitroscripts.com/gotkOWXQHfuUjrmouzhQHrfAgLXwUfua
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:255d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4d2b5c10747a9a02c401ece039329ec75c8a8f1dc4de0c7fb53a4ebde5555e4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://www.payaftercure.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sat, 15 Jun 2024 00:01:47 GMT
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
893e49a1dd982bdd-FRA
content-length
20
content-type
text/plain; charset=utf-8

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| _wpemojiSettings undefined| $ function| jQuery function| gtag object| dataLayer object| NPTelemetryMetadata object| NitroPack object| heartbeatData object| pollsL10n function| poll_vote function| poll_process function| poll_result function| poll_booth function| poll_process_success object| twemoji object| wp number| lcpCruxTimestamp number| lcpPerfTimestamp object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal

4 Cookies

Domain/Path Name / Value
www.payaftercure.com/ Name: nitroCachedPage
Value: 0
.payaftercure.com/ Name: _ga_R7NQFYCESC
Value: GS1.1.1718409706.1.0.1718409706.0.0.0
.payaftercure.com/ Name: _ga
Value: GA1.1.1689845971.1718409707
.payaftercure.com/ Name: _ga_QSDY7CEECH
Value: GS1.1.1718409706.1.0.1718409706.60.0.0

1 Console Messages

Source Level URL
Text
network error URL: https://www.payaftercure.com/lvt/qakbot.zip
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nitroscripts.com
payaftercure.com
region1.analytics.google.com
region1.google-analytics.com
s.w.org
stats.g.doubleclick.net
to.getnitropack.com
www.google.de
www.googletagmanager.com
www.payaftercure.com
142.250.184.200
142.250.186.67
192.0.77.48
193.201.82.174
2001:4860:4802:34::36
2606:4700:4400::6812:255d
2606:4700:4400::ac40:9af8
2a00:1450:4001:830::2008
2a00:1450:400c:c02::9c
03d87f337bb68d971d9fdb8ed746c0ab6f4008e6060e63ed67057f444a05a6a6
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
0e5de0266909e0b8193ce1bf1beded3fa841107946bdf3783cad0239b7617177
1c08a6a41c0b03b908bf09942c29fd907ce0f5018eea4545088fd1bc232ee1a0
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
4d956a758ca48121e4434c413596334c6b0f3cda0e622ada0d73c41d39eda526
4dcabb967a6a348a2508cb74415e86cabe70f4c921e9d36581047e0e89f20555
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5a1a3a3f0ef52a304cde50940ee607a2ebb008b76fa4cf49721b6e5cc07c350a
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c
5d6fab55c4e170d68df13b27e656591c79fd6faca74640803bf8a57846153886
6fe7c5119fc3957eb7ac4e18f00ac9cf74185c2f8840362a94278786b563d4f0
8f9c1c036e51c5a5fd7ba80909b5752ad0186618c4624f6a148bf56d04d2b817
943c44a0f3dc1aba84f5fbe8465baadbb90af66cd7be9f37ca07a39260357ad2
9545b6ec9a6326618c326c19e07f26daface84c51356be0aa2cdb77b66700491
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
a4d2b5c10747a9a02c401ece039329ec75c8a8f1dc4de0c7fb53a4ebde5555e4
af151a8bc1feea6038b4b6d8e74b57d376c2dbfe195340437db999792a5eb38f
b2dac46045333dc7a12a49a714e8f53b66197272695393600ba440ce4d2b531c
bf873c2d15a7b7dfc1595e8ee76cc97fd8e8d1c4deff9d2a2a56328a8f8d91a8
c271b9c5c4b7495f005384e79d4c9e42b12d17d996c5973963cdee667cb599e1
c94f080a550a1f2d4fe07d371969b7a40c01606bd5624e8c03c976cbf5e06058
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
d79752e33e156b5cb219ab45103fe0ed7d80f111533dd8eec42c57546b4da500
dbce0348b7dc46f71d101212000ac4180c3a46f55f8f530aa5f9292b7fef0af9
e1dd4857cf68611937202e97ed063f7f3bd401d5300f807795ee504aa5e98450
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edf23a9c2fe1fd705890839fe8c94d5dd6224c3f26874aea62f53ab40985f46c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629