intercom.travelata.kg
Open in
urlscan Pro
5.101.36.98
Malicious Activity!
Public Scan
Submitted URL: https://intercom.travelata.kg/
Effective URL: https://intercom.travelata.kg/admins/sign_in
Submission: On June 03 via api from US — Scanned from DE
Effective URL: https://intercom.travelata.kg/admins/sign_in
Submission: On June 03 via api from US — Scanned from DE
Summary
This website contacted 10 IPs
in 4 countries
across 8 domains to perform 18 HTTP transactions.
The main IP is 5.101.36.98, located in
Kazakhstan, Kazakhstan and
belongs to EDGEAMLLC, AM.
The main domain is intercom.travelata.kg.
TLS certificate: Issued by R3 on May 31st 2024. Valid for: 3 months.
This is the only time intercom.travelata.kg was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 31st 2024. Valid for: 3 months.
This is the only time intercom.travelata.kg was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Intercom (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 2 | 5.101.36.98 5.101.36.98 | 201589 (EDGEAMLLC) (EDGEAMLLC) | |
| 5 | 13.225.78.67 13.225.78.67 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:82b::2008 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2600:9000:26d... 2600:9000:26da:9c00:10:b017:5c00:21 | 16509 (AMAZON-02) (AMAZON-02) | |
| 2 | 2600:9000:223... 2600:9000:223c:4600:10:8536:c280:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 52.18.63.80 52.18.63.80 | 16509 (AMAZON-02) (AMAZON-02) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:803::200e | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 13.224.189.49 13.224.189.49 | 16509 (AMAZON-02) (AMAZON-02) | |
| 2 | 18.173.187.125 18.173.187.125 | 16509 (AMAZON-02) (AMAZON-02) | |
| 2 | 54.162.26.109 54.162.26.109 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 18 | 10 |
2
5.101.36.98
(Kazakhstan, Kazakhstan)
ASN201589 (EDGEAMLLC, AM)
PTR: ao7.example.com
ASN201589 (EDGEAMLLC, AM)
PTR: ao7.example.com
| intercom.travelata.kg |
5
13.225.78.67
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-67.fra2.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-67.fra2.r.cloudfront.net
| static.intercomassets.com |
1
2a00:1450:4001:82b::2008
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| www.googletagmanager.com |
1
2600:9000:26da:9c00:10:b017:5c00:21
(United States)
ASN16509 (AMAZON-02, US)
ASN16509 (AMAZON-02, US)
| dp3rct5vic41c.cloudfront.net |
2
2600:9000:223c:4600:10:8536:c280:93a1
(United States)
ASN16509 (AMAZON-02, US)
ASN16509 (AMAZON-02, US)
| fonts.intercomcdn.com |
1
52.18.63.80
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-63-80.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-63-80.eu-west-1.compute.amazonaws.com
| canarytokens.com |
2
2a00:1450:4001:803::200e
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| www.google-analytics.com |
1
13.224.189.49
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-49.fra2.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-49.fra2.r.cloudfront.net
| widget.intercom.io |
2
18.173.187.125
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-125.muc50.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-125.muc50.r.cloudfront.net
| js.intercomcdn.com |
2
54.162.26.109
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-26-109.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-26-109.compute-1.amazonaws.com
| api-iam.intercom.io |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
intercomassets.com
static.intercomassets.com — Cisco Umbrella Rank: 17055 |
64 KB |
| 4 |
intercomcdn.com
fonts.intercomcdn.com — Cisco Umbrella Rank: 64457 js.intercomcdn.com — Cisco Umbrella Rank: 2114 |
387 KB |
| 3 |
intercom.io
widget.intercom.io — Cisco Umbrella Rank: 1597 api-iam.intercom.io — Cisco Umbrella Rank: 2092 |
4 KB |
| 2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 32 |
21 KB |
| 2 |
travelata.kg
1 redirects
intercom.travelata.kg |
18 KB |
| 1 |
canarytokens.com
canarytokens.com — Cisco Umbrella Rank: 708427 |
239 B |
| 1 |
cloudfront.net
dp3rct5vic41c.cloudfront.net |
201 KB |
| 1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39 |
105 KB |
| 18 | 8 |
| Domain | Requested by | |
|---|---|---|
| 5 | static.intercomassets.com |
intercom.travelata.kg
static.intercomassets.com |
| 2 | api-iam.intercom.io |
js.intercomcdn.com
|
| 2 | js.intercomcdn.com |
widget.intercom.io
|
| 2 | www.google-analytics.com |
intercom.travelata.kg
dp3rct5vic41c.cloudfront.net |
| 2 | fonts.intercomcdn.com |
static.intercomassets.com
|
| 2 | intercom.travelata.kg | 1 redirects |
| 1 | widget.intercom.io |
intercom.travelata.kg
|
| 1 | canarytokens.com |
intercom.travelata.kg
|
| 1 | dp3rct5vic41c.cloudfront.net |
intercom.travelata.kg
|
| 1 | www.googletagmanager.com |
intercom.travelata.kg
|
| 18 | 10 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.intercom.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| intercom.travelata.kg R3 |
2024-05-31 - 2024-08-29 |
3 months | crt.sh |
| intercomassets.com Amazon RSA 2048 M03 |
2024-04-17 - 2025-05-16 |
a year | crt.sh |
| *.google-analytics.com WR2 |
2024-05-13 - 2024-08-05 |
3 months | crt.sh |
| *.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
| *.intercomcdn.com Amazon RSA 2048 M02 |
2023-12-01 - 2024-12-29 |
a year | crt.sh |
| canarytokens.org R3 |
2024-04-15 - 2024-07-14 |
3 months | crt.sh |
| *.intercom.com Amazon RSA 2048 M03 |
2024-01-15 - 2025-02-11 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://intercom.travelata.kg/admins/sign_in
Frame ID: 970B8A6C9D619C30D72F29F354108A06
Requests: 14 HTTP requests in this frame
Frame:
https://js.intercomcdn.com/frame-modern.535d6e8b.js
Frame ID: D4846E971EAA6279DE1E6DC3F6B75DE2
Requests: 4 HTTP requests in this frame
Screenshot
Page Title
Intercom | The easiest way to see and talk to your usersPage URL History Show full URLs
-
https://intercom.travelata.kg/
HTTP 302
https://intercom.travelata.kg/admins/sign_in Page URL
Detected technologies
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.intercom.com/
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://intercom.travelata.kg/
HTTP 302
https://intercom.travelata.kg/admins/sign_in Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
sign_in
intercom.travelata.kg/admins/ Redirect Chain
|
11 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
core_styles_shim-51b5c4a3c0a9fd898ac4f07b323fced4339733c4ec79044fe578512d89adedc0.css
static.intercomassets.com/assets/ |
123 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
intercom-logo-b7b715b2c9baaf90a695a6fcab2f9c660f205bc793857bedb666504fbef888d5.svg
static.intercomassets.com/assets/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
www.googletagmanager.com/gtag/ |
323 KB 105 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gtm.latest.js
dp3rct5vic41c.cloudfront.net/ |
200 KB 201 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login-737f49225b30643ad597519dde111e2a773d923c8ee028046fa162fa0af7d469.js
static.intercomassets.com/assets/ |
168 B 625 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
google_g_logo-36x36-at-2x-7cd954075c56741d84c838f69188f38591848a470a0c2bfe2b949ade6aec59ec.png
static.intercomassets.com/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Graphik-Regular.woff
fonts.intercomcdn.com/graphik/ |
46 KB 47 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Graphik-Semibold.woff
fonts.intercomcdn.com/graphik/ |
49 KB 50 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
contact.php
canarytokens.com/static/v2x2e1rt20jamc6wwp84hyk89/ |
43 B 239 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
www.google-analytics.com/j/ |
3 B 213 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tx2p130c
widget.intercom.io/widget/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon-c3a224b12ac68054e53b9e2f542ea4c96044661e1195f6b25f22e1e1cd24f198.png
static.intercomassets.com/assets/ |
1 KB 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
frame-modern.535d6e8b.js
js.intercomcdn.com/ Frame D484 |
460 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
vendor-modern.1a13b382.js
js.intercomcdn.com/ Frame D484 |
492 KB 153 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
ping
api-iam.intercom.io/messenger/web/ Frame D484 |
166 B 794 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
metrics
api-iam.intercom.io/messenger/web/ Frame D484 |
0 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Intercom (Online)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| ga_click function| DOMPurify object| __SENTRY__ function| GTM function| getCookieValue object| emailSubmissionField boolean| recaptchaVerified object| emailField object| passField object| submitBtn function| recaptchaSuccess function| recaptchaFailure function| toggleSubmitBtn undefined| gtag object| dataLayer object| IntercomGTM string| p string| r object| m object| domainSuffixes string| GoogleAnalyticsObject function| ga object| intercomSettings function| Intercom object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaplugins object| gaGlobal object| gaData string| GTM_PAGEVIEW_URL object| pageViewPromise function| __intercomAssignLocation function| __intercomReloadLocation4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| intercom.travelata.kg/ | Name: _intercom_session Value: dWNsUVAzNlVQQzNGSEJ4bFNQVi94TmU4SCt1TExkY2llYW9qSHNzY1F3c3kwa1JzUXpqcitzSkU0R0hOaFNZbHdGejU0b1lzcWU1RDdwVnM0cVBVMTVCeDdDblY1Nk1TUVdrd1NtdGJTd2xWTjNObjJ5bFNXVHhrVWxUR0xTT1QrdFk2clBaQzdWNlJtSExGMzByTmxWSFJIRmFGMEhrTGd6cUtuUitQZFF0dU5oeDNLcVRVVUlEUnNXY3ZkaTd5SXl2MUs1U2VLdHBKb1hFOWs0T2g5ejhVTDEyOW90alV1YVcxa05hdzdBd1RHb0pUSTdmMWNkYUlCYkIreTB1cWFsWE95Qnc2ZUNxYmJaVDYzczEvRmhQU082WEwrMTZvNnFnZzFzN3NyMnRFZ081M04wVXFSVG1ZZnd0ckl1QWlPbm1sWXN5SFc3VURaZUxDa0FtZFlnPT0tLUI5NXRodTlOTWZZMlVrLzJkTmFCUHc9PQ%3D%3D--26291cf0af8fb02dd0928b4ad63a0f8b7435ea09 |
|
| .travelata.kg/ | Name: _ga Value: GA1.2.304174100.1717386573 |
|
| .travelata.kg/ | Name: _gid Value: GA1.2.1676450908.1717386573 |
|
| .travelata.kg/ | Name: _gat Value: 1 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'self'; base-uri 'self'; child-src 'self' docs.google.com fast.wistia.net fast.wistia.com js.stripe.com hooks.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com web.microsoftstream.com share.synthesia.io embed.app.guidde.com share.descript.com app.guideflow.com www.youtube.com www.youtube-nocookie.com content.jwplatform.com players.brightcove.net intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com insight.adsrvr.org apisandbox.zuora.com zuora.com www.zuora.com *.my.connect.aws www.recaptcha.net intercom.help intercom-help.eu au.intercom.help sharepoint.com *.sharepoint.com; connect-src 'self' app.intercom.com api-iam.intercom.io api-ping.intercom.io api-visitor-analytics.intercom.com nexus-websocket-a.intercom.io nexus-websocket-overflow.intercom.io via.intercom.io wss://nexus-websocket-a.intercom.io wss://nexus-websocket-overflow.intercom.io nexus-europe-websocket.intercom.io wss://nexus-europe-websocket.intercom.io nexus-australia-websocket.intercom.io wss://nexus-australia-websocket.intercom.io uploads.intercomcdn.com uploads.intercomcdn.eu uploads.au.intercomcdn.com static.intercomassets.com app.getsentry.com sentry.io api.stripe.com meet.intercom.com meet.eu.intercom.com meet.au.intercom.com preview.intercom.com www.google-analytics.com stats.g.doubleclick.net www.facebook.com static.intercomassets.eu app.eu.intercom.com api-iam.eu.intercom.io static.au.intercomassets.com api-iam.au.intercom.io api.au.intercom.io *.intercom-chat.com wss://*.nexus.intercom-chat.com *.messenger.intercom-chat.com graph.facebook.com *.twilio.com wss://*.twilio.com frontend-telemetry.intercom.io frontend-telemetry.eu.intercom.io frontend-telemetry.au.intercom.io user-presence.intercom.com; font-src data: https:; frame-src 'self' docs.google.com fast.wistia.net fast.wistia.com js.stripe.com hooks.stripe.com platform.twitter.com player.vimeo.com staticxx.facebook.com www.facebook.com web.facebook.com www.loom.com play.vidyard.com web.microsoftstream.com share.synthesia.io embed.app.guidde.com share.descript.com app.guideflow.com www.youtube.com www.youtube-nocookie.com content.jwplatform.com players.brightcove.net intercom-sheets.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com gtm.intercom-marketing.com intercominc.typeform.com www.intercom-reporting.com insight.adsrvr.org apisandbox.zuora.com zuora.com www.zuora.com *.my.connect.aws www.recaptcha.net intercom.help intercom-help.eu au.intercom.help sharepoint.com *.sharepoint.com; img-src data: blob: https:; media-src data: blob: https:; object-src 'none'; script-src 'self' js.intercomcdn.com static.intercomassets.com store.intercomassets.com billing-admin.intercomassets.com billing-internal.intercomcdn.com developer-home.intercomassets.com store.intercom.io widget.intercom.io api.tiles.mapbox.com connect.facebook.net js.stripe.com platform.twitter.com switchet.s3.amazonaws.com www.google-analytics.com munchkin.marketo.net app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com dp3rct5vic41c.cloudfront.net static.intercomassets.eu static.au.intercomassets.com static.zuora.com p.trellocdn.com www.recaptcha.net 'nonce-VWOsFhUmWhLy7v50lQK2uBj06AUHHi5X2XqbiqJza64=' 'unsafe-inline'; style-src 'self' 'unsafe-inline' static.intercomassets.com billing-internal.intercomcdn.com developer-home.intercomassets.com static.intercomcdn.com marketing.intercomassets.com api.tiles.mapbox.com fonts.googleapis.com maxcdn.bootstrapcdn.com app-sjqe.marketo.com app-sjst.marketo.com app-ab27.marketo.com fonts.intercomcdn.com static.intercomassets.eu static.au.intercomassets.com |
| Strict-Transport-Security | max-age=31556952; includeSubDomains; preload |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api-iam.intercom.io
canarytokens.com
dp3rct5vic41c.cloudfront.net
fonts.intercomcdn.com
intercom.travelata.kg
js.intercomcdn.com
static.intercomassets.com
widget.intercom.io
www.google-analytics.com
www.googletagmanager.com
13.224.189.49
13.225.78.67
18.173.187.125
2600:9000:223c:4600:10:8536:c280:93a1
2600:9000:26da:9c00:10:b017:5c00:21
2a00:1450:4001:803::200e
2a00:1450:4001:82b::2008
5.101.36.98
52.18.63.80
54.162.26.109
0994a3d3661344684acec971fc82154a4605c4b2bbd4a95a6c065140dff7811f
1a3f3d5b66e7ca76c15c19b6ae89f9050966528616ddfae0340fdd0f8d2cb7f6
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
51b5c4a3c0a9fd898ac4f07b323fced4339733c4ec79044fe578512d89adedc0
607d571f40b505cc56997c0e242ff9dfdc90d5591651533aa7524d08460ecb11
737f49225b30643ad597519dde111e2a773d923c8ee028046fa162fa0af7d469
7cd954075c56741d84c838f69188f38591848a470a0c2bfe2b949ade6aec59ec
80767a4e443ff4384e2950e6cb85baa0aeaeb7dbdfc30317fb10ab33287090d0
818b15814b8ba5895a1e882ae38a245fa6509ee47d6efff9b185a0d3cf8620ef
a52f3ca3c9e604f08e2a61f85beaf7d750930ed3d3d8e18f29c20584da338e68
aed81679b5757be0719d08cb6c986629a2a436fc6eb643d32363484dcaf326b3
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b7b715b2c9baaf90a695a6fcab2f9c660f205bc793857bedb666504fbef888d5
bb47f19613d341d00d0f3379cf0f89f3e04462ea0265ae21fba2f1aae55176fa
c31f9617ab13c0c1643f28a2edc660051b1cb81fa31c61be93d4cccb4c1747c0
c3a224b12ac68054e53b9e2f542ea4c96044661e1195f6b25f22e1e1cd24f198
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd