mirror of https://github.com/avast/ioc
BluStealer IOC
This commit is contained in:
Anh Ho
parent
88b70aeedd
commit
cad293b058
|
|
@ -0,0 +1,113 @@
|
|||
# IoC for BluStealer
|
||||
|
||||
Malware analysis and more technical information at <https://decoded.avast.io/anhho/blustealer/>
|
||||
|
||||
|
||||
### Table of Contents
|
||||
* [BluStealer](#samples-sha-256)
|
||||
* [Network indicators](#network-indicators)
|
||||
|
||||
|
||||
## BluStealer
|
||||
#### SHA-256
|
||||
```
|
||||
678e9028caccb74ee81779c5dd6627fb6f336b2833e9a99c4099898527b0d481
|
||||
3151ddec325ffc6269e6704d04ef206d62bba338f50a4ea833740c4b6fe770ea
|
||||
7603f8e827ab78d5ff15be1b04b9a02821edf3bf90475295e0c7c792bc328f63
|
||||
7abe87a6b675d3601a4014ac6da84392442159a68992ce0b24e709d4a1d20690
|
||||
49da8145f85c63063230762826aa8d85d80399454339e47f788127dafc62ac22
|
||||
5ff29232adcc335d007ee55421d2d6bb4ac171becf2b9b9a7595d6e4b9fc13e1
|
||||
edab175c91e078e92b57446111cb07c61e357d9a12274cab33872e14d4511ea9
|
||||
8ba38dfdaed05011a8f9d19eec1670efa63cce30f23609a3c00afb265aa22ad8
|
||||
c52a0ce16c6db82bf194988a0094a4b18aec550f1953b5e9ab127c0b84f4ecca
|
||||
1885c2faae1cf90783c7fc9ea93506e8241232e90bdaeae4ca04a5cb305e13f3
|
||||
e6ed1d0f3827d5a2e6fd38ec812456b62ee702bdaa460f7f6ef5298db5136df5
|
||||
61560f470822a249950e3d35574aae0ee9c93da31c1fd6f001c0cec97069a4fb
|
||||
1e41442f28a2328a8cec90459483ae5da9b21484b2bdd2b2e206e34a8f5672bc
|
||||
6384e3d112dfb4f7d3f2761764e491383f20cffbb7a180a087b22ef903bcc9a6
|
||||
037815f51ba857c16a5c98aa37a2acba3430b0d27de3abf558cda2bff50fa35e
|
||||
b9dcf75696ba71f292246a31877cc8c833676c5c8c241e65c741711388d99bcb
|
||||
d1c69a54577f5c6491b2979279b04c5db668e20968363d7476848d152bb94362
|
||||
e6ed1d0f3827d5a2e6fd38ec812456b62ee702bdaa460f7f6ef5298db5136df5
|
||||
fbab6f778d521589e9371227f25112fed34c19efa9f3cc068bdcffe304d67111
|
||||
620ce6c90baeaba37fb4e4ad1edcb0a862e12e1b058eaa8c41bed7439c3bd983
|
||||
0872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
|
||||
b340e287c5c5cd48a5d27c71808dc75c3fd3a69a6cad029db2332e19d998bb82
|
||||
aef52ead2a03729f95962c511947226d78fe856d29ccfaacf25e1c002c0c9f92
|
||||
35d443578b1eb0708d334d3e1250f68550a5db4d630f1813fed8e2fc58a2c6d0
|
||||
c783bdf31d6ee3782d05fde9e87f70e9f3a9b39bf1684504770ce02f29d5b7e1
|
||||
42fe72df91aa852b257cc3227329eb5bf4fce5dabff34cd0093f1298e3b5454e
|
||||
1c29ee414b011a411db774015a98a8970bf90c3475f91f7547a16a8946cd5a81
|
||||
81bbcc887017cc47015421c38703c9c261e986c3fdcd7fef5ca4c01bcf997007
|
||||
6322ebb240ba18119193412e0ed7b325af171ec9ad48f61ce532cc120418c8d5
|
||||
4932ea0c29c86544f03f9425b8088886d68a5965be8541a8d9c36a9b95eeacf9
|
||||
7b1fc82d47470ee3c7f8de53a959eb55febe3c4c6ba408190a877396907f8293
|
||||
5d5e9bc60284b01bc75bec81489654b56a739d81acce580cdff735070d9e831f
|
||||
43c2649b8f43a3a39f3d5f93347ac0460b9ccf910bda544e84a07769e1af34bd
|
||||
bc52d9795f801ca6872502c6e8af05cf3730384062f3b90113abc30ff9395879
|
||||
304c188b1452beea8b8a1f8bd4ac64b02781665792b46df692762b18685b1ccb
|
||||
75839121c06dd5f7ea7a32ced2755c8913ae81f7225ef6e790c131a5554034fa
|
||||
b2a74a9349ed9ebe01b89786e5472ac4cb437cec7bfb7107e135baa69d41e11a
|
||||
21f75377b964d884a9c32849b766d52f43dc05a5e53a3bf5665473abc15d7740
|
||||
efd63437050cbce03fb4e13c4be8858d0793ceaf678ffed8e6369578037fb6e1
|
||||
274bcc8a907b7f1bbfceb5b0e9f0f8f6d0dbdc65d774ce135467b704f755db81
|
||||
7881a0b4a3b923ae091c09e3498e1513ff8872a56fbf7977777ad6776a781b0b
|
||||
b9933e298be75df66ed2eee62207815a20ec36cbfae9b098c24739f0d712aacf
|
||||
add711e10bfde4da3e2048a27d8c8eab084e2df5bde714437ff2dd5dc0baa505
|
||||
```
|
||||
|
||||
#### Crypto Address List
|
||||
```
|
||||
1ARtkKzd18Z4QhvHVijrVFTgerYEoopjLP (1.67227860 BTC)
|
||||
1AfFoww2ajt5g1YyrrfNYQfKJAjnRwVUsX (0.06755943 BTC)
|
||||
1MEf31xHgNKqyB7HEeAbcU6BhofMdwLE3r
|
||||
38atNsForzrDRhJoVAhyXsQLqWYfYgodd5
|
||||
bc1qrjl4ksg5h7p70jjtypr8s6cjpngzd3kerfj9rt
|
||||
bc1qjg3y4d4t6hwg6h22khknlxcstevjg2qkrxt6qu
|
||||
1KfRWVcShzwE2Atp1njogAqH8qodsif3pi
|
||||
3P6JnvWtubxbCxgPW7GAAj8u6CLV2h9MkY
|
||||
13vZcoMYRcKrDRDYUyH9Cd4kCRMZVjFkyn
|
||||
qrej5ltx0sgk5c7aygdsvt2gh7fq04umvusxhxl7wq
|
||||
qrzakt59udz893u2uuwtgrwrjj9dhtk0gc3m4m2sj5
|
||||
0xd070c48cd3bdeb8a6ca90310249aae90a7f26303 (0.10 ETH)
|
||||
0x95d3763546235393B77aC188E5B08dD4Af68d89D
|
||||
0xcfE71c720b7E99e555c0e98b725919B7a69f8Bb0
|
||||
46W5WHQG2B1Df9uKrkyuhoLNVtJouMfPR9wMkhrzRiEtD2PmdcXMvQt52jQVWKXUC45hwYRXhBYVjLRbpDu8CK2UN2xzenr
|
||||
43Q4G9CdM3iNbkwhujAQJ7TedSLxYQ8hJJHYqsqns7qz696gkPgMvUvDcDfZJ7bMzcaQeoSF86eFE2fL9njU59dQRfPHFnv
|
||||
LfADbqTZoQhCPBr39mqQpf9myUiUiFrDBG
|
||||
LY5jmjdFnvgFjJET2wX5fVV6Gv89QdQRv3
|
||||
GCGIOH2DY63P3EX4UIKXDN757DFGHWAYRBFZ5FD7QOJTXAOUTHF64RIA
|
||||
GBQAOVKWPEY3M373CZSN2EQSIGRXWG3J4SNLOQNVCWRUYK7S4RJXKTOJ
|
||||
r3xDYvq9FEqk37aDmS8S1WWSst58AiykVq
|
||||
rKJedgqQy12s8Y7y4ziL9kWkMMzfJ2wfAm
|
||||
```
|
||||
|
||||
## Network indicators
|
||||
#### Download URL
|
||||
```
|
||||
hxxps://cdn[.]discordapp.com/attachments/829530662406193185/881703391888281630/TME_delivery_status.iso
|
||||
hxxps://cdn[.]discordapp.com/attachments/829530662406193185/882099214866333706/Shipment_Receipt.pdf.iso
|
||||
```
|
||||
|
||||
#### SMTP
|
||||
```
|
||||
andres.galarraga@sismode.com (smtp.1and1.com)
|
||||
saleseuropower@yandex.com
|
||||
info@starkgulf.com (mail.starkgulf.com )
|
||||
etopical@bojtai.club (mail.bojtai.club)
|
||||
fernando@digitaldirecto.es (smtp.ionos.es)
|
||||
baerbelscheibll1809@gmail.com
|
||||
dashboard@grandamishabot.ru (shepherd.myhostcpl.com)
|
||||
logs@grandamishabot.ru
|
||||
shan@farm-finn.com (mail.farm-finn.com)
|
||||
info@starkgulf.com (mail.starkgulf.com)
|
||||
netline@netjul.shop (mail.restd.club)
|
||||
```
|
||||
|
||||
#### Telegram Token
|
||||
```
|
||||
1901905375:AAFoPAvBxaWxmDiYbdJWH-OdsUuObDY0pjs
|
||||
1989667182:AAFx2Rti45m06IscLpGbHo8v4659Q8swfkQ
|
||||
```
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
import idautils
|
||||
from Cryptodome.Cipher import AES
|
||||
from Cryptodome.Util.Padding import pad
|
||||
import hashlib
|
||||
import base64
|
||||
|
||||
def KSA(key: bytes) -> bytes:
|
||||
S = bytearray(256)
|
||||
for i in range(256):
|
||||
S[i] = i
|
||||
j = 0
|
||||
for i in range(256):
|
||||
j = (j + S[i] + key[i % len(key)]) % 256
|
||||
temp = S[i]
|
||||
S[i] = S[j]
|
||||
S[j] = temp
|
||||
return S
|
||||
|
||||
def PRGA(key: bytes, ci: bytes) -> bytes:
|
||||
S = KSA(key)
|
||||
a = 0
|
||||
b = 0
|
||||
pl = bytearray(len(ci))
|
||||
for i in range(len(ci)):
|
||||
a = (a+1) % 256
|
||||
b = (b + S[a]) % 256
|
||||
temp = S[a]
|
||||
S[a] = S[b]
|
||||
S[b] = temp
|
||||
K = S[(S[a] + S[b]) % 256]
|
||||
pl[i] = ci[i] ^ K
|
||||
return pl
|
||||
|
||||
def rc4_decrypt_str(citext, key):
|
||||
citext = bytearray.fromhex(citext.decode('utf-8'))
|
||||
pltext = PRGA(key, citext)
|
||||
return pltext
|
||||
|
||||
|
||||
return pltext
|
||||
|
||||
def xor_decrypt_str(citext, key):
|
||||
citext = bytearray.fromhex(citext.decode('utf-8'))
|
||||
pltext = bytearray()
|
||||
|
||||
for i in range(0, len(citext)):
|
||||
pltext.append(citext[i] ^ key[(i+1) % len(key)])
|
||||
|
||||
return pltext
|
||||
|
||||
def prepad(size):
|
||||
pre_pad = []
|
||||
nonce = 0
|
||||
for i in range(0, size, 16) :
|
||||
nonce +=1
|
||||
padding = nonce.to_bytes(16, 'little')
|
||||
pre_pad += padding
|
||||
return bytearray(pre_pad)
|
||||
|
||||
def aes_decrypt(citext, password):
|
||||
salt = b'SaltVb6CryptoAes'
|
||||
key = hashlib.pbkdf2_hmac('sha1', password, salt, 1000, dklen=32)
|
||||
aes_stream = prepad(len(citext))
|
||||
aes_stream.extend(citext)
|
||||
cipher = AES.new(key, AES.MODE_ECB)
|
||||
xor_key = cipher.encrypt(pad(aes_stream, 16))
|
||||
plaintext = bytearray(len(citext))
|
||||
for i in range(len(citext)) : plaintext[i] = xor_key[i] ^ citext[i]
|
||||
return plaintext
|
||||
|
||||
def aes_decrypt_str(citext, password):
|
||||
citext = bytearray.fromhex(citext.decode('utf-8'))
|
||||
citext = base64.b64decode(citext)
|
||||
return aes_decrypt(citext, password)
|
||||
|
||||
def get_str(addr):
|
||||
res = bytearray()
|
||||
length = 0
|
||||
data = idc.get_wide_word(addr+length)
|
||||
|
||||
while data:
|
||||
res.append(data)
|
||||
length += 2
|
||||
data = idc.get_wide_word(addr+length)
|
||||
return res
|
||||
|
||||
def decrypt_all_strs(hex_func, decrypt_func, algo=0, patch=1):
|
||||
#List of addreses required manual provision
|
||||
citext_exception = []
|
||||
key_exception = []
|
||||
citext_addrs = []
|
||||
key_addrs = []
|
||||
strings = []
|
||||
|
||||
for addr in idautils.XrefsTo(hex_func, flags=0):
|
||||
citext_addr = addr.frm
|
||||
while True:
|
||||
citext_addr = idc.prev_head(citext_addr)
|
||||
if idc.print_insn_mnem(citext_addr) == "mov" and idc.get_operand_type(citext_addr, 1) == 0x5 :
|
||||
temp = idc.get_operand_value(citext_addr, 1)
|
||||
if temp not in citext_exception:
|
||||
citext_addrs.append(temp)
|
||||
break
|
||||
|
||||
for addr in idautils.XrefsTo(decrypt_func, flags=0):
|
||||
key_addr = addr.frm
|
||||
while True:
|
||||
key_addr = idc.prev_head(key_addr)
|
||||
if idc.print_insn_mnem(key_addr) == "mov" and idc.get_operand_type(key_addr, 1) == 0x5 and idc.get_operand_value(key_addr, 0) == 0x2:
|
||||
temp = idc.get_operand_value(key_addr, 1)
|
||||
if temp not in key_exception:
|
||||
key_addrs.append(temp)
|
||||
break
|
||||
|
||||
decrypted = []
|
||||
size = min(len(key_addrs), len(citext_addrs))
|
||||
citext_addrs = citext_addrs[:size]
|
||||
citext_addrs.extend(citext_exception)
|
||||
key_addrs = key_addrs[:size]
|
||||
key_addrs.extend(key_exception)
|
||||
|
||||
for i in range(0, size+len(citext_exception)) :
|
||||
if citext_addrs[i] not in decrypted:
|
||||
decrypted.append(citext_addrs[i])
|
||||
else:
|
||||
continue
|
||||
|
||||
print(f"{hex(citext_addrs[i])} {hex(key_addrs[i])}")
|
||||
if algo == 1:
|
||||
pltext = xor_decrypt_str(get_str(citext_addrs[i]), get_str(key_addrs[i]))
|
||||
elif algo == 2:
|
||||
pltext = rc4_decrypt_str(get_str(citext_addrs[i]), get_str(key_addrs[i]))
|
||||
else:
|
||||
pltext = aes_decrypt_str(get_str(citext_addrs[i]), get_str(key_addrs[i]))
|
||||
print(pltext)
|
||||
|
||||
if pltext not in strings:
|
||||
idc.set_cmt(citext_addrs[i], pltext.decode('utf-8'), 1)
|
||||
strings.append(pltext)
|
||||
if patch:
|
||||
for idx in range(len(pltext)) :
|
||||
idc.patch_word(citext_addrs[i] + idx*2, pltext[idx])
|
||||
for pad_idx in range(idx + 1, idx*2) :
|
||||
idc.patch_word(citext_addrs[i] + pad_idx*2, 0x00)
|
||||
return strings
|
||||
|
||||
''''
|
||||
Please provide the address of the following functions
|
||||
hex_func as Proc_1_3
|
||||
decrypt_func as Proc_1_5
|
||||
|
||||
(void (__fastcall *)(char *, const wchar_t *))_vbaStrCopy)(
|
||||
v165,
|
||||
L"9FB61391D8974B3D8AD01F88F3CECED5B4E9100A3C10C6A37AC8670C078E23B9C0C7");
|
||||
v8 = Proc_1_3(v165);
|
||||
((void (__fastcall *)(int *, int))_vbaStrMove)(&v162, v8);
|
||||
((void (__fastcall *)(char *, const wchar_t *))_vbaStrCopy)(v163, L"OMSkahFpbDoSRbwObPrXoXrL");
|
||||
v120 = v162;
|
||||
v162 = 0;
|
||||
((void (__fastcall *)(char *, int))_vbaStrMove)(v164, v120);
|
||||
v156 = Proc_1_5(v164, v163);
|
||||
|
||||
Please apply an IDC Script generated from http://sandsprite.com/vbdec/ to help fix up all functions
|
||||
'''
|
||||
hex_func =
|
||||
decrypt_func =
|
||||
strings = decrypt_all_strs(hex_func, decrypt_func, patch=0)
|
||||
|
||||
#Decrypt payload from resource file example
|
||||
#citext = bytearray(open('CUSTOM101', 'rb').read())
|
||||
#password = b'DDDJJFHHDII8387474765HHFNNFBGGFJJRKJKERJ439485TH8THTJMNBGJTIGH4I5YYIU45VBIUG4I7I1123405TY'
|
||||
#open('payload.bin', 'wb').write(aes_decrypt(citext, password))
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
cdn[.]discordapp.com/attachments/829530662406193185/881703391888281630/TME_delivery_status.iso
|
||||
cdn[.]discordapp.com/attachments/829530662406193185/882099214866333706/Shipment_Receipt.pdf.iso
|
||||
andres.galarraga@sismode.com
|
||||
saleseuropower@yandex.com
|
||||
info@starkgulf.com
|
||||
etopical@bojtai.club
|
||||
fernando@digitaldirecto.es
|
||||
baerbelscheibll1809@gmail.com
|
||||
dashboard@grandamishabot.ru
|
||||
logs@grandamishabot.ru
|
||||
shan@farm-finn.com
|
||||
info@starkgulf.com
|
||||
netline@netjul.shop
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
9d68d62ba648dc881076bbd7d70ac59c
|
||||
925b9684983a46b984f190c18c868db3
|
||||
79a97d24433615837251fe141b7174d4
|
||||
6f7302e24899d1c05dcabbc8ec3e84d4
|
||||
6ada9bd1462fbfd331cf512e5818845c
|
||||
e1cb274e093a6511f3f4fe455f914544
|
||||
0126cf58488b9c91b900d66990dea74a
|
||||
6b7904fcf4f57299a961a746d83cef89
|
||||
d4acddc42c8a82dfe42b86f02eb8bc76
|
||||
7b67428d037e03d486bfc80126a86fc9
|
||||
f2f6a1a59fea21aae4341827feea8d0b
|
||||
b3d0b8c065ad75dfd646829bc7c87735
|
||||
75cd3d2c8c439e9e7bb66b3b102bfda0
|
||||
716f710f6f2b57d83ad58644fbd96b8b
|
||||
fd5bcdac791022b5452b12542a4be250
|
||||
07ddb19024ba308280048375e9be32ff
|
||||
5ad315813b752aa9483c5868dbc7d37b
|
||||
199bab13ac407a49891dabb0c1c8e303
|
||||
e0b26c5b50a37a6672d29e90b8b0adbd
|
||||
91b41651e6e9ab352805c6d35a297d08
|
||||
6ae510da968ebcbf5a8661c080ac12fd
|
||||
4b975596502b87cd63ac969b13ea998f
|
||||
6f8bb2ff11646a8e47c1b2a27d475010
|
||||
3729ddb118ee2c7addc09de37b00c7bf
|
||||
6fe6ba1439d88cf7fd8debb37324ce82
|
||||
479de94fbadd83fce799ed3389da1ce5
|
||||
4ac6f9f4017f83d0582f445584bb143c
|
||||
659add09ffc62a07b044a31d8b0df624
|
||||
906dccd51a18df6ea9f18d092976f942
|
||||
28896e0518936c1d15f282b7cba5f7c6
|
||||
818d803e3bb3a1b21fd663db75b3c6ae
|
||||
852272ecaca074fc886617a92886c511
|
||||
4a7e2d2455e0a69ffd9f67c1d3742a0e
|
||||
e07778f09aa5030ed8552e5038f8fc1c
|
||||
5a025fd5a54ec9b733c5c7936977839f
|
||||
9907b4c2e52595de42ae8cda0cb10613
|
||||
98c0be7dfb690e61ba2a0eb9352e1497
|
||||
a14f2cf850e04ec669fdb46462895541
|
||||
f71be3c684a4cc97288b3b7609adeda3
|
||||
71be01727b86c69e893e046be8f9fa1b
|
||||
03ebd4eb395cf8a547048504d8c97540
|
||||
61ae6cda7bcd244e8bd4717425ec823d
|
||||
46349f1af3adcf917df984040a8dce52
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
9a896957321b89c4ad55d906f98d58024f05b9f9
|
||||
d8452cda97b9efc597254055e1d3089a21aa5582
|
||||
6629ebd021eefece2411f6253e2d0b2c7a04d577
|
||||
11a5cbb08fc5698fd3bf3fd086ba0fcd954ecdec
|
||||
a0960b16e2057ed5ec1a5b356005392beb59de64
|
||||
42e6134c8ab92fb8bcdf1e222d9b80c117640b27
|
||||
731c5fd198ff88c8819d99a2d499a2d23e50114f
|
||||
bfe71a81fc2a1ee0e45a705fe021b0302b07c927
|
||||
1ab7ff892bb1cfa2b88e3024561288efc5a9c0c8
|
||||
a50ff1bc36532a11b987471ee42d34a657a0b7ad
|
||||
6a5abba4d17f275eb4c28028f815642c7e22a1ce
|
||||
629655f03b356ad46ae106855eb004c7be7098c0
|
||||
d2a2717f22f5ce326a3e8f8e7efd852e5b5c68f7
|
||||
f2a9b68f3222ca133ffd26c22c358f3f285b8eba
|
||||
7ad684c4d6969dc2292fd73a924c6109614190c3
|
||||
e2714ca01a6e8e8713e9e2a175c0e3598ebb75df
|
||||
73375d743067ada0569acc444143b56fa66c1ff3
|
||||
e332094b0ffd29f0fc0e7a70a03345ef725181d9
|
||||
9d70d4c5bed44e6a3375cf16d9f8830f0a85c8ab
|
||||
11b8eaa7b7941461bc952b11ec3f07d25dcd1c2e
|
||||
954411a295d35020e447be1535253d800d463efe
|
||||
c3f2fa95e2b668b5e32b3a494f81d8ac5f476f60
|
||||
a300b7be64343ce6ab88edb0c71f3052663674d4
|
||||
4c56754e3261a7368ade6033e6cca69b316cc834
|
||||
6dd21af92d79085a4140be5db5c6faa7c5de2f81
|
||||
4ae4c57faeab4e3b4cbf07f34c0cb12f542bc422
|
||||
15d11f71b884c4ce0c1c4a83e760bf7a7c492cab
|
||||
bef7500a5e3a62295f102ef5f6f100597d78a546
|
||||
7328e378ec766d7a898c4043f3d9ec0885a2d209
|
||||
87d3b5c8b1d284f446cf3a0dc955551c4d42fe3c
|
||||
37f7b510514953113fd7cbc1b5ff246e2e486a7a
|
||||
e3a16c367d0672868c65f5bffbfa33264458a84d
|
||||
a35989cc8343c5afbfa7eab186dc6c72129cfc2a
|
||||
994c26d20165cb5be37a18a61211d713f8c6d487
|
||||
a46c05b5ea797f490ac8d5379b1be3278e9d512e
|
||||
aef892e87feb647658b4dd5a1596018febb54bc4
|
||||
8354b56569ccd489f6f183154f233b4421899b83
|
||||
adfa3cc683f488a3adf1b0260b0b447aac6db575
|
||||
7c5ece45eed87e34b1a138bb2dedddc982d8c8b9
|
||||
be2d44249d8dae9a8370686c9b44e21cf3e53bf9
|
||||
5bbef49ef15239fade1d94ea21d542268a781857
|
||||
4daa6d18aa326da1e70fc488cecec5ff7f66c3cf
|
||||
a8b368324a9188ca6af687c1fc62f48474ea742d
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
678e9028caccb74ee81779c5dd6627fb6f336b2833e9a99c4099898527b0d481
|
||||
3151ddec325ffc6269e6704d04ef206d62bba338f50a4ea833740c4b6fe770ea
|
||||
7603f8e827ab78d5ff15be1b04b9a02821edf3bf90475295e0c7c792bc328f63
|
||||
7abe87a6b675d3601a4014ac6da84392442159a68992ce0b24e709d4a1d20690
|
||||
49da8145f85c63063230762826aa8d85d80399454339e47f788127dafc62ac22
|
||||
5ff29232adcc335d007ee55421d2d6bb4ac171becf2b9b9a7595d6e4b9fc13e1
|
||||
edab175c91e078e92b57446111cb07c61e357d9a12274cab33872e14d4511ea9
|
||||
8ba38dfdaed05011a8f9d19eec1670efa63cce30f23609a3c00afb265aa22ad8
|
||||
c52a0ce16c6db82bf194988a0094a4b18aec550f1953b5e9ab127c0b84f4ecca
|
||||
1885c2faae1cf90783c7fc9ea93506e8241232e90bdaeae4ca04a5cb305e13f3
|
||||
e6ed1d0f3827d5a2e6fd38ec812456b62ee702bdaa460f7f6ef5298db5136df5
|
||||
61560f470822a249950e3d35574aae0ee9c93da31c1fd6f001c0cec97069a4fb
|
||||
1e41442f28a2328a8cec90459483ae5da9b21484b2bdd2b2e206e34a8f5672bc
|
||||
6384e3d112dfb4f7d3f2761764e491383f20cffbb7a180a087b22ef903bcc9a6
|
||||
037815f51ba857c16a5c98aa37a2acba3430b0d27de3abf558cda2bff50fa35e
|
||||
b9dcf75696ba71f292246a31877cc8c833676c5c8c241e65c741711388d99bcb
|
||||
d1c69a54577f5c6491b2979279b04c5db668e20968363d7476848d152bb94362
|
||||
e6ed1d0f3827d5a2e6fd38ec812456b62ee702bdaa460f7f6ef5298db5136df5
|
||||
fbab6f778d521589e9371227f25112fed34c19efa9f3cc068bdcffe304d67111
|
||||
620ce6c90baeaba37fb4e4ad1edcb0a862e12e1b058eaa8c41bed7439c3bd983
|
||||
0872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723
|
||||
b340e287c5c5cd48a5d27c71808dc75c3fd3a69a6cad029db2332e19d998bb82
|
||||
aef52ead2a03729f95962c511947226d78fe856d29ccfaacf25e1c002c0c9f92
|
||||
35d443578b1eb0708d334d3e1250f68550a5db4d630f1813fed8e2fc58a2c6d0
|
||||
c783bdf31d6ee3782d05fde9e87f70e9f3a9b39bf1684504770ce02f29d5b7e1
|
||||
42fe72df91aa852b257cc3227329eb5bf4fce5dabff34cd0093f1298e3b5454e
|
||||
1c29ee414b011a411db774015a98a8970bf90c3475f91f7547a16a8946cd5a81
|
||||
81bbcc887017cc47015421c38703c9c261e986c3fdcd7fef5ca4c01bcf997007
|
||||
6322ebb240ba18119193412e0ed7b325af171ec9ad48f61ce532cc120418c8d5
|
||||
4932ea0c29c86544f03f9425b8088886d68a5965be8541a8d9c36a9b95eeacf9
|
||||
7b1fc82d47470ee3c7f8de53a959eb55febe3c4c6ba408190a877396907f8293
|
||||
5d5e9bc60284b01bc75bec81489654b56a739d81acce580cdff735070d9e831f
|
||||
43c2649b8f43a3a39f3d5f93347ac0460b9ccf910bda544e84a07769e1af34bd
|
||||
bc52d9795f801ca6872502c6e8af05cf3730384062f3b90113abc30ff9395879
|
||||
304c188b1452beea8b8a1f8bd4ac64b02781665792b46df692762b18685b1ccb
|
||||
75839121c06dd5f7ea7a32ced2755c8913ae81f7225ef6e790c131a5554034fa
|
||||
b2a74a9349ed9ebe01b89786e5472ac4cb437cec7bfb7107e135baa69d41e11a
|
||||
21f75377b964d884a9c32849b766d52f43dc05a5e53a3bf5665473abc15d7740
|
||||
efd63437050cbce03fb4e13c4be8858d0793ceaf678ffed8e6369578037fb6e1
|
||||
274bcc8a907b7f1bbfceb5b0e9f0f8f6d0dbdc65d774ce135467b704f755db81
|
||||
7881a0b4a3b923ae091c09e3498e1513ff8872a56fbf7977777ad6776a781b0b
|
||||
b9933e298be75df66ed2eee62207815a20ec36cbfae9b098c24739f0d712aacf
|
||||
add711e10bfde4da3e2048a27d8c8eab084e2df5bde714437ff2dd5dc0baa505
|
||||
Loading…
Reference in New Issue