ad.corerewards.com
Open in
urlscan Pro
13.82.46.233
Public Scan
Effective URL: https://ad.corerewards.com/SecureNewPageTemplates/Secured/Login.aspx?PageID=289
Submission: On August 01 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 7th 2023. Valid for: a year.
This is the only time ad.corerewards.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.115.56 167.89.115.56 | 11377 (SENDGRID) (SENDGRID) | |
1 1 | 3.33.152.147 3.33.152.147 | 16509 (AMAZON-02) (AMAZON-02) | |
3 20 | 13.82.46.233 13.82.46.233 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 2a02:26f0:310... 2a02:26f0:3100::1735:28ea | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 2606:4700::68... 2606:4700::6812:1734 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:82b::2008 | 15169 (GOOGLE) (GOOGLE) | |
4 | 52.239.155.132 52.239.155.132 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:26f0:780... 2a02:26f0:780::210:a419 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
6 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
35 | 7 |
ASN11377 (SENDGRID, US)
PTR: o16789115x56.outbound-mail.sendgrid.net
mail.corerewards.com |
ASN16509 (AMAZON-02, US)
PTR: a4ec4c6ea1c92e2e6.awsglobalaccelerator.com
www.adhqrewards.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ad.corerewards.com |
ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com | |
ka-p.fontawesome.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
coreperformancefiles.blob.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
corerewards.com
4 redirects
mail.corerewards.com ad.corerewards.com |
249 KB |
6 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 1914 |
452 B |
4 |
windows.net
coreperformancefiles.blob.core.windows.net |
480 KB |
3 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 2025 ka-p.fontawesome.com — Cisco Umbrella Rank: 3621 |
23 KB |
3 |
typekit.net
use.typekit.net — Cisco Umbrella Rank: 569 p.typekit.net — Cisco Umbrella Rank: 686 |
28 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 73 |
159 KB |
1 |
adhqrewards.com
1 redirects
www.adhqrewards.com |
295 B |
35 | 7 |
Domain | Requested by | |
---|---|---|
20 | ad.corerewards.com |
3 redirects
ad.corerewards.com
|
6 | region1.google-analytics.com |
www.googletagmanager.com
|
4 | coreperformancefiles.blob.core.windows.net |
ad.corerewards.com
|
2 | ka-p.fontawesome.com |
kit.fontawesome.com
|
2 | www.googletagmanager.com |
ad.corerewards.com
www.googletagmanager.com |
2 | use.typekit.net |
ad.corerewards.com
use.typekit.net |
1 | p.typekit.net |
use.typekit.net
|
1 | kit.fontawesome.com |
ad.corerewards.com
|
1 | www.adhqrewards.com | 1 redirects |
1 | mail.corerewards.com | 1 redirects |
35 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.loewshotels.com |
coreperformancefiles.blob.core.windows.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.corerewards.com Go Daddy Secure Certificate Authority - G2 |
2023-02-07 - 2024-03-10 |
a year | crt.sh |
use.typekit.net DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-09-14 - 2023-10-15 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-22 - 2023-12-23 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
*.blob.core.windows.net Microsoft RSA TLS CA 02 |
2023-03-22 - 2024-03-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ad.corerewards.com/SecureNewPageTemplates/Secured/Login.aspx?PageID=289
Frame ID: 6004FB64F462B17CE582016FDFCD9D28
Requests: 35 HTTP requests in this frame
Screenshot
Page Title
AD RewardsPage URL History Show full URLs
-
http://mail.corerewards.com/ls/click?upn=7KFPWOpJp5XlUTAXpw6WAvtsAIdw7NbuMdqSeYR-2BO0Dtk3I-2BQZkVXAd27P0...
HTTP 302
http://www.adhqrewards.com/ HTTP 301
http://ad.corerewards.com/ HTTP 301
https://ad.corerewards.com/ HTTP 302
https://ad.corerewards.com/login.aspx?ReturnUrl=%2f HTTP 302
https://ad.corerewards.com/SecureNewPageTemplates/Secured/Login.aspx?PageID=289 Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Microsoft ASP.NET (Web Frameworks) Expand
Detected patterns
- \.aspx?(?:$|\?)
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
Google Analytics (Analytics) Expand
Detected patterns
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Typekit (Font Scripts) Expand
Detected patterns
- <link [^>]*href="[^"]+use\.typekit\.(?:net|com)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Loews Hotel & Co Destinations
Search URL Search Domain Scan URL
Title: Not a Member? Click here for details.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail.corerewards.com/ls/click?upn=7KFPWOpJp5XlUTAXpw6WAvtsAIdw7NbuMdqSeYR-2BO0Dtk3I-2BQZkVXAd27P0LfEb41AeL_LDzayZpYuiaeDJY-2F6v9K-2B2iZnXqqYeJ7nwMue1uLaJJ0mXpe9d-2FyOr1Cs82lMyP2EAmmYV85pTiXJWOrqkIthxht7HffdXOk5RF0PWHa3aInfRhw-2F-2B7dacRRMdxc60hmvDgii6QfzoYLwGPrJshSHyLuc2Vv2pqwZY4X6AH19p-2FyHljbOKXNg2qm-2FjyH9w6bXUOrXYHkDenkm1fk74A-2Bi-2Fd6-2B-2BkQ5NXRLJa8AhWENg3I4HhGXNrEUgyBrffW7pJoM2ew-2BEDq2hakyPZw7SBSzg-3D-3D
HTTP 302
http://www.adhqrewards.com/ HTTP 301
http://ad.corerewards.com/ HTTP 301
https://ad.corerewards.com/ HTTP 302
https://ad.corerewards.com/login.aspx?ReturnUrl=%2f HTTP 302
https://ad.corerewards.com/SecureNewPageTemplates/Secured/Login.aspx?PageID=289 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
35 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Login.aspx
ad.corerewards.com/SecureNewPageTemplates/Secured/ Redirect Chain
|
24 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yaa7ory.css
use.typekit.net/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d7e26cfa54.js
kit.fontawesome.com/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
ad.corerewards.com/content/ |
159 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.4.1.min.js
ad.corerewards.com/scripts/ |
86 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
ad.corerewards.com/scripts/umd/ |
20 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
ad.corerewards.com/scripts/ |
58 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
226 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
addtohomescreen.css
ad.corerewards.com/scripts/addtohome/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
addtohomescreen.js
ad.corerewards.com/scripts/addtohome/ |
39 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
1 KB 652 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
25 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
2 KB 909 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebResource.axd
ad.corerewards.com/ |
23 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Telerik.Web.UI.WebResource.axd
ad.corerewards.com/ |
501 KB 125 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Base.css
ad.corerewards.com/styles/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad.css
ad.corerewards.com/Content/BrandingCSS/ |
2 KB 827 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_image_advertisment_forCustomers.png
coreperformancefiles.blob.core.windows.net/coreperformancefiles/images/platform/AD_Canada/PlatformImages/ |
46 KB 46 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_image_forCustomers.png
coreperformancefiles.blob.core.windows.net/coreperformancefiles/images/platform/IES/ |
39 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p.css
p.typekit.net/ |
5 B 172 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro-v4-shims.min.js
ka-p.fontawesome.com/releases/v5.15.4/js/ |
14 KB 4 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro.min.js
ka-p.fontawesome.com/releases/v5.15.4/js/ |
40 KB 14 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ad_rewards_logo_tag_eng_hires_rgb%402x.jpg
coreperformancefiles.blob.core.windows.net/coreperformancefiles/images/platform/AD/SupplierLogos/ |
72 KB 72 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg_adrewards_home.jpg
coreperformancefiles.blob.core.windows.net/coreperformancefiles/images/platform/AD/ |
322 KB 322 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/3f7b4d/00000000000000003b9acb2d/27/ |
26 KB 26 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 256 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
227 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
region1.google-analytics.com/g/ |
0 17 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
region1.google-analytics.com/g/ |
0 17 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
79 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| FontAwesomeKitConfig function| $ function| jQuery function| Popper number| uidEvent object| bootstrap function| gtag object| dataLayer function| addToHomescreen object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_SimulateClick function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY function| Sys$Enum$parse function| Sys$Enum$toString function| Sys$Component$_setProperties function| Sys$Component$_setReferences function| $create function| $addHandler function| $addHandlers function| $clearHandlers function| $removeHandler function| $get function| $find object| commonScripts function| Type object| Sys object| _events object| Telerik object| $telerik object| TelerikCommonScripts object| __TsmHiddenField object| platformManifest function| a object| ___FONT_AWESOME___ object| fontawesome-pro-shims object| FontAwesomeConfig object| FontAwesome object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ad.corerewards.com/ | Name: ARRAffinity Value: a65dd16f05c746f847335f79da7aa07bd1a85666330bf4f51239e9b4ba79498a |
|
.ad.corerewards.com/ | Name: ARRAffinitySameSite Value: a65dd16f05c746f847335f79da7aa07bd1a85666330bf4f51239e9b4ba79498a |
|
ad.corerewards.com/ | Name: PATWebSession Value: fgv43yplklql5mtfmkctpku5 |
|
.corerewards.com/ | Name: _ga Value: GA1.1.1935581374.1690893098 |
|
.corerewards.com/ | Name: _ga_1P5N0H5LH8 Value: GS1.1.1690893097.1.0.1690893097.0.0.0 |
|
.corerewards.com/ | Name: _ga_8XPQ6M6HSH Value: GS1.1.1690893097.1.0.1690893097.0.0.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ad.corerewards.com
coreperformancefiles.blob.core.windows.net
ka-p.fontawesome.com
kit.fontawesome.com
mail.corerewards.com
p.typekit.net
region1.google-analytics.com
use.typekit.net
www.adhqrewards.com
www.googletagmanager.com
13.82.46.233
167.89.115.56
2001:4860:4802:34::36
2606:4700::6812:1734
2a00:1450:4001:82b::2008
2a02:26f0:3100::1735:28ea
2a02:26f0:780::210:a419
3.33.152.147
52.239.155.132
0db25e340ee527d0e457abbaf331b0506b334f2727362cf6209546b1b966ec28
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb
4a221530681185d5e32924c875d5fb9a1f486ce5d573041673bfe9e274ba0ffd
4c7cb6c3c4be6580aa49c0bf23a13c2b0402e266e7be45c40a82f41a9f04cae3
4ffdfd660ef785f6020579a08ddd0481dd41193cd59b2280b2af22912f89ee2d
593e4a081526b86b239549964ef75a106b122fdc89047627a843cbaef4a304ac
608a954429aae4272a3177673626798451c46632c7de5b1d7c133d683be9c488
6d018997e5f8ec6d650cff7d193b9144112acc35c8be20a9c6a84aa2a420119b
6dbaa24b431859b8bfbb40359a3cc209220a88ba6fe66f684ed6d41a91aa670a
6e42866a64ab14eb3519cd428256b7f5a7fee22002675c13f964740ae6b72440
7036bb870f6b89b96ec2ff63150ab833b8ae63fb725dfc472129f7f99ce24791
70ff79709c211842ef0cfe4bdae64e240784e619676a93a4c277414eafe0092b
7f29f0c0d79ab5709a70743ab3073111ecd500be2f62353503b6965524e543e4
895007a0cd0e769c9d4c3763d2b3cdd09dc3c19c1036929061df323a4fe101ba
9cab4c340a5facb8dca439238ceb35ad0a4a685ae94b088115fcf2313b550a21
a6c3dcc4a1fc0a8521320d9f67b58ddfadafb11d7131a85976c500fd113ce0ea
a9c1d254a7f05efed17fecfdffb1567b2d8ec37110a17bd0778cf4ad90a5a901
b803181c0425687ab56ee28bc2b93b145e2ac6f70b5a7b52dbf0e974ab9c7e65
bf764d1a048d8ea1ff523cafb8eb2dcc417c7e24468eadd7e297de3956a37a2f
cb3b0e13675a93accf1022b0b5ceaed49c15eb9a8c893898a9de286ae03adfc1
cf93bcf57907d37087e82cb787413a5df55ff7dddde3f4cd58b724c5ee3dbf1c
db610e75334605d418437f5d04cece71837c8fe605777dfa42c8bb1bd9b841d8
dc4cb7d0f26435c7fd2eb2bb088aabba3a2aefd6beb89a8a818b1a0438f5e44a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e408afadb30bf7807b2604d6a332cb91b0ce073ffef23817f7982abaf7e6708b
e7366b51b3d8e29923f556519aa9391bc6ebfe3ff2e2659c7805b78237f60a3d
ef7d9bc9eae3ef6ef684192bc8a63f1ea44a25362396b0a1bf548eaa0c505c47
f24b6afb91ff8c4f0f9bcaf87736d7b33fd2153716e219eb4327d728433bd26c