mirror of https://github.com/avast/ioc
Add files via upload
This commit is contained in:
avast-ti
GitHub
parent
ff6f01ba5f
commit
d3efb0a889
|
|
@ -0,0 +1,65 @@
|
|||
# IoC for MSIL/Bobik
|
||||
Malware analysis and more technical information at [https://decoded.avast.io/martinchlumecky/bobik](https://decoded.avast.io/martinchlumecky/bobik)
|
||||
|
||||
## DDoS Targets
|
||||
Examples of captured XML config files are stored in the [XML_configs](/XML_configs) folder.
|
||||
|
||||
The targeted hosts are listed in the [targets.txt](targets.txt) file. A complete analysis of the Bobiks’ targets is in the [targets.xlsx](targets.xlsx) file.
|
||||
|
||||
## Decryptor
|
||||
The Python [decryptor.py](decryptor.py) script decrypts the HTTP responses.
|
||||
|
||||
## Samples
|
||||
|
||||
### Variant 1
|
||||
|
||||
**Hardcoded C&C URLs**
|
||||
|
||||
http://77.232.41.206/bcaa8752-51ff-4e35-8ef9-4aefbf42b482
|
||||
http://2.57.122.82/d380f816-7412-400a-9b64-78e35dd51f6e
|
||||
|
||||
**sha256**
|
||||
|
||||
00fead2e42b663522bfd8de53973b52dce737862b4ed6b965edb547364c64572
|
||||
01f0c34c6dccbd321a0a91146e8627a8408dd26cb7e7c5164a1d0f2bfeb16316
|
||||
2a450e29979be9fffec1459861a40c3b61445a47cd544665e86a44ed4fe719c9
|
||||
59f9e06b0bb5ca296df0b224f8c46982d78f47a1d2d8e536a7792d1b0e8242c4
|
||||
7256c9d385cbcf130e023380c77feb89e50d206d82ac4f653d2448b88e0499a6
|
||||
786095166809e6dcdb295f4cea90b877b965fc9b221fb364bfb93f5d5028589c
|
||||
7dad1b3414823ed590acfdd146026b11706c3482247e96952b7c83d1eb7b8ea2
|
||||
85cb02fdebb021674f8526b4e3a85abba59919b9b185a3ea6237a6ed8927beac
|
||||
ad680fc861a68e677da3ace15aaf9bb1736867c9171faf7e1849acc0e9bdd5af
|
||||
bab56e71e7d0fd683b14b74d4001697550a93aacb5ce42313a8c32945d33d4bd
|
||||
dfe515f26cddf21b3467c2d228b62435baa3deb09d14ce0fec4096d346384e58
|
||||
e8bf07b3c2cb794286aafc7a7fc7070226be36b99b339484564c7743ac4aaec8
|
||||
ee97d9bec755ced951f1e3296c543b3268f8dc8bed70a0007b3a6df4a1fd81f7
|
||||
eebfae33bf2d95084ca01400824d1e921cd51322e45b285146830984c2d45649
|
||||
f2ac8b2c9ef18f47ab6703fd5e84d7fd7edb872fe22f42324d7d8d5e322eb6f2
|
||||
f712178db07cfe487e9c6e0c2d64bbe996ccda8d110a9eaa2e18b5a306c0f45d
|
||||
f8dcb9e093781f2081a6deed618bf75484b086bc48ccf7a98fcd27f7cbb6b8fc
|
||||
|
||||
### Variant 2
|
||||
|
||||
**Hardcoded C&C URLs**
|
||||
|
||||
http://v9agm8uwtjmz.sytes.net/d380f816-7412-400a-9b64-78e35dd51f6e/update
|
||||
|
||||
**sha256**
|
||||
|
||||
3d1817e36ad70a58b809e0eb1bd49533397d58bede47cf98fb4bf306c39109df
|
||||
55875b324f86f112adfaad5b5f4b5c3a8028e02a9dd6f6372cedd96a26afb81c
|
||||
|
||||
|
||||
|
||||
### Variant 3
|
||||
|
||||
**Hardcoded C&C URLs**
|
||||
|
||||
http://v9agm8uwtjmz.sytes.net/d380f816-7412-400a-9b64-78e35dd51f6e/update
|
||||
http://q7zemy6zc7ptaeks.servehttp.com/d380f816-7412-400a-9b64-78e35dd51f6e/update
|
||||
|
||||
|
||||
**sha256**
|
||||
|
||||
4ae750334d6d0ade3f3c8dea1d5d49c277097010d1af9e85910cd4d410ff592e
|
||||
ec80e279830d478f169c8232ff0bb21f84f57b1baa920366af0e81fa380f48a4
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
<config>
|
||||
<tasks delay="0" thread_count="-5">
|
||||
<task type="http_10" period="0" method="GET" ip="212.47.199.180" port="443" host="www.eestipank.ee" path="/en/search/{.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="391863715" />
|
||||
<task type="http_10" period="0" method="POST" ip="212.47.199.180" port="443" host="www.eestipank.ee" path="/api/newsletter" response="1" allow_gzip="1" timeout="1000" https="1" body="{"userEmail»:»{.,3,8}@{.,3,8}.{.,2,3}»,»token»:»{.,462,462},»locale":"en","subscriptions":[{"targetid":"statistics","status":2,"source":"custom"},{"targetid":"pressreleases","status":2,"source":"custom"},{"targetid":"publications","status":2,"source":"custom"},{"targetid":"monetarypolicy","status":2,"source":"custom"},{"targetid":"financialstability","status":2,"source":"custom"},{"targetid":"paymentandsettlementsystems","status":2,"source":"custom"},{"targetid":"economicresearch","status":2,"source":"custom"},{"targetid":"banknotesandcoins","status":2,"source":"custom"},{"targetid":"eesti_pank","status":2,"source":"custom"}]}" id="392287242" />
|
||||
<task type="http_10" period="0" method="GET" ip="212.47.199.180" port="443" host="www.eestipank.ee" path="/en/calendar/20{d,2,2}/0{d,1,1}?s={.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="392287263" />
|
||||
<task type="http_10" period="0" method="GET" ip="212.47.199.162" port="443" host="statistika.eestipank.ee" path="/spring/getAvaldamiskalenderList?lng=et&rubriikId={.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="392287454" />
|
||||
<task type="http_10" period="0" method="POST" ip="212.47.199.143" port="443" host="sumo.eestipank.ee" path="/index.php/lostpassword/email" response="1" allow_gzip="1" timeout="1000" https="1" body="{"user»:»{.,3,12}»}" id="392287523" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startSmartIdLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="identityCode={.,3,12}&*cid=0&*csrf={.,36,36}" id="392287704" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startSmartIdLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="identityCode={.,3,12}&*cid=0&*csrf={.,36,36}" id="392287704" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startSmartIdLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="identityCode={.,3,12}&*cid=0&*csrf={.,36,36}" id="392287704" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startSmartIdLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="identityCode={.,3,12}&*cid=0&*csrf={.,36,36}" id="392287704" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startSmartIdLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="identityCode={.,3,12}&*cid=0&*csrf={.,36,36}" id="392287704" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startMobileLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="personalCode={.,3,12}&phoneNr={d,12,12}&*cid=0&*csrf={.,36,36}" id="392287737" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startMobileLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="personalCode={.,3,12}&phoneNr={d,12,12}&*cid=0&*csrf={.,36,36}" id="392287737" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startMobileLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="personalCode={.,3,12}&phoneNr={d,12,12}&*cid=0&*csrf={.,36,36}" id="392287737" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startMobileLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="personalCode={.,3,12}&phoneNr={d,12,12}&*cid=0&*csrf={.,36,36}" id="392287737" />
|
||||
<task type="http_10" period="0" method="POST" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login/startMobileLogin" response="1" allow_gzip="1" timeout="1000" https="1" body="personalCode={.,3,12}&phoneNr={d,12,12}&*cid=0&*csrf={.,36,36}" id="392287737" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.2" port="443" host="www.seb.ee" path="/ru/infohub-archive?date=anytime&dropdown=anytime&month=6&year=20{d,2,2}&mobilemonth=6&mobileyear=20{d,2,2}&page={d,1,1}" response="1" allow_gzip="1" timeout="1000" https="1" id="392301027" />
|
||||
<task type="http_10" period="0" method="POST" ip="78.24.199.2" port="443" host="www.seb.ee" path="/submit-appointment" response="1" allow_gzip="1" timeout="1000" https="1" body="------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="lang"

tt_RU

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="country"

EE

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="group"

FP

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="subunitid"

63

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="appointmenttypeid"

14

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="date"

20{d,2,2}-0{d,1,1}-0{d,1,1}

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="time_slot"

795

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="customer[name]"

{.,3,12}

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="customer[email]"

{.,3,8}@{.,3,8}.{.,2,3}

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="customer[phone]"

372{d,9,9}

------WebKitFormBoundarycXCkrPeSUGoUYVRC

Content-Disposition: form-data; name="comments"

{.,3,12}

------WebKitFormBoundarycXCkrPeSUGoUYVRC--" id="392301076" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.2" port="443" host="www.seb.ee" path="/ru/search?search_input={.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="392301157" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.2" port="443" host="www.seb.ee" path="/ru/search?search_input={.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="392301157" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.2" port="443" host="www.seb.ee" path="/ru/search?search_input={.,3,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="392301157" />
|
||||
<task type="http_10" period="0" method="GET" ip="212.47.199.162" port="443" host="statistika.eestipank.ee" path="/#/en" response="1" allow_gzip="1" timeout="1000" https="1" id="392301395" />
|
||||
<task type="http_10" period="0" method="POST" ip="78.24.199.20" port="443" host="e.seb.ee" path="/web/ipank.p" response="1" allow_gzip="1" timeout="1000" https="1" body="fromLogin=yes&errorCode=0&cert=&lang=RUS&pwd=&code={d,3,8}&certsel=&user={d,3,12}&newphone=&IDcode=&submitact=&logintype=&phone=&act=LOGIN1" id="392301452" />
|
||||
<task type="http_10" period="0" method="POST" ip="78.24.199.20" port="443" host="e.seb.ee" path="/web/ipank.p" response="1" allow_gzip="1" timeout="1000" https="1" body="fromLogin=yes&errorCode=0&cert=&lang=RUS&pwd=&code={d,3,8}&certsel=&user={d,3,12}&newphone=&IDcode=&submitact=&logintype=&phone=&act=LOGIN1" id="392301452" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.20" port="443" host="e.seb.ee" path="/web/ipank.p?act=MOBLOGINSTART&usar={.,3,12}&lang=RUS&mobdevice=SMARTID&logintype=&idcode={d,3,12}&_=1654525647463" response="1" allow_gzip="1" timeout="1000" https="1" id="392301473" />
|
||||
<task type="http_10" period="0" method="GET" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login#loaded" response="1" allow_gzip="1" timeout="1000" https="1" id="392319828" />
|
||||
<task type="http_10" period="0" method="GET" ip="195.50.195.2" port="443" host="ext-aruandlus.eestipank.ee" path="/epakpui_ext/login#loaded" response="1" allow_gzip="1" timeout="1000" https="1" id="392319828" />
|
||||
<task type="http_10" period="0" method="GET" ip="78.24.199.2" port="443" host="www.seb.ee" path="/ru" response="1" allow_gzip="1" timeout="1000" https="1" id="392320025" />
|
||||
</tasks>
|
||||
</config>
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
<?xml version="1.0" ?>
|
||||
<config>
|
||||
<tasks delay="0" thread_count="-5">
|
||||
<task type="http_10" period="0" method="GET" ip="91.208.93.236" port="443" host="www.wojsko-polskie.pl" path="/szukaj?subject=&query={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="396258650"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.208.93.236" port="443" host="www.wojsko-polskie.pl" path="/articles/news/?strona={d,1,2}" response="1" allow_gzip="1" timeout="1000" https="1" id="396351111"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.208.93.177" port="80" host="archiwum.wojsko-polskie.pl" path="/pl/a/aktualnosci_strona%3d{d,1,2}.html" response="1" allow_gzip="1" timeout="1000" https="0" id="396351158"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.208.93.177" port="80" host="archiwum.wojsko-polskie.pl" path="/pl/a/index?szukaj={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="0" id="396351221"/>
|
||||
<task type="http_10" period="0" method="POST" ip="77.240.254.237" port="80" host="gps.simatra.eu" path="/" response="1" allow_gzip="1" timeout="1000" https="0" body="__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUJNjg1NjAxMTAzD2QWBAIBD2QWAmYPZBYCZg8WAh4EVGV4dAUJVmVyLiAxLjA2ZAIDD2QWCAIBDxAPFgIeC18hRGF0YUJvdW5kZ2RkFgECAWQCAw8WAh8ABRNQcmlzaWp1bmdpbW8gdmFyZGFzZAIHDxYCHwAFDFNsYXB0YcW%2Bb2Rpc2QCCw8PFgIfAAULUHJpc2lqdW5ndGlkZGT79{.,53,53}&__VIEWSTATEGENERATOR=90059987&__EVENTVALIDATION=%2FwEdAAlTcDwZN%2Bjb%2BfJchQ3ChIGw5jZMYo80IgVgSbmeq8qmTqnUS%2FeCjCMrX041bhM37RzxlQ7haCe8FU92x8VwMmYr3%2Bl9GgBdbLv3gVeGR%2FZ6OX2ilsbDxrZxOUKxl1M3yqZUrsGtEC0SKq72cYUQj6MHdjb4xzpKucCqKjegIpvFhnd%2FcDBIq6BooBrepfvNF%2Bo{.,47,47}%3D%3D&LangDropDownList=lt&txtUsername={.,15,20}&txtPassword={.,15,20}&btnlogin=Prisijungti" id="396351266"/>
|
||||
<task type="http_10" period="0" method="POST" ip="77.240.254.237" port="80" host="transportas.simatra.eu" path="/" response="1" allow_gzip="1" timeout="1000" https="0" body="LASTFOCUS=&**VIEWSTATE=%2FwEPDwUKMTQ1NzkwMDM0Mg9kFgJmD2QWAgIDD2QWBAIBDw9kFgIeBXN0eWxlBQ1kaXNwbGF5Om5vbmU7FgICAQ9kFgICAQ9kFgICBQ8PFgIeCEltYWdlVXJsBRh%2BL0NTUy9idXR0b25zL3NlYXJjaC5wbmdkZAICD2QWAgIBDw9kFgIfAAUQbWluLXdpZHRoOjYwMHB4O2QYAQUfY3RsMDAkVGVtcGxhdGVDb250ZW50JE11bHRpVmlldw8PZGZkdC2vbCOuKlQkhi6a8fngpdKNiBplyeOjzVXyZ3IKcZw%3D&**VIEWSTATEGENERATOR=CA0B0334&**EVENTTARGET=&**EVENTARGUMENT=&**EVENTVALIDATION=%2FwEdAAfTdSzEwtUqn23eKcNcjifUSKDV1sFdgh5f%2FBppUUgs5DHApwUH%2BvYCDXmGAyeBu%2FJMjFx0H1RJnQ53ehH%2B9f6NVeFHb%2FYsQEjS48jO7qKChIZxdHPq7So48%2BbHnRo2CpQu62GmQX2u2hPYSdIjuyqReCZe7bnRSZiGKwfAczjT%2B89J%2FQ3T1AvyRR6vTOJnLv0%3D&ctl00%24SearchBox%24TextBox=Paie%C5%A1ka&ctl00%24SearchBox%24StateBox=&ctl00%24TemplateContent%24RedirectTo=&ctl00%24TemplateContent%24NameBox={.,15,20}&ctl00%24TemplateContent%24PasswordBox={.,15,20}&ctl00%24TemplateContent%24LoginButton=Prisijungti" id="396351321"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.240.254.237" port="80" host="transportas.simatra.eu" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="396351333"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.240.254.237" port="80" host="transportas.simatra.eu" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="396351352"/>
|
||||
<task type="http_10" period="0" method="POST" ip="194.135.87.129" port="443" host="kreditogarantas.lt" path="/wp-admin/admin-ajax.php" response="1" allow_gzip="1" timeout="1000" https="1" body="------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="post_id" 3346 ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_id" d2b7f9c ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="referer_title" Reikalinga paskola? - Kredito garantas ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="queried_id" 3346 ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[name]" {.,15,20} {.,15,20} ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[email]" {.,15,20}@gmaul.com ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[field_70ce1a8]" ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[field_663f646]" {d,5,6} ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[field_check1]" Taip ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="form_fields[field_2f1f116]" on ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="action" elementor_pro_forms_send_form ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw Content-Disposition: form-data; name="referrer" https://kreditogarantas.lt/reikalinga-paskola/ ------WebKitFormBoundaryjsw8LbAOMxVhi7Gw--" id="396353246"/>
|
||||
<task type="http_10" period="0" method="GET" ip="194.135.87.129" port="443" host="kreditogarantas.lt" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="396353260"/>
|
||||
<task type="http_10" period="0" method="GET" ip="194.41.12.17" port="443" host="www.sejm.gov.pl" path="/Sejm9.nsf/wydarzenia.xsp?symbol=MEDIA_KOMUNIKATY&$$ajaxid=view%3A_id1%3A_id2%3AfacetMain&page={d,1,2}&$$viewid=!799n2vk7r73vty9ve0akfyo5n!" response="1" allow_gzip="1" timeout="1000" https="1" id="396354017"/>
|
||||
<task type="http_10" period="0" method="GET" ip="194.41.12.17" port="443" host="www.sejm.gov.pl" path="/Sejm9.nsf/wydarzenia.xsp?$$ajaxid=view%3A_id1%3A_id2%3AfacetMain&page={d,1,2}&$$viewid=!awgxlp3h8swl1enna9309wwxk!" response="1" allow_gzip="1" timeout="1000" https="1" id="396354437"/>
|
||||
</tasks>
|
||||
</config>
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
<?xml version="1.0" ?>
|
||||
<config>
|
||||
<tasks delay="0" thread_count="-5">
|
||||
<task type="http_10" period="0" method="POST" ip="212.33.68.4" port="443" host="bialystok.sr.gov.pl" path="/formularz-kontaktowy" response="1" allow_gzip="1" timeout="1000" https="1" body="d5be4f5bbee33ba149e23011bd32a081=1&task=send&from_name={.,15,20}+{.,15,20}&from_email={.,15,20}%40gmail.com&subject={.,15,20}&area_data=rds56ijk5druj&g-recaptcha-response=03ANYolq{.,561,561}&send_button=Wy%C5%9Blij" id="397643992"/>
|
||||
<task type="http_10" period="0" method="GET" ip="212.33.68.4" port="443" host="bialystok.sr.gov.pl" path="/component/search/?searchword={.,15,20}&searchphrase=all&Itemid=161" response="1" allow_gzip="1" timeout="1000" https="1" id="397731001"/>
|
||||
<task type="http_10" period="0" method="GET" ip="212.33.68.4" port="443" host="bialystok.sr.gov.pl" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731015"/>
|
||||
<task type="http_10" period="0" method="GET" ip="85.128.232.119" port="443" host="brodnica.sr.gov.pl" path="/index.php?p=cases&action=search&nrwydzial=II&reper=Kp&nrspr={d,1,3}&rokrozpr=2018&wydzial=0&data=&godz=GG%3AMM&sala=" response="1" allow_gzip="1" timeout="1000" https="1" id="397731092"/>
|
||||
<task type="http_10" period="0" method="GET" ip="85.128.232.119" port="443" host="brodnica.sr.gov.pl" path="/?p=search&kword={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731104"/>
|
||||
<task type="http_10" period="0" method="GET" ip="85.128.232.119" port="443" host="brodnica.sr.gov.pl" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731110"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.86.189.123" port="443" host="www.parkkivaraus.raja.fi" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731137"/>
|
||||
<task type="http_10" period="0" method="POST" ip="77.86.189.123" port="443" host="www.parkkivaraus.raja.fi" path="/" response="1" allow_gzip="1" timeout="1000" https="1" body="username={.,15,20}&password={.,15,20}&logini=" id="397731155"/>
|
||||
<task type="http_10" period="0" method="POST" ip="77.86.189.123" port="22" host="www.parkkivaraus.raja.fi" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="397731168"/>
|
||||
<task type="http_10" period="0" method="GET" ip="13.224.68.129" port="443" host="avoindata.eduskunta.fi" path="/api/v1/tables/SaliDBAanestys/rows?perPage=10&page=0&columnValue={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731201"/>
|
||||
<task type="http_10" period="0" method="GET" ip="13.224.68.129" port="443" host="avoindata.eduskunta.fi" path="/digitoidut/search?q={.,15,20}&language=%20*&dateRange=before_1975&from=0" response="1" allow_gzip="1" timeout="1000" https="1" id="397731209"/>
|
||||
<task type="http_10" period="0" method="GET" ip="13.224.68.129" port="443" host="avoindata.eduskunta.fi" path="/resolution-register/api/public/resolutions?perPage=10&page=0&filter={.,16,20}&languageCode=fi" response="1" allow_gzip="1" timeout="1000" https="1" id="397731221"/>
|
||||
<task type="http_10" period="0" method="POST" ip="17.71.144.140" port="443" host="portti.eduskunta.fi" path="/dana-na/auth/url_1/login.cgi" response="1" allow_gzip="1" timeout="1000" https="1" body="tzoffset=180&clientMAC=&xsauthtoken={.,32,32}&username={.,15,20}&password={.,15,20}&realm=EK_Realm&btnSubmit=Kirjaudu" id="397731277"/>
|
||||
<task type="http_10" period="0" method="GET" ip="17.71.144.140" port="443" host="portti.eduskunta.fi" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731305"/>
|
||||
<task type="http_10" period="0" method="GET" ip="217.71.145.65" port="443" host="www.eduskunta.fi" path="/fi/search/sivut/results.aspx?k={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731335"/>
|
||||
<task type="http_10" period="0" method="GET" ip="217.71.145.65" port="443" host="www.eduskunta.fi" path="/kirjasto/EKS/eksdb/haku/{.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731377"/>
|
||||
<task type="http_10" period="0" method="GET" ip="217.71.145.65" port="443" host="www.eduskunta.fi" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731384"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.117.169.235" port="443" host="www.krakow-nowahuta.sr.gov.pl" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731429"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.117.169.235" port="443" host="www.krakow-nowahuta.sr.gov.pl" path="/index.php?p=cases&action=search&nrwydzial=II&reper=Kp&nrspr={d,1,3}&rokrozpr=2018&wydzial=0&data=&godz=GG%3AMM&sala=" response="1" allow_gzip="1" timeout="1000" https="1" id="397731441"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.117.169.235" port="443" host="www.krakow-nowahuta.sr.gov.pl" path="/?p=search&kword={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731455"/>
|
||||
<task type="http_10" period="0" method="GET" ip="193.33.175.58" port="443" host="www.rzeszow.sr.gov.pl" path="/search/node?keys={.,15,20}" response="1" allow_gzip="1" timeout="1000" https="1" id="397731531"/>
|
||||
<task type="http_10" period="0" method="GET" ip="193.33.175.58" port="443" host="www.rzeszow.sr.gov.pl" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="397731551"/>
|
||||
</tasks>
|
||||
</config>
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
<?xml version="1.0" ?>
|
||||
<config>
|
||||
<tasks delay="0" thread_count="-5">
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/map?koatuu={d,8,8}" response="1" allow_gzip="1" timeout="1000" https="1" id="399673135"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/map?koatuu={d,8,8}" response="1" allow_gzip="1" timeout="1000" https="1" id="399673135"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/map?koatuu={d,8,8}" response="1" allow_gzip="1" timeout="1000" https="1" id="399673135"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/map?koatuu={d,8,8}" response="1" allow_gzip="1" timeout="1000" https="1" id="399673135"/>
|
||||
<task type="http_10" period="0" method="GET" ip="88.218.28.16" port="443" host="jammschool.com.ua" path="/xmlrpc.php" response="1" allow_gzip="1" timeout="1000" https="1" id="399673207"/>
|
||||
<task type="http_10" period="0" method="GET" ip="88.218.28.16" port="443" host="jammschool.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399673217"/>
|
||||
<task type="http_10" period="0" method="GET" ip="88.218.28.16" port="22" host="jammschool.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399673227"/>
|
||||
<task type="http_10" period="0" method="POST" ip="62.149.28.49" port="443" host="cdo.org.ua" path="/send.php" response="1" allow_gzip="1" timeout="1000" https="1" body="ff=consult&firstname={.,6,12}&phone={d,12,12}" id="399673357"/>
|
||||
<task type="http_10" period="0" method="POST" ip="62.149.28.49" port="443" host="cdo.org.ua" path="/reg/?login" response="1" allow_gzip="1" timeout="1000" https="1" body="------WebKitFormBoundaryPXV1AWPOQyQN3NyH Content-Disposition: form-data; name="phone_user_login" {.,6,12}@{.,6,12}.com ------WebKitFormBoundaryPXV1AWPOQyQN3NyH Content-Disposition: form-data; name="phone_parent_login" {.,6,12} ------WebKitFormBoundaryPXV1AWPOQyQN3NyH Content-Disposition: form-data; name="login" Увійти ------WebKitFormBoundaryPXV1AWPOQyQN3NyH-- " id="399673391"/>
|
||||
<task type="http_10" period="0" method="GET" ip="62.149.28.49" port="22" host="cdo.org.ua" path="/reg/?login" response="1" allow_gzip="1" timeout="1000" https="0" id="399673441"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.239.232.105" port="443" host="school.meridian.com.ua" path="/?s={.,6,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="399673562"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.239.232.105" port="443" host="school.meridian.com.ua" path="/xmlrpc.php" response="1" allow_gzip="1" timeout="1000" https="1" id="399673583"/>
|
||||
<task type="http_10" period="0" method="GET" ip="91.239.232.105" port="22" host="school.meridian.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399673704"/>
|
||||
<task type="http_10" period="0" method="POST" ip="185.156.41.160" port="443" host="online-shkola.com.ua" path="/cabinet/auth.php" response="1" allow_gzip="1" timeout="1000" https="1" body="name=q23123&ocenka={.,6,12}" id="399673824"/>
|
||||
<task type="http_10" period="0" method="GET" ip="185.156.41.160" port="22" host="online-shkola.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399673932"/>
|
||||
<task type="http_10" period="0" method="GET" ip="31.28.168.119" port="443" host="www.athens.kiev.ua" path="/?s={.,6,12}&submit=Шукати" response="1" allow_gzip="1" timeout="1000" https="1" id="399674082"/>
|
||||
<task type="http_10" period="0" method="POST" ip="31.28.168.119" port="443" host="www.athens.kiev.ua" path="/php/index.php" response="1" allow_gzip="1" timeout="1000" https="1" body="log_form={.,6,12}&pwd_form={.,6,12}&login_submit=1&login_submit.x=32&login_submit.y=10" id="399674120"/>
|
||||
<task type="http_10" period="0" method="POST" ip="31.28.168.119" port="443" host="www.athens.kiev.ua" path="/php/feedback.php" response="1" allow_gzip="1" timeout="1000" https="1" body="------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="sername" {.,6,12} ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="mail" {.,6,12}@{.,6,12}.com ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="email" nomail ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="task" notask ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="text1" {.,6,12} ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="send" ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="mail_file"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryycgPECNY8rMSTj2b Content-Disposition: form-data; name="sendcopy" 1 ------WebKitFormBoundaryycgPECNY8rMSTj2b--" id="399674190"/>
|
||||
<task type="http_10" period="0" method="POST" ip="31.28.168.119" port="1122" host="www.athens.kiev.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674211"/>
|
||||
<task type="http_10" period="0" method="GET" ip="212.26.146.67" port="443" host="e-journal.iea.gov.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399674345"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.88.252.70" port="80" host="shodennik.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674421"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.88.252.70" port="3331" host="shodennik.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674437"/>
|
||||
<task type="http_10" period="0" method="GET" ip="77.88.252.70" port="3331" host="company.shodennik.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674501"/>
|
||||
<task type="http_10" period="0" method="POST" ip="77.88.252.70" port="80" host="company.shodennik.ua" path="/join/form/default.aspx" response="1" allow_gzip="1" timeout="1000" https="0" body="dnlast=&dnfirst=&dnmiddle=&dsex=NotSet&sposition=-1&snlast=&snfirst=&snmiddle=&ssex=NotSet&sbirthday=&semail=&swphone=&comment=&CitySelectBox_country=UA&CitySelectBox_region=7119&CitySelectBox_childregion=c48194&CitySelectBox_cityRegion=33&stype=4&otypeou=12&oviewou=62&sname=rwewetwet&snamefull=werwerwerwer&sphone={d,12,12}&save1=%D0%94%D0%B0%D0%BB%D1%96+%3E" id="399674546"/>
|
||||
<task type="http_10" period="0" method="POST" ip="168.119.201.117" port="443" host="education.umj.com.ua" path="/login" response="1" allow_gzip="1" timeout="1000" https="1" body="log={.,6,12}%40{.,6,12}.com&pwd={.,6,12}&submit=%D0%A3%D0%B2%D1%96%D0%B9%D1%82%D0%B8&redirect_to=https%3A%2F%2Feducation.umj.com.ua%2F&testcookie=1" id="399674627"/>
|
||||
<task type="http_10" period="0" method="POST" ip="168.119.201.117" port="443" host="education.umj.com.ua" path="/lostpassword" response="1" allow_gzip="1" timeout="1000" https="1" body="user_login={.,6,12}%40{.,6,12}.com&submit=%D0%9E%D1%82%D1%80%D0%B8%D0%BC%D0%B0%D1%82%D0%B8+%D0%BD%D0%BE%D0%B2%D0%B8%D0%B9+%D0%BF%D0%B0%D1%80%D0%BE%D0%BB%D1%8C&redirect_to=" id="399674695"/>
|
||||
<task type="http_10" period="0" method="GET" ip="176.114.4.180" port="443" host="voshozdenieschool.com.ua" path="/xmlrpc.php" response="1" allow_gzip="1" timeout="1000" https="1" id="399674745"/>
|
||||
<task type="http_10" period="0" method="GET" ip="176.114.4.180" port="443" host="voshozdenieschool.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399674759"/>
|
||||
<task type="http_10" period="0" method="GET" ip="176.114.4.180" port="22" host="voshozdenieschool.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674791"/>
|
||||
<task type="http_10" period="0" method="POST" ip="176.114.4.180" port="80" host="ukr.voshozdenieschool.com.ua" path="/imlogin.php" response="1" allow_gzip="1" timeout="1000" https="0" body="imUname={.,6,12}%40{.,6,12}.com&imPwd={.,6,12}&imJsCheck=765C9BDE1C1BEC66D20FBBDB0E578FB1" id="399674875"/>
|
||||
<task type="http_10" period="0" method="GET" ip="89.184.79.245" port="443" host="www.futureschool.online" path="/xmlrpc.php" response="1" allow_gzip="1" timeout="1000" https="1" id="399674943"/>
|
||||
<task type="http_10" period="0" method="POST" ip="89.184.79.245" port="443" host="www.futureschool.online" path="/wp-admin/admin-ajax.php" response="1" allow_gzip="1" timeout="1000" https="1" body="us_form_1_text_1={.,6,12}&us_form_1_text_2=23423423423423424234234&us_form_1_email_1={.,6,12}%40{.,6,12}.com&action=us_ajax_cform&post_id=23827&form_index=1" id="399674973"/>
|
||||
<task type="http_10" period="0" method="GET" ip="89.184.79.245" port="22" host="www.futureschool.online" path="/" response="1" allow_gzip="1" timeout="1000" https="0" id="399674992"/>
|
||||
<task type="http_10" period="0" method="GET" ip="45.83.192.129" port="443" host="977.com.ua" path="/xmlrpc.php" response="1" allow_gzip="1" timeout="1000" https="1" id="399675076"/>
|
||||
<task type="http_10" period="0" method="GET" ip="45.83.192.129" port="443" host="977.com.ua" path="/ru/?s={.,6,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="399675089"/>
|
||||
<task type="http_10" period="0" method="GET" ip="45.83.192.129" port="443" host="977.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399675099"/>
|
||||
<task type="http_10" period="0" method="GET" ip="185.124.11.178" port="443" host="planetaclub.com.ua" path="/search/node/{.,6,12}" response="1" allow_gzip="1" timeout="1000" https="1" id="399675139"/>
|
||||
<task type="http_10" period="0" method="GET" ip="185.124.11.178" port="443" host="planetaclub.com.ua" path="/" response="1" allow_gzip="1" timeout="1000" https="1" id="399675153"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/wall?id={d,4,4}" response="1" allow_gzip="1" timeout="1000" https="1" id="399703964"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/wall?id={d,4,4}" response="1" allow_gzip="1" timeout="1000" https="1" id="399703964"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/wall?id={d,4,4}" response="1" allow_gzip="1" timeout="1000" https="1" id="399703964"/>
|
||||
<task type="http_10" period="0" method="GET" ip="188.114.97.2" port="443" host="nz.ua" path="/wall?id={d,4,4}" response="1" allow_gzip="1" timeout="1000" https="1" id="399703964"/>
|
||||
</tasks>
|
||||
</config>
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
import sys
|
||||
import gzip
|
||||
from pathlib import Path
|
||||
from xml.dom import minidom
|
||||
|
||||
decrypt_key = bytes([0x5F, 0xA2, 0x06, 0x34, 0xD1, 0xC6, 0x68, 0x2A, 0x68, 0xF4, 0x81, 0x92, 0x70, 0x95, 0x4C, 0xE4, 0xE4, 0x0D,
|
||||
0x23, 0x7C, 0x09, 0x2A, 0xA2, 0xFC, 0xA0, 0xA2, 0x71, 0xB6, 0xB8, 0x88, 0x33, 0x1E, 0x04, 0xAA, 0xDE, 0x3F,
|
||||
0xA0, 0xAA, 0x7E, 0x4F, 0x78, 0xD0, 0x71, 0x75, 0x9C, 0x8D, 0x85, 0xB9, 0xCA, 0x81, 0xA0, 0x6C, 0xC8, 0x27,
|
||||
0x2E, 0x1E, 0xA1, 0x0F, 0x3A, 0xDC, 0xCE, 0x63, 0x51, 0x89, 0xC9, 0x7D, 0x97, 0xE5, 0x03, 0xD3, 0xFB, 0x10,
|
||||
0x83, 0x56, 0x9E, 0x36, 0xE1, 0x38, 0x13, 0x0D, 0x5A, 0x29, 0x1A, 0xF1, 0x46, 0x49, 0x7A, 0xBC, 0xED, 0x52,
|
||||
0x3B, 0x97, 0x9D, 0xE9, 0x5A, 0x78, 0xAE, 0xB2, 0xA2, 0x1F, 0xF5, 0xCE, 0xF7, 0xC9, 0x0D, 0xD6, 0x6C, 0x1F,
|
||||
0x83, 0x2F, 0x68, 0xAD, 0xA4, 0x1F, 0xBB, 0xC8, 0x8D, 0xC7, 0x56, 0x74, 0xB9, 0x18, 0xCC, 0x6E, 0xB5, 0x2C,
|
||||
0x42, 0xA9, 0x06, 0xC9, 0x20, 0x80, 0x2B, 0xA6, 0xA4, 0x77, 0xC7, 0x58, 0xFC, 0xF9, 0x70, 0x6F, 0x97, 0xAD,
|
||||
0xF3, 0xAD, 0x2A, 0x01, 0x11, 0xF4, 0xC9, 0x11, 0x9D, 0x36, 0xF5, 0x83, 0x72, 0xC9, 0xA6, 0x0F, 0x51, 0xA1,
|
||||
0xDF, 0xDD, 0xD1, 0x70, 0x9C, 0x0E, 0x91, 0x09, 0xE7, 0xD0, 0x58, 0x5A, 0xEA, 0xAC, 0xD1, 0x4B, 0xDB, 0x45,
|
||||
0x9A, 0x4D, 0x4F, 0xF2, 0xBF, 0x5D, 0x5B, 0x84, 0x88, 0xA3, 0x90, 0x8C, 0x60, 0x9F, 0x21, 0xB5, 0xDC, 0x60,
|
||||
0xCA, 0x6A, 0x9A, 0x41, 0x1A, 0xBD, 0xF0, 0x6C, 0xB7, 0xED, 0x9C, 0xD3, 0x91, 0x0F, 0xA1, 0x3F, 0xCD, 0x69,
|
||||
0x5E, 0x7D, 0x21, 0xD2, 0x0F, 0x55, 0x29, 0xD7, 0x1D, 0x4E, 0x18, 0x6E, 0xDA, 0xF1, 0x18, 0x62, 0xE4, 0x65,
|
||||
0x2B, 0xF5, 0x00, 0xFB, 0xDD, 0x08, 0x20, 0x79, 0xF3, 0x16, 0x1A, 0xDA, 0xBC, 0x02, 0x57, 0x11, 0xB0, 0x92,
|
||||
0x77, 0x90, 0x28, 0x58]
|
||||
)
|
||||
|
||||
def decrypt(key: bytearray, data: bytes):
|
||||
assert len(key) == 256
|
||||
array = [0] * len(key)
|
||||
array2 = [0] * len(key)
|
||||
array3 = [0] * len(data)
|
||||
|
||||
for i in range(0, len(key)):
|
||||
array[i] = key[i % len(key)]
|
||||
array2[i] = i
|
||||
|
||||
num = 0
|
||||
for i in range(0, len(key)):
|
||||
num = (num + array2[i] + array[i]) % 256
|
||||
num2 = array2[i]
|
||||
array2[i] = array2[num]
|
||||
array2[num] = num2
|
||||
|
||||
num3 = 0
|
||||
num = 0
|
||||
for i in range(0, len(data)):
|
||||
num3+=1
|
||||
num3 %= 256
|
||||
num += array2[num3]
|
||||
num %= 256
|
||||
num2 = array2[num3]
|
||||
array2[num3] = array2[num]
|
||||
array2[num] = num2
|
||||
num4 = array2[(array2[num3] + array2[num]) % 256]
|
||||
array3[i] = data[i] ^ num4
|
||||
return array3
|
||||
|
||||
|
||||
# ======================================================================================================================
|
||||
|
||||
|
||||
for fn in Path(".").glob(sys.argv[1]):
|
||||
print("Processing " + fn.name)
|
||||
data = bytearray(fn.read_bytes())
|
||||
decrypt_data = decrypt(decrypt_key, data)
|
||||
unzip_data = gzip.decompress(bytearray(decrypt_data))
|
||||
xmlstr = minidom.parseString(unzip_data).toprettyxml(indent="\t")
|
||||
fn.with_suffix(".xml").write_text(xmlstr, encoding='UTF-8')
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
026c416e1c40943561a28808b77554ff
|
||||
035ba2d374b01888989a3cd2525cd1a0
|
||||
0e3aaa1a438bbdc86499bc40b4c5fee6
|
||||
0fc62547073894774f9934a7fb45285f
|
||||
1e5395a1b95ce572c9367bbb58a74168
|
||||
3235a3f4dca75110a8f6f6bd422e51c3
|
||||
4823acf45a7e28f89a1894c6bfeb69ba
|
||||
54a82b3722fab243c1d87b6aacf809a4
|
||||
6ec1aff6578f2b1a90be51d1dc72720e
|
||||
862f539bcd21b621f869b762009bb305
|
||||
9d5757a786428a26d2814ee69aad5c01
|
||||
9de3fd81a0976f3aa07fface219c59bb
|
||||
b24259ab0da512eab224ca7bd8cb9053
|
||||
b2c7a9cb1860415a6ff0cbac52d9c9e9
|
||||
bb58b3e2dd4c21479fc05bab62cd3ed8
|
||||
c08b365766e065ff1feccc2a75d87c02
|
||||
d27e3e4216af4eec9d9358f4d88e57cc
|
||||
d2e5495134b396f0157cfeeb8aff1ee4
|
||||
e54344fae3d8a043df5032f0f5158124
|
||||
ece491befd0f68f5d717bd9ff1859264
|
||||
ffcad95cd7ac9d5818ffdb2595eb97d5
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
1ec27d0433f5066fb1e9259f165d3353e9d1d666
|
||||
25a03e2adfe3f2671d34060e1bf7be8abde69c45
|
||||
352df0681530e6fe57d9a0efee63e5d88125a3c2
|
||||
3acc23fa594aa9a4b130cb1ab8df61bee8b2c516
|
||||
3c8db8dd7a171f24d69349088624a9e6f6b2c056
|
||||
3dc2ad35a8909c3b77a2e51fa52a2ccfb61bc294
|
||||
473f1e37b546e10ef291c5a563f455e17a27641b
|
||||
568c989ae46455f67873ef27c91475ea228ea9d4
|
||||
71ea00abbb7c0faca2da40360b3ff46417a64c82
|
||||
73fd26caea3c73fb8f197c41020193776cd9438f
|
||||
7c3e451459c47560f37ff2d49d3ac52e528e3736
|
||||
85683161d7331ab75da25b8252ab0cc8cbe0d17f
|
||||
98b7ed6e370f4ab68da537e6dee9071c231208f9
|
||||
a1d6c4a822aa08a7b47b607f01b38d6bec0cb895
|
||||
a445efc1e8b1f9f09ad778ed6fc0d26ea7673e73
|
||||
b34a68703499fa81a3d4ec03a037eaa566729d1c
|
||||
ba6b8bf0970a06598bad198c4444175dcf1bd795
|
||||
bdcb1b5e42f962455ad5e7c7b74675e876a0e03c
|
||||
d3097727cfcffc68344ec2345b6c6a68518a04b6
|
||||
d7e08b1a2622d261b7636684610c9421ec06d189
|
||||
ee430dd971d11a0bd2fb50d725b993bc2b69d1ed
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
00fead2e42b663522bfd8de53973b52dce737862b4ed6b965edb547364c64572
|
||||
01f0c34c6dccbd321a0a91146e8627a8408dd26cb7e7c5164a1d0f2bfeb16316
|
||||
2a450e29979be9fffec1459861a40c3b61445a47cd544665e86a44ed4fe719c9
|
||||
3d1817e36ad70a58b809e0eb1bd49533397d58bede47cf98fb4bf306c39109df
|
||||
4ae750334d6d0ade3f3c8dea1d5d49c277097010d1af9e85910cd4d410ff592e
|
||||
55875b324f86f112adfaad5b5f4b5c3a8028e02a9dd6f6372cedd96a26afb81c
|
||||
59f9e06b0bb5ca296df0b224f8c46982d78f47a1d2d8e536a7792d1b0e8242c4
|
||||
7256c9d385cbcf130e023380c77feb89e50d206d82ac4f653d2448b88e0499a6
|
||||
786095166809e6dcdb295f4cea90b877b965fc9b221fb364bfb93f5d5028589c
|
||||
7dad1b3414823ed590acfdd146026b11706c3482247e96952b7c83d1eb7b8ea2
|
||||
85cb02fdebb021674f8526b4e3a85abba59919b9b185a3ea6237a6ed8927beac
|
||||
ad680fc861a68e677da3ace15aaf9bb1736867c9171faf7e1849acc0e9bdd5af
|
||||
bab56e71e7d0fd683b14b74d4001697550a93aacb5ce42313a8c32945d33d4bd
|
||||
dfe515f26cddf21b3467c2d228b62435baa3deb09d14ce0fec4096d346384e58
|
||||
e8bf07b3c2cb794286aafc7a7fc7070226be36b99b339484564c7743ac4aaec8
|
||||
ec80e279830d478f169c8232ff0bb21f84f57b1baa920366af0e81fa380f48a4
|
||||
ee97d9bec755ced951f1e3296c543b3268f8dc8bed70a0007b3a6df4a1fd81f7
|
||||
eebfae33bf2d95084ca01400824d1e921cd51322e45b285146830984c2d45649
|
||||
f2ac8b2c9ef18f47ab6703fd5e84d7fd7edb872fe22f42324d7d8d5e322eb6f2
|
||||
f712178db07cfe487e9c6e0c2d64bbe996ccda8d110a9eaa2e18b5a306c0f45d
|
||||
f8dcb9e093781f2081a6deed618bf75484b086bc48ccf7a98fcd27f7cbb6b8fc
|
||||
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Loading…
Reference in New Issue