![](/screenshots/1005feec-4236-4457-abbc-f14903e8935b.png)
malware.news
Open in
urlscan Pro
172.67.74.65
Public Scan
Submission: On September 27 via api from GB — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2021. Valid for: a year.
This is the only time malware.news was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
33 | 172.67.74.65 172.67.74.65 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 142.250.185.174 142.250.185.174 | 15169 (GOOGLE) (GOOGLE) | |
7 | 162.159.152.4 162.159.152.4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 162.159.153.4 162.159.153.4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
43 | 5 |
ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f14.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
33 |
malware.news
malware.news |
1 MB |
8 |
medium.com
cdn-images-1.medium.com medium.com |
1 MB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
43 | 3 |
Domain | Requested by | |
---|---|---|
33 | malware.news |
malware.news
|
7 | cdn-images-1.medium.com |
malware.news
|
2 | www.google-analytics.com |
malware.news
www.google-analytics.com |
1 | medium.com |
malware.news
|
43 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.youtube.com |
cdn-images-1.medium.com |
gchq.github.io |
github.com |
www.virustotal.com |
gist.github.com |
malpedia.caad.fkie.fraunhofer.de |
www.zdnet.com |
us-cert.cisa.gov |
ryancor.medium.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-15 - 2022-06-14 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-08-30 - 2021-11-22 |
3 months | crt.sh |
medium.com Cloudflare Inc ECC CA-3 |
2021-09-01 - 2021-11-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://malware.news/t/deobfuscating-powershell-malware-droppers/53056
Frame ID: CB4397D95B8A0991758C3F8DAEB6FD92
Requests: 44 HTTP requests in this frame
Screenshot
![](/screenshots/1005feec-4236-4457-abbc-f14903e8935b.png)
Page Title
Deobfuscating PowerShell Malware Droppers - Malware Analysis - Malware Analysis, News and IndicatorsDetected technologies
Detected patterns
- medium\.com
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
28 Outgoing links
These are links going to different origins than the main page.
Title: video
Search URL Search Domain Scan URL
Title: Ahmed S Kasmani 2
Search URL Search Domain Scan URL
Title: 770×345
Search URL Search Domain Scan URL
Title: 761×268
Search URL Search Domain Scan URL
Title: 1024×571
Search URL Search Domain Scan URL
Title: 1024×518
Search URL Search Domain Scan URL
Title: 1024×54
Search URL Search Domain Scan URL
Title: cyberchef
Search URL Search Domain Scan URL
Title: 1024×730
Search URL Search Domain Scan URL
Title: 1024×795
Search URL Search Domain Scan URL
Title: 1024×795
Search URL Search Domain Scan URL
Title: 1024×113
Search URL Search Domain Scan URL
Title: 1024×538
Search URL Search Domain Scan URL
Title: 1024×593
Search URL Search Domain Scan URL
Title: 1024×155
Search URL Search Domain Scan URL
Title: 1024×659
Search URL Search Domain Scan URL
Title: 1024×404
Search URL Search Domain Scan URL
Title: here
Search URL Search Domain Scan URL
Title: 1024×796
Search URL Search Domain Scan URL
Title: 1024×657
Search URL Search Domain Scan URL
Title: jackpot
Search URL Search Domain Scan URL
Title: 1024×250
Search URL Search Domain Scan URL
Title: Dropper Part I
Search URL Search Domain Scan URL
Title: Dropper Part II
Search URL Search Domain Scan URL
Title: Malpedia: Turla Group
Search URL Search Domain Scan URL
Title: ZDNet: Hacking group steals antivirus logs to see if its malware was detected
Search URL Search Domain Scan URL
Title: CISA: Malware Analysis Report (AR20–303A)
Search URL Search Domain Scan URL
Title: Deobfuscating PowerShell Malware Droppers | by Ryan Cornateanu | Sep, 2021 | Medium 2
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
43 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
53056
malware.news/t/deobfuscating-powershell-malware-droppers/ |
139 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
browser-detect-115ab5953de1b5bb122bfb26b757f5391dd8d1d2aef2b81baf7b59aee99d9f34.js
malware.news/assets/ |
247 B 551 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en-b4c652e74e1f00d0e6059b6bf4aae63aedc7ef40ec1cd31a2d5494431da11f82.js
malware.news/assets/locales/ |
256 KB 75 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ember_jquery-36a23101c869ab0dc53fc908de69adb785731593573d32bdeef416acc1076ef4.js
malware.news/assets/ |
557 KB 157 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-72ed7d3a2757503f5d4b387ef519a6f371137f63e3b8f1ff29544b54c1d8450f.js
malware.news/assets/ |
173 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pretty-text-bundle-0651e2a797c3ce2e7029301b15f1e2d11ab1286bea425eaf70aac53d80e226ee.js
malware.news/assets/ |
150 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-3df47873cd9bb1ffc9f33b03e1c6ae8ca41d140f3208fb6b80353c289123e986.js
malware.news/assets/ |
3 MB 505 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-details-9be9806ef2338ede8e5c567dfd5b521aaad27d01694f01c604516118466d2120.js
malware.news/assets/plugins/ |
1 KB 1021 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-local-dates-fb84b6e975839c2af6c7ffe54ef3f37631eb79d1ca4c032e3232c522b202b185.js
malware.news/assets/plugins/ |
32 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-narrative-bot-0b1e40d099d739cee23bbad45c2fb5eac1dcaaba028fdc9fa21b9e32930ec40b.js
malware.news/assets/plugins/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-presence-b6fbd1a4370db8cbe9a6026b149f4c857b4f4a71b0f72eefda4a295d0ed6a56a.js
malware.news/assets/plugins/ |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
docker_manager-ad177f91e75af171560e0d79a81bd5ce7b5b01c80c9055a24d75e9370c9de28b.js
malware.news/assets/plugins/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lazy-yt-9db193c8caacf2e3b3a24ed4c63699ad497c210f668f467d95380efd00982345.js
malware.news/assets/plugins/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll-4ece327052472a4245ca79c494a4bc3ad9b1f49d921e2df8b00a2299303f04bd.js
malware.news/assets/plugins/ |
59 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js
malware.news/assets/ |
725 B 772 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
color_definitions_base__1685c93a050ced147a1038a195b8e1dd02483a6a.css
malware.news/stylesheets/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktop_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
372 KB 67 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-details_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
1 KB 870 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-local-dates_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-narrative-bot_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
153 B 566 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
discourse-presence_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lazy-yt_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
poll_desktop_787482ef26fe5197f888d4afa236f1d8edce38ec.css
malware.news/stylesheets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
desktop_theme_2_1eb7402e0a8095456972b2383753bd3ab76231e8.css
malware.news/stylesheets/ |
90 B 571 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
start-discourse-efa4e5abfbd1b50b5152ffbe64d5dcea9f7c33f766dcc6387e2711f0f2112148.js
malware.news/assets/ |
135 B 497 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js
malware.news/assets/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
svg-2-9b0d85c163090ed00004e0abb5db8bd226e57ab5.js
malware.news/svg-sprite/malware.news/ |
114 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.magnific-popup.min.js
malware.news/javascripts/magnific-popup/1.1.0/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cdefff4af52a8d2d43094b5d57ebca1fc7613a63.js
malware.news/highlight-js/malware.news/ |
202 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24_2.png
malware.news/user_avatar/malware.news/malbot/45/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
37 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*PyTd6P0FzsQA9nu_CBfRuQ.png
cdn-images-1.medium.com/max/1024/ |
48 KB 48 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*zTw6U_nILQnu-d624fezSQ.png
cdn-images-1.medium.com/max/1024/ |
97 KB 97 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*5KxejX-A7IuGaWR7lyUX6A.png
cdn-images-1.medium.com/max/1024/ |
53 KB 53 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stat
medium.com/_/ |
43 B 633 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*YTIYg7N_3N8Zj3xiq1icVA.png
cdn-images-1.medium.com/max/770/ |
27 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*BIf9pJqt18CQfClcmc-rHg.png
cdn-images-1.medium.com/max/761/ |
32 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*yBQU9rG-T2stllALAmE5vg.png
cdn-images-1.medium.com/max/1024/ |
591 KB 591 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1*yvboEjYjpmEEKTXCi6OkvA.png
cdn-images-1.medium.com/max/1024/ |
226 KB 226 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 205 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
poll
malware.news/message-bus/0083a802255145519df0c125d01abc24/ |
266 B 0 |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
44 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| I18n object| MessageFormat function| moment function| define function| requirejs object| ENV object| EmberENV function| $ function| jQuery object| mainContext object| Ember object| Em function| require function| requireModule object| Markdown object| bootbox object| clone object| Logster object| Handlebars object| MessageBus object| Popper function| _ function| Mousetrap object| RSVP object| BufferedProxy string| __INDIVIDUAL_ONE_VERSION_ev-store_ENFORCE_SINGLETON undefined| __INDIVIDUAL_ONE_VERSION_ev-store object| virtualDom function| filterCSS function| filterXSS function| __t object| __DISCOURSE_RAW_TEMPLATES object| Discourse object| __widget_helpers string| GoogleAnalyticsObject function| ga undefined| $bu object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| hljs4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.malware.news/ | Name: _ga Value: GA1.2.713042485.1632719285 |
|
.malware.news/ | Name: _gid Value: GA1.2.598444837.1632719285 |
|
.malware.news/ | Name: _gat Value: 1 |
|
.medium.com/ | Name: __cfruid Value: bd246c2745be15e83b2955ad58b4d463625282c1-1632719284 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | base-uri 'none'; object-src 'none'; script-src https://malware.news/logs/ https://malware.news/sidekiq/ https://malware.news/mini-profiler-resources/ https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/extra-locales/ https://malware.news/highlight-js/ https://malware.news/javascripts/ https://malware.news/plugins/ https://malware.news/theme-javascripts/ https://malware.news/svg-sprite/ https://www.google-analytics.com/analytics.js; worker-src 'self' https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/javascripts/ https://malware.news/plugins/ |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-images-1.medium.com
malware.news
medium.com
www.google-analytics.com
142.250.185.174
162.159.152.4
162.159.153.4
172.67.74.65
003c3d882b326d441cae76648a6510f6c8404353de5d54e76883a2fb61b6cdd1
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
093714378e2e61720fdd442517e5ac12580f7e7231aff8b07fa99cb1a925353d
0b37d1d5fdce07501dbcf92e59de22bcb3b59cf179c2c4ae85c6b4e53d7a33ac
180110a7a4ac1df81ccd0d022e0929949ba0d85dddf4beb145ea590b86bd9715
19089746082c9d1ae6b7fb6e3218eafa4411abffe26412d4d823cb304683c045
1ab3d376b5d18228e95af2f61f4ea5ee12a4200177969694c347048fb41c9b7c
1daf903ee846f106e08e2a131f4800ffbf8837d227192192e1f00d6fb0a6027f
26bb701f8d2bc0c26311703286ce254d544f90716a9bc111477a3e8807546e40
33297b8ff0a3ff89d902dbe2996700cc22fc1fe51faac6a28e0aaf9a4bb0d800
36e56ff433d1e7c0017688ed51d42dea37fc7a90431b54d4568df80746ed349b
3c15affcf691f574f368f5aa118ac2202984c42a17b4a76bde374cdb7c854454
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
40526df990780061385831eb7143db974cf389583c704c0f986284d2d8d3a0d3
430ac06a9912729cedf0e6c618b7ad7d8c1a7623b380b60312dd17b0037f36ce
439310fe70c9254ca886a5848ab84ece7a2d0b9f1d7eb654e35ee1af86b1d0d9
45f6ca8487d4a39609e9395229775921286ab6e5ba65116ed0f5becb5928bf4b
5ccf20c77e2159876f53e2e7903140447691cd93ea5fdf38142a34cc37c0a1fa
5dc2f3f0b6682457b113ec4e3641049d51488e18deaa8185831f4973cb57f97e
6ba10e33fc40749d8e0a6e2ab2f0271c2bc89f8aca0c4432000456d2a9912ea9
70295e23173942999f6560f098b372fb27ad0de5bc1a1e195c6ef5af18dfc856
70f1cbf2697ee3da0fce545369f9ff2394d5a67afb1920b1433dabd5d299c436
7e6dbcb4fa67139ef1bfb019ef153f21b130a1f68f7d5bbe3c15033c14342ff7
7eedbeb43c93c8d82301cb78609a457a55cec956398be4b7dd6d12f0fac1d516
8ac752cf3429ed4d1322aaece17556cb40319d80cef682f0ee5cbb9e1438a0fa
8d814ada502cfca69414ee2168f70cc98bdf53153a31b47548c0be6d75c5c046
9487cb559d6168d8f29a5684b10a9c253776e7280ea758f332902773d85367e5
9bc63a02041e3cbc9365d2a70224f9c22ca5e31897e72e0b3cb620259250a556
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a6915794955aa02a862c6286b6ae26b9ad45b49d9a095ecd1c9d1b7f8b498778
a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442
aa7aadbd1349c23ab2ab4bfecc563e091b07aad49739b21fa4a2ed2047fa57c1
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b64d6f3b3fafe479610cfa9b4b86fcef473ba7d0dfc5f68c8e9de52ed4774075
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
dbf6e5a1bdcf7981e49d952fc5e62e36715904a838584c9c7da9a49c62290baf
dc2ef7aec684905f7cff2b2e99381f3f423814dd2958d76e5ec70d0c6979f60d
dd2536f946af509cb93bdd7b146389101dbc8f8d9891d0af83e801b217d3e9ce
dd8eb5f29381950bd2d56653f3a9aeb82ca7b0bcbadc5903d48f335d1a0f0fa7
dd9e6a6acb9f58dc36a1826208b1294313f850a38089456c5ebeea0bfc2a639e
f25487aa53b51b4c355c8c8dcfe481294a929e8e6c8ab3f4c1b0d84115803fb5
f7f819ee6aa6609d661c8a68c5d2a479df0c397eda778e0026337f53f343df35
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62