Malware Analysis of Dridex, BitPaymer and DoppelPaymer Campaigns

LIFARS Introduces Cyber Vaccine in the Battle Against Ransomware Attacks

Threat actors are constantly working towards finding new and complex ways to deploy cyber-attacks. The affiliates behind Dridex initially used it as a means to steal banking and personal credentials. However, in order to adapt in the changing cybercrime landscape, the threat actors evolved and developed BitPaymer Ransomware, which uses Dridex for the new purpose of moving laterally and proliferating within a network. Thus, increasing the level of disturbances and attacks on organizations leading to loss of data, assets, and reputation. Ransom demands ask for seven-figure payments, and it is never a guarantee that data will be returned after payment. Just this past summer, malware analysts found a new evolution of BitPaymer ransomware, called DoppelPaymer. This version of the ransomware campaign, although it looks very similar, is far more complex than BitPaymer. In response to this incident, LIFARS Incident Response Team created a custom Cyber Vaccine to remove the Dridex infection. This vaccine finds maliciously injected thread and removes all malicious Dridex artifacts.
To learn more about, DEDRI and to download the vaccine go to our GitHub.

LIFARS Incident Response Team summarizes the common initial stages of the ransomware infections, below.

Download LIFARS Cyber Vaccine Guide

 

TTP – Tactics, Techniques, and Procedures

The attackers use many various types of malware and tools, in addition to Dridex, before and during the encryption incident. First, they infiltrate the network (usually via malspam email, or other common and successful phishing tools). Then, they execute malicious code, which is usually hidden in VBA macros of the attached document(s) or in JavaScript code. This malicious code typically downloads Dridex loader or it downloads PowerShell downloader first and then also Dridex loader. These downloaders communicate with short TTL (time to live) geofenced websites for downloading their payload. The attackers need the connection only for a short time, even as little as one week after the phishing email is delivered. Once this initial download is successful, the attackers use PowerShell Empire and accessible SMB shares or RDP, etc. for lateral movement and spreading across the network (usually undetected by antiviruses and unmonitored network tools). They do this until the objective number and types of machines are infected with Dridex. At this point, it will lay in waiting until the switch flips, the systems become encrypted, and the dreaded ransom note appears.

In this case, we observed similar Dridex lifecycle than in July 2019, which was depicted in [1]:

 

Dridex Lifecycle

 

We found machines with Dridex loader, which injected malicious thread in Explorer.exe and leveraged DLL Hijacking technique for hiding its presence in the system and used various methods of automatic execution for achieving persistence, which survive also user logouts and system reboots.

In some cases, operators of Dridex can also use their bot for delivering the BitPaymer ransomware, or the DoppelPaymer ransomware, which is a fork of BitPaymer ransomware after some operators of Dridex group INDRIK SPIDER (also known as Evil Corp) split into a separate group. More about the history about the Dridex group can be found on Lifars Blog at [6] and [7].

Some machines in the client network have been also infected with the DoppelPaymer variant of the BitPaymer ransomware.

Malware analysis

sdev.exe

Dridex was first released as a banking Trojan designed to steal banking and personal credentials. The first version was derived from, Cridex, a trojan released around September 2011. In our case the attackers use the Dridex samples, we found at least one loader, with filename sdev.exe and SHA-256 hash 9cfcdb31b677f860b277ffb52425a27efdb9544bc37982d6f54f038b94433ec1. This sample is detected by many antiviruses as a variant of Cridex [2]:

Variant of Cridex

It is obfuscated and packed, the entropy of its largest section OR9R_eF is almost 8 – it means almost completely random/packed data:

OR9R_eF packed with random data

After execution, from this sample is unpacked the loader (it also contains filename ldr.exe) with compile date 18 Oct 2019. This loader shares more than 85% of its code with known Dridex samples and a small portion with known BitPaymer ransomware [3]:

Code similarity with Dridex

Code reuse with BitPaymer occurs because BitPaymer is created and used by same threat actors and they reused their code base between Dridex and BitPaymer (and a newer version called DoppelPaymer), as shows the following picture from [4]:

Code reuse between Dridex, BitPaymer, and DoppelPaymer Credit: Sentinelone

After execution, this loader waits for a couple of minutes by printing Debug messages “Installing…”. Malware sometimes uses a similar technique (waiting before the execution of malicious payload) as protection against automatized behavioral analysis in sandboxes.

Debug Messages

After unpacking the payload, it is possible to reveal the addresses of C&C servers from the memory of the running processes, as follows:

Addresses of running processes

These URL addresses use IP addresses from various countries and most of these machines are listening on TCP port 3389, which is commonly used for RDP. However, in this case, the port is used for HTTPs web server, which is also listening on common port 443:

  • IP addresses of possible C&C servers
    • 185.69.154.108; UA; Ukraine 
    • 45.137.148.201; DE; Germany 
    • 74.208.154.153; US; United States 
    • 88.220.65.41; PL; Poland 
    • 81.17.23.125; CH; Switzerland 
    • 91.83.93.104; HU; Hungary 
  • URLs of possible C&C servers
    • hxxps://185.69.154.108/
    • hxxps://185.69.154.108:691/
    • hxxps://45.137.148.201/
    • hxxps://74.208.154.153/
    • hxxps://74.208.154.153:3389/
    • hxxps://88.220.65.41/
    • hxxps://88.220.65.41:3389/
    • hxxps://81.17.23.125/
    • hxxps://81.17.23.125:3389/
    • hxxps://91.83.93.104/
    • hxxps://91.83.93.104:3389/

This characteristic (HTTPs on TCP/3389 port) can be used as an additional indicator of potential malicious IP address for investigating the IP addresses discovered in Network Monitoring tools. Also, these IP addresses could be used as Indicators of Compromise (IOCs) for discovering other infected machines in Network Monitoring tools.

Interestingly, at least one SSL certificate for these HTTPs servers are self-signed and recently generated, thus it was probably created for purposes of this campaign, see the example for hxxps://91.83.93.104:3389/ [5]:

SSL certificate for HTTP servers

However, another C&C at hxxps://81.17.23.125:3389/ uses a bit older certificate from July 2019:

Older SSL certificate

Dridex DLLs

Dridex execution and infection are usually based on the following scenario:

Obfuscated and packed Dridex loader (masqueraded as legitimate Windows application) will unpack itself after execution, collect some information about the infected machine (e.g product name and product key, version, see the following picture); it will then inject the legitimate Explorer.exe and create malicious thread inside this legitimate Windows processCollected information about infected machine

The malicious thread then looks for .exe files in  C:\Windows\System32 directory which are prone to DLL hijacking – technique for abusing the Windows search and load algorithm for DLL files, allowing an attacker to inject its own malicious code into the process through DLL file on particular location, which is searched before the legitimate location for Windows system DLLs like C:\Windows\System32. Execution of various Windows executables from injected thread in Explorer.exe:Execution of various Windows executables from injected thread in Explorer.exe

As a part of the infecting process, the Dridex loader also uses the “C:\Windows \System32” directory (including whitespace after Windows), probably for confuse application whitelisting and monitoring software and/or the analysts. Injected thread in Explorer.exe creates a copy of legitimate Windows executables and new DLLs with legitimate filenames. Then, these legitimate applications load provided DLLs instead of DLLs from legitimate C:\Windows\System32 directory – DLL HijackingDLL Hijacking

The malicious thread creates a copy of vulnerable legitimate Windows program to the %APPDATA% directory in a new directory with random name (e.g. C:\Users\user\AppData\Roaming\UlSLg6\phoneactivate.exe) and place a malicious DLL to this directory – the legitimate application executed from this directory will load this malicious DLL instead of one in C:\Windows\System32 dir.

The malicious thread also creates persistence via autorun registry entry and .lnk file in the Startup menu folder, which execute the above-mentioned Windows executable in %APPDATA% directory.

Dridex also repeats the same technique in C:\Windows\System32 directory – legitimate Windows application with malicious DLL in the directory with a random name and this time it creates a scheduled task which executes this Windows executable every hour. These behaviors are captured on the following picture together with the creation of a copy of Windows executables with an unusual location. Also, events for achieving persistence are included and highlighted: scheduled task, autorun via registry and Startup entry in Windows Start Menuscheduled task, autorun via registry

Moreover, the injected malicious thread in Explorer.exe is used for self-protecting against the removal – it checks every minute (or more often like every 20 seconds) the presence of the scheduled task and the presence of other above-mentioned components (files in created random-directories). If some file or scheduled task is missing, it will recreate it again. Execution of this checks is visible on the following screenshot; here it is visible Thread ID (TID) of the maliciously injected thread (this TID is also visible on previous screenshots – it is responsible for malicious activities of Explorer.exe process).

visible Thread ID (TID) of the maliciously injected thread

 

Below in IOCs section there are collected some SHA-256 hashes of malicious DLLs and their names – the Dridex malware creates DLL files with one of the names of hijackable legitimate DLL files, because this DLL hijacking technique will not work with every DLL filename, only with few of them (depending on coding-style of particular Windows application). Also, Dridex slightly modifies the malicious DLLs in the way that even if they have the same functionality, they have different hash values. In the IOCs section are also collected IP addresses and URLs extracted from malicious samples – these URLs are possible C&C servers used for communication of infected hosts with the attackers.

Activities of the injected thread in Explorer.exe described above are visualized in the following picture:

Activities of the injected thread in Explorer.exe

 

Dridex Vaccine – DEDRI

While the first stage loader is widely detected by many antiviruses, also some malicious DLLs can be detected, other artifacts have a less detection ratio. These artifacts can remain undetected even on the system with installed and running antivirus software. Moreover, injected thread in Explorer.exe can remain hidden and after the antivirus deletes some malicious artifacts, this injected thread soon restores them. Or, the scheduled task is running every hour, and after each user login again there are executed autoruns (startup) items which can reinfected the system again. So, it is not unusual to find systems with multiple Dridex infections – it is not uncommon to found endpoints with tens of malicious Dridex artifacts. We saw this during an incident response incident; some machines with approximately two thousand Dridex artifacts.

From previous analysis it is clear how Dridex is achieving its persistence and how its self-protecting feature works. We can leverage our knowledge of the recent Dridex lifecycle and create a defending tool against it – or tool for automatic cleaning Dridex artifacts from infected machines. First, let’s start with manual Proof of Concept (PoC): what we must do if we want to find all Dridex artifacts on the system and then remove them without allowing Dridex self-protecting mechanism to recreate it again?

This relatively easy question requires several steps, however, for now, let’s assume that we already found all Dridex artifacts and we would like to remove them without their recovering by Dridex self-protection.

So, we need to find which thread in Explorer.exe is injected and responsible for malicious activities. Just like above, we can use Process Monitor by SysInternals to find Thread ID of thread in Explorer.exe, which executes schtasks.exe. Then, we need to suspend this thread (during the PoC phase we can use another SysInternals tool to suspend thread – Process Explorer), see on the picture below – notice the Thread ID 5796. Then, while the injected thread is suspended, we can remove all malicious artifacts from the filesystem and Windows registry without risk of their recovering by the injected thread, which is already suspended. And finally, if all artifacts are cleaned, we can terminate the injected thread and prevent Dridex from running again on this system.

Thread ID 5796

Our PoC proves that this approach works after the termination of injected thread no more artifacts are created. Even after logout and login the user or restarting the system, no Dridex artifacts are created. However, it is unfeasible to do this on tens, potentially hundreds of compromised machines, so it is time to automate this cleaning process. We should create a Vaccine against Dridex – DeDridex, or abbreviated, DEDRI Vaccine.

We will need to develop a program that will be able to find Dridex artifacts in the filesystem, scheduled tasks, registry entries and .lnk startup files pointing to any of these filesystem artifacts. Then, it should be able to detect, suspend, and terminate injected thread in Explorer.exe. And last, but not least: we should be able to automate deployment of our vaccine to hundreds of endpoints.

We have several possibilities for how to do this: we can do it in an old-fashion way and develop this vaccine in pure C or C++. Features like thread manipulation should be relatively straightforward, however, the correct development of other features could be a little bit challenging – we will need to take care about checking the return values, errors, and also we should avoid possible memory leaks from string manipulation. It is possible to do it this way, however, it is faster to use the powerful features of modern PowerShell. It has commandlets and functions for almost all of required functionality except thread monitoring, suspending and terminating. For thread monitoring we can use the same approach as in PoC – Process Monitor offers also a command line version, so we execute it from our PowerShell vaccine for one-two minutes and search for events that create process schtasks.exe from Explorer.exe. More interesting is thread suspending/termination, we need to use native Win32 API from PowerShell – we need to add type definition and import OpenThread and SuspendThread functions from Kernel32.dll, and then wrap in as PowerShell function. This approach works in many cases, however, a problem with insufficient permissions can occur (especially when we try to manipulate threads running in context of another Administrator account) – for this case, we will use a second method via the command line version of Process Hacker and the implementation of  Suspend-Thread function will look like this:

[DllImport("kernel32.dll")]

public static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);

[DllImport("kernel32.dll")]

public static extern uint SuspendThread(IntPtr hThread);

public static extern int CloseHandle(IntPtr hObject);

...

function Suspend-Thread{

param (

[Parameter(Mandatory = $True)]

[int]$ThreadID

)

$Error = $False

$handle = [Kernel32]::OpenThread([Kernel32+ThreadAccess]::SUSPEND_RESUME, $False, [System.UInt32]$ThreadID)

if ($handle -ne 0)

{

if ([Kernel32]::SuspendThread($handle) -eq 4294967295) // -1

{

$Error = $True

}

[Kernel32]::CloseHandle($handle)

if ($Error)

{

[IO.File]::WriteAllBytes($ProcHack, [Convert]::FromBase64String($prochack_base64str))

& $ProcHack -c -ctype thread -cobject $ThreadID -caction suspend

}

…

Next, step by step we can describe the ideas behind our DEDRI Vaccine. It needs to:

  • Find malicious injected thread in Explorer.exe via Process Monitor – if such thread exists, then DEDRI will suspend it
  • Find directories with Dridex artifacts – these directories could be found in %APPDATA% of any user and in %WinDir%\System32. They have a random-looking name and contain one legitimate Windows executable (same as its original in %WinDir%\System32), it could also contain one .DLL library with legitimate name (but not legitimate content) which will be hijacked, and these directories could contain encrypted file with random-looking filename and extension beginning with char ‘x’
  • Check every:
    • scheduled tasks
    • autoruns via HKLM (Local Machine) and HKCU (Current User) registry entry with path “\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” for any user,
    • Windows Start Menu .lnk startup file for any user

Find items pointing to some of the malicious directories with Dridex artifacts found in the previous step.

  • Remove all malicious artifacts found in previous steps
  • Terminate malicious injected thread if this thread exists (1st step)
  • (Optionally) – prevent future successful Dridex execution by creating read-only file “C:\Windows “ (including trailing space) – Dridex will not be able to use fake directory with the same name for one of its stage
  • (Optionally) – prevent future successful BitPaymer ransomware infection by creating file “C:\aaa_TouchMeNot_.txt” (see below)

Example output from running our DEDRI Vaccine is presented below:

+---------------+

| DEDRI Vaccine |

+---------------+

Wednesday, November 13, 2019 5:44:26 PM

(Running detection of infected thread)

(ProcMon Tracing running for 70 seconds)

(ProcMon convert PML to CSV)

Infected Thread:

5844 in Explorer.exe

Thread 5844 suspended

Infected Dirs:

C:\WINDOWS\System32\uZynH

C:\Users\admin\AppData\Roaming\9T1m

C:\Users\user2\AppData\Roaming\EgJMB2

C:\Users\user1\AppData\Roaming\A3e2Hg

C:\Users\user1\AppData\Roaming\wAwyh

C:\Users\user\AppData\Roaming\ApW1pt

Infected Tasks:

\Cituczwakmgniyj -> C:\WINDOWS\system32\uZynH\SppExtComObj.Exe

\Qqqoyugknzwuce -> C:\Users\admin\AppData\Roaming\9T1m\wermgr.exe

\Tjbtnc -> C:\Users\user\AppData\Roaming\ApW1pt\wermgr.exe

\Zjpblrxgbzbvkv -> C:\Users\user2\AppData\Roaming\EgJMB2\wermgr.exe

Infected Startups:

C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rtvuylbuengipk.lnk

Infected Autoruns:

HKEY_USERS\S-1-5-21-254018323-656874600-324685044-114009\SOFTWARE\Microsoft\Windows\CurrentVersion\Run:Rtvuylbuengipk -> C:\Users\user1\AppData\Roaming\A3e2Hg\FXSCOVER.exe

Removing infected dirs:

C:\WINDOWS\System32\uZynH

C:\Users\admin\AppData\Roaming\9T1m

C:\Users\user2\AppData\Roaming\EgJMB2

C:\Users\user1\AppData\Roaming\A3e2Hg

C:\Users\user1\AppData\Roaming\wAwyh

C:\Users\user\AppData\Roaming\ApW1pt

Removing tasks:

\Cituczwakmgniyj -> C:\WINDOWS\system32\uZynH\SppExtComObj.Exe

\Qqqoyugknzwuce -> C:\Users\admin\AppData\Roaming\9T1m\wermgr.exe

\Tjbtnc -> C:\Users\user\AppData\Roaming\ApW1pt\wermgr.exe

\Zjpblrxgbzbvkv -> C:\Users\user2\AppData\Roaming\EgJMB2\wermgr.exe

Removing startups:

C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rtvuylbuengipk.lnk

Removing autoruns:

HKEY_USERS\S-1-5-21-254018323-656874600-324685044-114009\SOFTWARE\Microsoft\Windows\CurrentVersion\Run:Rtvuylbuengipk

Error 5 with native terminating thread

Trying ProcesHacker tool

(Removing temporary files)

Prevention:

BitPaymer Prevention created

Dridex Prevention created

Wednesday, November 13, 2019 5:46:36 PM

PowerShell script for endpoints is one part of DEDRI Vaccine, however, it is important to automate also deploy of this Vaccine on hundred of endpoints – under some circumstances, Domain Group Policies can not be used, so we also prepared another PowerShell script which copies DEDRI to each machine from provided list of hostnames, then executes this copy (via PowerShell Invoke-Command or PsExec) parallel on each machine, waits several minutes for completion of these tasks and finally, collects DEDRI logs and remove it from machines. Below is provided an example of DEDRI Vaccine execution in the background via PsExec:

Start-Process -WindowStyle Hidden $PsExec -ArgumentList /AcceptEula,\\$Hostname,cmd,/c,"powershell -noninteractive -executionPolicy Bypass -file $RemoteDedriFile"

This DEDRI Vaccine was used by LIFARS during Incident Response process on almost 300 endpoints, with the following results, which saved enormous effort during manual cleaning or reinstalling infected systems:

Detected and removed artifacts created by DridexCount
Directories in AppData63281
Directories in System32229
Scheduled Tasks for programs in AppData233
Scheduled Tasks for programs in System32103
Startups .lnk in Windows Start menu222
Autoruns via Registry (CurrentVersion\Run)429
Total Directories63510
Total Persistency artifacts987

PowerShell Empire usage

During forensic analysis, LIFARS found traces of PowerShell execution with the Base64-encoded command on some machines. The command was slightly obfuscated, however, it was easy to deobfuscate it. The deobfuscated version of this PowerShell command is provided below:

Deobfuscated version of this PowerShell command

This script bypasses some security features and monitoring and disables the logging of ScriptBlock. Then, it downloads from hardcoded IP address and URL (highlighted in the picture) another stage of infection, which is encrypted by RC4 cipher. After decrypting, downloaded content is executed as another PowerShell expression via IEX alias of the Invoke-Expression command.

This second stage was not accessible during our analysis, however, from deobfuscated 1st stage it is clear that this is Stager from PowerShell Empire HTTP listener available at [8].

BitPaymer ransomware

At the beginning of our engagement, looking at the ransom note there were significant similarities with BitPaymer ransomware, which is often distributed by Dridex operators. Here we mention some interesting technical details, which could be used during forensic analysis for finding BitPaymer samples, or, for preventing new BitPaymer infection. For further reading, it is recommended to see the LIFARS blog post about BitPaymer [7].

BitPaymer payload is usually obfuscated and packed in a custom loader, which is compiled only a few hours before deploying on the victim network, making highly difficult for EDRs and AntiViruses to detect these BitPaymer loaders.

Moreover, BitPaymer ransomware avoids its execution in Windows Defender AV Simulator by checking presence of file “C:\aaa_TouchMeNot_.txt”. This file is present during execution in Windows Defender AV Simulator [9], it is like a trap – there is no reason to modify this file by legitimate application, however, ransomware likely encrypt it.

We can compare the execution of BitPaymer ransomware using Any.Run service, first is without this file [10]: ransomware checks its presence and if not found, then spawns multiple processes for elevating its privileges,  deleting Volume Shadow Copies, for network discovery and take control of random service and executing itself as this service:

Bitpaymer ransomware

Execution of BitPaymer ransomware

Next, the second image is an execution of the ransomware with the file “C:\aaa_TouchMeNot_.txt” present [11]. We can see that BitPaymer detects presence of this file:

BitPaymer detects presence aaa_TouchMeNot_.txt

 

aaa_TouchMeNot_.txt file before execution of BitPaymer

So, we can use this feature against BitPaymer ransomware as a killswitch – if we create this file on every machine, the BitPaymer ransomware supposes that it is executed in Windows Defender AV Emulator and then does nothing malicious – and this is one above-mentioned prevention method leverages by DEDRI Vaccine.

BitPaymer comes up with new ways to disguise itself from security software deployed on the network. One sample of BitPaymer, uses alternate data streams or ADS to do just this. ADS is usually used by Windows to store additional data in a mainstream, such as date or time, however, BitPaymer it uses to creating copies of itself and hiding its presence. This technique of creating copies and then copies of copies allows the malware to evade detection more than usual. Further, these copies can delete the initial malware file once they execute their assigned task.

BitPaymer also uses a Fileless UAC bypass to elevate privileges between the network. First, the malware tries to change the default open for .msc files. The .msc files by default are opened using the Microsoft Management Console (MMC) tool using admin privileges. Using normal user credentials, the eventviewer is launched using .msc snap in the MMC console. This time the malware uses the HKCR\mscfile\shell\open\command command to point to the .cmd file. Thus, allowing the malware to execute with high privileges without using the Fileless UAC bypass:

Fileless UAC bypass

DoppelPaymer ransomware

DoppelPaymer is an evolution of BitPaymer, that looks very similar, but is a bit more complex. Since its distribution, only a few confirmed victims of DoppelPaymer have been identified. A Client in a recent LIFARS case is one of the confirmed victims of DoppelPaymer. The latest known victim of DoppelPaymer is a Mexican oil company, Pemex. Attackers demanded 565 bitcoin or about $4.9 million USD from the oil company.

Numerous new features were added to DoppelPaymer’s source code to increase its level of functionality and threat. This new variant, unlike BitPaymer, does not use the aaa_TouchMeNot_.txt. Perhaps INDRIK SPIDER has gotten more clever and knows that a killswitch can be used to get past the malware’s infection. Further, file encryption occurs much faster because this process is now threaded. Again, for further reading, it is recommended to visit LIFARS blog [7].

However, here, we will cover other changes in DoppelPaymer. While ADS is still used by DoppelPaymer, this time, when DoppelPaymer creates copy of itself, this copy is modified by obfuscation/encryption, and when it is launched, its command line contains random-looking value as a parameter – without this parameter, the executable crashes soon after its start, because it uses this value as parameter for deobfuscation. You can see parametrized execution in the following picture:

Parametrized execution of doppelpaymer

On the other hand, if some of these binaries are executed without parameters, the result is the following:

binaries are executed without parameters

You can compare the normal execution from using the loader, which then starts other processes with the correct parameter [12], one of its obfuscated copy executed without parameters [13], and the same copy is executed with correct parameter [14]. With correct parameters, DoppelPaymer will continue with running, however, it does not necessarily encrypt files and generate a ransom note as if it is executed with first stage loader. In the first execution [12] it generates ransom note with  .onion URL (accessible via TOR) of the ransom portal. This ransom portal also includes name of the victim., as you can see in the following pictures:

DoppelPaymer Ransome Note

 

Conclusion

In this report LIFARS analyzed and covered the recent campaign of Dridex from a malware analyst’s point of view: we saw tens of thousands of malicious artifacts, different malware families with common code base used by same threat actors, and we saw also their usage of other tools like PowerShell Empire and PsExec for lateral movement. During incident response and remediation, we developed a special vaccine targeted to these recent Dridex samples, and we also found traces of the above-mentioned malware samples like Dridex loader and DLLs, PowerShell Empire and DoppelPaymer.


IOCS

  • IP addresses of possible C&C servers
    • 185.69.154.108; UA; Ukraine
    • 45.137.148.201; DE; Germany
    • 74.208.154.153; US; United States
    • 88.220.65.41; PL; Poland
    • 81.17.23.125; CH; Switzerland
    • 91.83.93.104; HU; Hungary
    • 2.56.213.35; NL; Netherlands
  • URLs of possible C&C servers
    • hxxps://185.69.154.108/
    • hxxps://185.69.154.108:691/
    • hxxps://45.137.148.201/
    • hxxps://74.208.154.153/
    • hxxps://74.208.154.153:3389/
    • hxxps://88.220.65.41/
    • hxxps://88.220.65.41:3389/
    • hxxps://81.17.23.125/
    • hxxps://81.17.23.125:3389/
    • hxxps://91.83.93.104/
    • hxxps://91.83.93.104:3389/
    • hxxps://2.56.213.35:443/login/process.php
  • File names – malicious hijacked DLLs – attackers use names of legitimate Windows DLLs
    • ACTIVEDS.dll
    • credui.dll
    • DUI70.dll
    • DEser.dll
    • dwmapi.dll
    • MFC42u.dll
    • NETPLWIZ.dll
    • OLEACC.dll
    • P2PCOLLAB.dll
    • P2P.dll
    • ReAgent.dll
    • Secur32.dll
    • slc.dll
    • SPP.dll
    • sqmapi.dll
    • SRCORE.dll
    • TAPI32.dll
    • UxTheme.dll
    • VERSION.dll
    • wer.dll
    • WINBRAND.dll
    • WINMM.dll
    • WINSTA.dll
    • WMsqAPI.dll
    • WTSAPI32.dll
    • XmlLite.dll
  • File hashes – loaders
    • 9cfcdb31b677f860b277ffb52425a27efdb9544bc37982d6f54f038b94433ec1 sdev.exe
  • File hashes – malicious hijacked DLLs
    • 004d073a13444cf0e43ad6cead686df5e191422a11e48e817bee5764b0808944
    • 00ab15c3e991e8c61ac03c29ae8417b83c39cd875f3d86d4722b31047e5f1c17
    • 00f3cd03bf27a3f738a9109cd3d50c598863d794d5fa5b9ff748ad34b112f2cc
    • 014ecd16b94a07315d646cb6b79bb8960e00cd9e5ceb4e4a25de8e203e8f5b63
    • 0176ed4b5db5a55a4e8b49780bde7e1b2b3296c714350a01dcb80975302ec8de
    • 01e794a5fec601c476c0ac68c1bb3f2819bf9f64b413a830fe893e2de188f1cb
    • 01e801b9aaa6438013e5bbaba9a96bc399d756db3c84aef3c6b750d53445faad
    • 021242935f11354c04e905e7d593e8e4db28bfeea9980d8b9723d6a3bcb69604
    • 02350a8228fdc0b338efdf14c28b13d4906767e8e010def14149877eb376e3b4
    • 0246bf7da0ff2ef677d794e2bb240a07c48472827aac4c387840c4194d5cce32
    • 02ba76a50cefe3fb7be5fb45a433de764043f54578d100598f17233bb7352fc8
    • 02c6120e9d1f1e1c9f30b569eafa41f147d8b3db14111ee6a96e4cc8849853ed
    • 02efc302e2b5d74c468eeaa6247a76a67a498b68f4d99be8c3c34d77dd6fe359
    • 03cc83bb3ca8af14c890d6c1b54d272bf33acad0fb64dd30f5c74fc89df591d1
    • 03db528796c6501d8ff27442bac66cc48bf8ff6571f17a839ca8e62175280ba0
    • 0412e26b3ed481108d78ca470780fcfcf1f7677fd0717ae7453afab57e57e69d
    • 04b996062b61fec760ca7707b1a849631fa60deb1c5c3f5e47e0131af74b5754
    • 04d6e149c4a08add3921dbdc7e3388cfdfb71c2ef0e7f5bf8d8738712aae533e
    • 04f36448e10f45117d659995e9ad68710854a10922b7019b0d3d406cbabd8f28
    • 05213cf77833954a44996dd115bfe1786647faa80b73166419c734d00b4f2b46
    • 05217fdf968eeb967a6eb74b205b97bcb2b8b59a15b36b6791981fb5e72c8a58
    • 0532f9eff4f9d90703bcd0b6c4d7ee4025e2b6e25f4644e08125081eac74d0f1
    • 0533dc1f849c89968dd519b28dfeb84b73a4e664056d656810a094a2a0c91e00
    • 057a2bd7f14de1f22cd89410d88e828f7c54bd7a4c716decae82e59fc1449279
    • 057d3a17bd6c674f5c7e79f930553d15a11e5bd50e4f0384f0675fd1f9e9e584
    • 05dd03fb6123447055a3bbc5b64dc87f5494af625d8c8479057ba2a0e88be7c6
    • 05e5fc4f3387b36144976786e24676f3e1ef41396c74506f8275be92d5a1d735
    • 05e66f51eb1384d27bc82075de603fba17f007163a007acc1908a9f91fc1a7ad
    • 060fc7759d87f56fea3e85263d425f32445a927c8bf7e2f7a238698674adc6df
    • 062b168d5bbd01cdb6fa3ab53817b551c4ec0280babe8fe221d6d801466c9b28
    • 064525d12ae4c82d9de6b944a1901c44611f2c2181b889be93796872e4ac8769
    • 06c0a48fd9136b7998071487a699cd44901c39cb11be7c9c1563b9496acf5568
    • 06e8a472a64b44c3cc98c6edae9c60152b4c8ab9bc37da187a79144c38b37305
    • 0757500438e10c888c0340a7ac4a6292b8c9f5a26db94fe883819c6491f4e7f5
    • 07c549e1069e630bc46cedbb9c1051328ae92eb4ce9070fd06a5f983c3894e74
    • 085d23e8efce74ebc22396889000db2fb4295514f4316218f3a06ab65104e94f
    • 088d1a322597e38dc66a82ad368eaa7f7ad764799452ff09c4c217b292dd73a7
    • 088f1571ab854a643ad978fa310dd88e60417aacd437cb5a5da24b1261c5cfd2
    • 08efa775ba0a5c1deb90eae5ff3da0479f97cd024506980cf1683017865b3a25
    • 09bbaa03eb179fd3edc429bafeab52873881edc96df0b9ab5e290269187b78ee
    • 09c1b3dd99d52ab5643d9939c0b72ee5fd8890b56e1fe992f9f7286a36929f3e
    • 0a2ca5e7c1aeb1cba43312489ee68e232f8dfe2173ef2185e5ea5383249c85ad
    • 0a61cae01e381d3cceb47139c1a3299897aec5a0ec730ffbd3d26a320f59ab44
    • 0a9d41b693b041e4363895b87f7e7c1028395bd064473040d539d00ac3256e4e
    • 0ab0a2385e6076aa406443ffd7a36da04c3ec72f66825d2c96964750cbb562d3
    • 0ab96267e857b9e636aa361af6d0cb3a6e95a3a5e11e0958e59a27662ba890e6
    • 0b0adaa7f565b7daef1719307e2f0a0e3e848d32f4c343bf232641f324b76df7
    • 0b0eda5faea0a321b82a3c1d76f0954174960fe472019859ff7f51becb0e00af
    • 0b4f501b197190a3adcd46f942377801288b77af209a6660a0efe29c6f77e605
    • 0cfab9ae23a65ce6489ed6fd88fcc9dd599711c7393264d2842b29d0557b2c39
    • 0d42a5f952dfca53349b410d1a07a58d707078e2550457bec9c834451e342583
    • 0db7ccd559307df2ec596299e4dfe7e6859cf168cbe96e891cfc911660b9c08c
    • 0e15f2f5226ac829531312038d2c12ce35f351feb00917a2a7740b682763b78d
    • 0e764e915f97ecc6b7f26b2764989e8131ee24cd85fd7154102d091fedb3a74d
    • 0e89e555278dd99666214a383a119de64deb6811d98d4ccd83a88fbc7d634bcc
    • 0f50197ae338a6351beb3de78d916843503215ef16f8547524420520ed987127
    • 0f56919e60fa16cc6c074dc54090576ff313fb70300d46f2938a367fa8f6c50e
    • 0f5f16ec359127f1422e6f7d1d0da72755bac3f27fabfe65e76f490c487661db
    • 1029279445ca11cac6c7158a99d2e53d97665d4fe532cbc2fccc7b163dcd60f1
    • 112535fe26b4777aea0ded79eaa2e579e625bb7f121d9c93123d08af4f4beb60
    • 1135fd1c56ea1bc316216765c2b6d06a339f1333b84de4b865676104e61e6b1c
    • 113772f8f1701e1ac211fc3396031aec3ad15f8c720805d9a75fbc7174987a80
    • 116ecbc586aacd6539e45e42a0aedfa31985867aca91c573ec0e89aa8c54f376
    • 117dec0f9812de775002a544136e76a7bee5e0dbe91bd74296be6c8290b2bd7c
    • 1184c26c161bcc62be08824858325c7fad652f4059b69ee2e3a60638d808929a
    • 11b646be8e717453c314b7de5c86b3e4b958ab4877dd7c15fb7fe98f68cdb825
    • 11cdbd7794758dd7c0bce6a220587eeeb288683c3f35de98e7085020f7d34680
    • 1221d4fef640d660a024bce3e55566ea239ead2d24d4da46a63cd003fdf613ee
    • 12251e2b36ba0e5c96e47547b4a5a0b89dc62d7052424b6783776946f22776cc
    • 130588427a22cfe248382a0cfc97284683fb93b0dd3056c080ceaf3da72e3a46
    • 13529b94661dd9cf428f93badc1d2ae01b914d7ab36e2e2c7bca50fb37337c28
    • 13f076f959ea9e08123ed424cf975d3687b6bc3e0fc94877cb3be69eeb2a00cb
    • 140845bef0ced02ec30902ffad891476921737687b29f63663926eb36a240a75
    • 1422c6ad3dcc8a423ca8aca435228e5329b8b99c18fc68fd09b9da2e0c70ca5f
    • 1516f8ce66a54ba83535b51b899c44330568a2ae6e0ccd38603f1d4cf42d091f
    • 153bc14efa4f6a115bb42d8bebf9d03eba87ef17b0d3ad210e976ef5ea2bbf4f
    • 15768b77ea884c53bfbecb1bdd2317600b96bf34dabfd0a32e7f4c97de883ed9
    • 15d3818aabcee033e398ebf7eec41e310f68febf2e478713130c9516f0e147b0
    • 1607b0d0df62342aa422f93ec447b162a4abc471f7fd894418dc3a96208f875a
    • 1673f730807da6012dcb05de6c19f67d2f1e0ad28f913fc8d74d312ef9fe15fc
    • 171cb68043395486a56b015730d70caa031f6030c534ccd2f96b6ca3fe95d96a
    • 171dec033d526500a5c3c338301a4fd7bdd69cdc95214194ebedbc83bdee6dea
    • 1762cb407c5037c323604d7162a20bdad72c4185e6206fda38cc7ab44a77c317
    • 17b789cc861b71281afb297d5a020675e1fbadafc8d4064ef01b179075e3954c
    • 17d428b6b0e64576973c8e5efc785f48faccde56697151c2edc8f17301be4745
    • 17f15a2b252a6b00ac01bd8e7ac0c335b3e92e6a1236254a0b4fb8b64f4d52b3
    • 184805dced09ef183148a6549d26f2f84f5d91462f230a43e7a6e4d6a96bc63d
    • 18740123da00654849f5ca61d34e47cc8f8851161cf425586846cdc251475dd1
    • 1903690949bfbcd5b61c7ea406635d08c25422f44f2fe4e7957c85d69dde9a35
    • 1947a51cfd1f68cc81cff143436dc5b34a78839c5e4e9e4de3c59d256756a343
    • 19bafccf3c199d311977e7fabdeaf1aa9ce156af1a9edadd423962d0da766021
    • 19c02b79440c4920e76c514718b7476aa86560a825f4df85ef84a5475efca26d
    • 1ad89a091a0be91acc96c9f580bce740b7e38875ef4bf145eb5e01b2bffb0901
    • 1b30797b7108f9bfb2fd1580cfec2b1cfb1c7773e0becccf3a7c61c571532ee6
    • 1b6803c41ce793a85798b3a889e8f5f88b3d274eb181f5844898f3bdfee0ef61
    • 1c02144a15c566b8e6b1bc197f4df5d73e4b49b71521d9f56aaabae23d29fc47
    • 1ca33d57a5bb7e90f30adc0714852f14e1f602cbb201e8e0176fe09cb9ad4086
    • 1cb8e02c2b06ff2d101167ae8bf7ffd3f8392c021cc36cf0701bf9bd48fb873e
    • 1d8ac81295f16162593bb938ded1efcd36542b862810c058c4b6dc826f9d269b
    • 1db09e26c2de7384e225777b28406f2427420d1b2969e161fe71544d0db4c710
    • 1e1e441913f9e1894bf852dd69371a8bb017467087d6ecad5fbc73db354d5fe5
    • 1e75fa12350160bf7fc457e9e1c22022a99df05397fdb362fce2dbffd9f6552f
    • 1e98686a9970a1f2c76ed87f263c755347ecf56bfb908d46dc328a770f846291
    • 1ee1e3e4d405bfd2282e86e8eded139483c734eb4de53c0c25e8f7f72a0088bc
    • 1f0f2f367316475efcf8d69b829b6040cdd51f6df5f0ca605d3a181b5f616ec3
    • 1f115de239ed854ac0d3c4ecbd8b97e5bf97281c97c95967a0029489c586065f
    • 1f22b91b3fec0c92db4f039f416411e054dc912af818f265971ea5feafaa60e0
    • 1fb4cc05a60de0adc1cc65b79289c9ddb2758b48e70f05e6a9ae0357ca79bdcc
    • 2034b7fc04c9a0b3bd619b3d739669c590fbc9373f24b3bb4da3da58a8db4fa0
    • 20c23dd07e0711a30242fb4bb60b60f4ad57d64a1c7dfaa8c8badf94385a93ef
    • 20f582e9878e93ec50cd568db88a658c97b8712fc9ce7e1f5061cc29db6fc29c
    • 20fcc7e373d09548ef5e92763d084686a438378b2cfc9f9e4cbe948ae27d4d09
    • 216022437f09fc9690efcf5fd1619b7d8321d9db3131202af1110dc5124d3860
    • 217ea6481ee2d5b54943803a0f0569515822f5d9171a74c137fa3956f52dfa05
    • 218800316d0a003d2ce6e7856c9da7bbad23af36b1a2b8d535d0758ba0cc07c8
    • 2188129bae32371193da59fe6ee9a4944b7aee86cd02659eafa2e2d411da6e2b
    • 219834901679664977ec6948e819ae863498104183297b4c8f274fe58de6675c
    • 219d6d3dfef915cd1feb5483e1b926b632aaa47a283036c9e558684c46d01930
    • 21a7f1c1bf012fbea0a725289749ed4b42a5dd205d584e0466910774a7929f3d
    • 21b02abb6b921c6e3a80527cce986658b2d2096da821cdf6694e38da5f3a113e
    • 21d635dc4a72582a0e7abbd5081d288f0e3a43b5c74ddc31d56e3fb74b538ffa
    • 222b5e9b593cc1dbd067c8dd1eb774597e728ffbf06179bc02db50ba47c4ac38
    • 22564b856682b35c65a4bdefcbe6919db9e8242e75cac5ab0358f26f63c8f099
    • 2295ad32f666232437b5e1b1bebfe3a9fa15d742b7dee0dec9cc19172ade5e46
    • 22d67ee741d7a40e1b3e94161d041fdfd5659df22f033cec0856b0420fcd35a9
    • 2360835b0339ba802b971df294b5ee23b7d31a1dc53e445cc2c3b54db81356b9
    • 239ea448f767ef6a8bfee7cd732598b0c327a7519b58205884797875c09d32c0
    • 23acb0fbaaf0661fdfcd1c85c9e7328719139e39eb7a141fd5c6f88cdde27b2d
    • 23ae25a7c3bf140f190cf8a2606d432a5b6a83795deabe82779d737eb4fe3313
    • 241f5ef8c32a108ada474eb8e7831112ec783790cac7c834a4dddcb7879b2b47
    • 244571dffbd270e9aaff87e18ddb855be27a2764524e343e1e2ecc21cb096f13
    • 244caadd1af84c390a034a93f82ed476f699704e3bb74a2f1cbad127427e9bc6
    • 24f9ce285a593bf770b4f5c1094c20bae1288fb7d6fbb3723c519959f1888c12
    • 250266f0aa7a9183b3060555155bf79bbc28959a72ec8da99eb4f88461d13951
    • 25a75e9cbabc06a6148ca875361b4ae20a20dc9dd42f492e25de80d309a16527
    • 25caaede352bd127f6d3cfb521d75bf402bd4820112de55651ba30d032c92a35
    • 26c989fbe127d82e7f743ccc267e209089d9c378e9b3d6ad04d6e21f86843843
    • 270708ed3ae7d60995b4fc8f3171c7ea25564af95f706c1edc7199d8d48f5443
    • 271f024caf5dcbe649c7759eee7f15eb2b471ff2815dfe2c5a1fa578a358705d
    • 272088544ad976b308fc4d13322c341baab475028a1643189cc85482078faf44
    • 2734ae3734a843ae39a8bd64b2efb73569d24a24115b26f983ad30dd432691ed
    • 2778a7ff5ed7004d9f671784c59e40848cb1baac222d7e1b4c79e95448baaab2
    • 279c21cfff885710e7f7746bdf3d83f5d4db756b4acf0f766cab3cdd0293fc2f
    • 27cf60d2f514f56908b6b703fca58e37cf431d91088322d4509af142ee478665
    • 2802528c764a9727a80522b9e7d15ffc2c1d9ecc7cecb8ed72cd1af9957608f4
    • 285649cf3eaef19c17efaaeb733c450f88590ea4299b3a22da676244162de004
    • 291fd6d9b765714ab385f69e51490a9112003d209ebe7af44c87a4d2b02fd2cd
    • 29664e8f36980d5bd109b7f623267f42b0b85f25d69168b5080cb1887c1b9775
    • 29742ea7b967abdc9391bec4fe030311800f4634896b71365e56e393547cc5ec
    • 29815062b499e390e9497f2ccd623db6ffd650c60820179b266eddb9e17245b2
    • 2a489b38e06a50cf2cf3c59f98af9d902b2989e50227475b8862cadb500b82b1
    • 2a7b1c39608c12845860f9a2d3726d069b99d2122590fee7a1c4a32a2bd1667f
    • 2b07e6d4622634ec1258135b2ceb82e9d0d968546cc4c9f8a6abcdbb1e52eb5f
    • 2b234f64c1e34887ecacffd35e17906387da34a56455fc3927d698145bb51443
    • 2b2aa26d1017b779174253ac91c8d3d2a31cbb74b99baa64c7ff92f6a5a693a6
    • 2b356d09f6a9d4f80b49d8a6dcde33e9013ddae960bef1e43d170d26ad2194a4
    • 2bb803bebbe7dbc5bda80f5c370b292d70985590c77d9806949f17c0b889adb6
    • 2becc89cf0d7778caee289b5802548dd9f7091781242eaf32302cc1b60862fa9
    • 2c5f456309d3fc139e91f762e589c3ca284ae34e36cdc6ef1ee8d2d58e26ecf6
    • 2c7064638c15cd4ce17f4c9120a946a343cca005d49e30518caa57fab536b192
    • 2ca14f6862c8920e9e53085f6d2c087b03471a6f56407c6b43aa2ffa3a225d3b
    • 2cadb21ac47a9264354ea5c83e73d13a0221171171c7c59069e02e1c0be7c4bb
    • 2d0d6c5a1998a870ee6f1d76f78dedc49d751ff779d8150abcf5b31221ba371a
    • 2d4819c8252945a06f6dfed3be7f310837811b0a8dfa7fcd715cf0d60486bc80
    • 2d6717c14803c88770f8f547ca8c3862b44e27964d35f4688410b78cb9bec654
    • 2d7886ae15f84133d6f3ad370ee5f0ccedca9aab44503abc2f2a2f2531b3d1bb
    • 2d989bc86c6512bdcb6fe1d0d8001b49ece1e55971c54769e13832ac566200fd
    • 2db86631dbd463c54ace39098fb593adae72771c120ba0c9a08a64c9116025fd
    • 2dcd0b6eb50b1b449e1d2935cb8eda3515369f25158588695004d482aea65e26
    • 2e1deb149b638e968aaffdef9aef187ceae5a8f93fd508d53ec1e114a139644a
    • 2e32f154db5cd6bcc8b9d73020bfb68552e950afa1fa4ef7aaddd454d84e7552
    • 2e718b3efa1c9a1f56d37cdb8255aa7b6a63df3b6a0d134880e5f9bf69047ad9
    • 2f92bfb76dea43c50b7ff053b44cca8da2ed4bd0d11471b3d8339f45e85467e6
    • 2fb0435536209f7ddb7867739cbb8f73c53b5eb580961b9fbc35ce87878b7168
    • 2fd8fa86ecfbf3ef52f58f94ab05133f3c4a73e9259dfce9a2ff29b2c050668c
    • 2ff110ed133a5fd06a335ba490c29c0e794dd92345505ff7585d1cd10ebaa0e5
    • 3074b0f43b3f256e851131a16274d85668ab4383de695b90b66b2cb49c534284
    • 30acbd6c877ca4d40553b086d80705a35ed2ea56d1a1f3faab97d271ee6b9b4e
    • 31008f49e4d6a79740c42fdc8415d53b186fc241e26c9c6b4484e319cd46502b
    • 3106fb5cb255c48bd09b19d882111df5267d2235a99cf86a88882fa16ce05124
    • 3129bcbd011ecc5d4286c6473ce00370b4337b43ce7d3c8884d5a04da08c2995
    • 3248f3bb7bcb6b0748120bc5c5ac7220a9734f899c1da12c3ce774761e697668
    • 324a36cbe584de2ce0d40c6a969188bf2deca0f2242056042958c8c8a05eb57d
    • 32d6414666b6e175eae12ce83bc4f524b80a5fa4c1e265cc27b9ca086c3feb0d
    • 32d72cbea2ec8d05f20f21537caf486a37354dab0022b7f08586ee12fe32b5e8
    • 32eb3e11763237cc63a4bfb020ee888d803988fcbe9a7dfeb2ddfbf58ea4fa0c
    • 33364c69a136fed4c36193d58bf04ea55896ea2f25b59f8bd96d004aab4d3cec
    • 33369031b60e382fc95cb0cd200e3f1932613b9560f0f2972c61ff2350ec564b
    • 33c74973febe4f944ef5b1fe55bdd4eb05d9f36916616c4b59a144cbb2193054
    • 33e6a577540c5a7986002f3bc67d21542790054930e34288f377661a3a61e21c
    • 33eaa82af36590921cefaaf6acc0ed23522b6f5681931a365fb7ae032e1a1eb9
    • 33fbe650a3603956adf452f14f738c51dc7e27ab9698590bda2c56afe679c46c
    • 347e95c981ce8b128806a7935f24b914369b78a28b2d87589547a62ec2a60ec7
    • 34c2467798fa0efdb44fb050486e47d0bc61dffd5554e867579a557c1a762223
    • 34d3e804361ee9574a60bfb42517860cb20df6471ba89c07ce96fd783faac023
    • 3504a003ac2ba2812081a01b0c554871dae3eef5534d7f71b7596cf375240461
    • 3532f92437d670251c3839926229351b751659d1feb34a1d271c61cc9032bf98
    • 355838279e23c855359e2ac9483687654bb86bbad5cac62fd5721d065c17314f
    • 356d813bab9adc1c77b99a755f16041cb0adf46eedbd6c1e5ae9c43e10452665
    • 35b4d1efd04edcb86e1345de80625273469e7e6badb8fe1265a8d0483c756137
    • 36806783ef418faddb782f6405ffc13dbdbfc825f03a57f9e25638a4ec432457
    • 3696ef76ee98c460c9d7d562da9fdf205d78f5995140b05dada78d34759b76d9
    • 36eab8f0e9f861167cae920c4c047fcf6991d9bc1a7ea93379a234c43f18d1fc
    • 371b1eea2715c0d47df54991c1b09efbfe3cf6209ce1a738e7e4d0b657fab4d9
    • 373043f527d10c5500cba030c67be7beef9f8aea173f53c4bb7044c20f3436e1
    • 377d3f17a0d4389a08f1be395c0cfca459e381291c03ce2e46dc8c8dac9646b1
    • 37ebf3d59eafd1cf01ed6f5141eeb0878bfcc6f44f3eb96dba84630886148fc8
    • 3952e3482146becf4b108e2b8721cccaf74397bac28e50a1475464e06772e7b5
    • 3975a256dbe7673c342b73d87b4499946a845da6e3344d1fbd1af58722863cd0
    • 3a7fe6995eff666264f1e8cacc9bb791a2d610be86b54ecabb6810bc1d7f9be1
    • 3aeac3149c475d3bf55158755dc9e76e52673ed04106ee310b9bd5dee073c0c3
    • 3b629a507b8939f39797e17016382786323db42e16c264a3f5dcc5476b95c74a
    • 3ba58089474344ae1ce3250baec4f9e00aa734b6268ac0e1d984c0635affc4cd
    • 3bc4daf018d1bf51841bf2d23150ff838a8487a02917b93d05e48d5b4722b6ec
    • 3c2b151b3cdabc6ef5a518c15440fd6d16b4a7b586e50f11c12fa3851f28adfe
    • 3c3dbb3bd24442db12efc78b818dbcfca8cfbeba7f90a38535c688a8984fe6dc
    • 3c4ab3bd05f3521fd0899845ceeb2c21a1a115936e28134fa884ed80694455e3
    • 3c70a03880e4c7adeec299e8f414cee4f2a616d899a340ca8fd82a32a302ad7b
    • 3c77fd6b70bc3ae7035b64bb76c2e3f7123741da8ca4cf6e78e7f2a7556cb7eb
    • 3c78832d8c98994725e0d4425175351d36e84db3871e642c039e19e50935a2f8
    • 3d255be054aff1f6faf6ffd4bb775178ccee625e449485f520b4005169092e70
    • 3d2fd00900ad506eec9901ff71ba4e7628fd03f7f07637774f91df39ce26a52a
    • 3d8e7d52ff6aa2b8b796326655e6e9ccb7aab3615f24777e95f225a9add20c6d
    • 3da65ac0c4a79b3b2cedc88d618dee03226db540f660086b919b25d295d8bab4
    • 3e0355b48f2a2dde69ec3179b8f92dcc6d34b2a851f67e55ae4d7be50ab3ab30
    • 3e927c54592f9c8de519ef9fd3d3d629613e8e319bb4ef4833bd5bdc0178c080
    • 3ea85d613ec966f76a23499bd99e7a4e70152de9a83066da54700b9ca4f8080f
    • 3eaf1533de5a78e4dc628a44f1c1645e100507e5682807af64296526cda21ebd
    • 3f4f5bffea097b3eb0601ed37fab4da6103d0a9262e8367e82ea362873b75910
    • 3f5a8503f3d4d6b4d1cd94e974a52df070592b592139e356dae51ef8adc01402
    • 3f686b56708d3c780dca22e40a11c0011751f474286147be37484cb6bab84adf
    • 3f904868072989da0230eb99e6d3f7a27f9e6dcf0bb58b0fad5cc24dca0f4293
    • 409ba5cc13683a7d518f3fd3694faf66ee60b5d8ed9b1849da4b018cbe95e435
    • 40c0be564b4e83c8880894c406cf97b23cebb3f1d2c81ce428879170daff4838
    • 4153d24053ca449091aa44fea8012088688360d063cc473b84f29eb8cc6c5a1a
    • 415fe542107114d48964ed295a70658c3808a90f2430d6d4d83efce46b9f4102
    • 416ab4ca7c0753f4177feb24b40b7bcb808206ac8240ceb5d38199967ac0242d
    • 4246e837b76752e1a044ddccad1bbe5ea3bb200e4ecacd682144a5bbdebe953c
    • 426afb2b606031dbc0778d77f7cc16adc54cf268a898b4ea15309217baf74b63
    • 4270caef132cbd89eafc4634db1dbdf7505be13daa1ef7122b6b227a9ebf15a5
    • 430ff91672af13307906d31c91632c2f76f630f33061062dd2186507212ebdd7
    • 43537a746189f2e42025f2b28d8a33bd68f63717bf0d080573020c038e44d2a4
    • 43bf1bf38f02b6b68a56f33db8be43f6c6ea374d6a06b021e0e3e63a871f8ded
    • 4454ce396ec3fdf4114c59f89531b70116719b49568f78e3e96cfa82f2e3887d
    • 454a67114c6a5e648a2d01071166a9129543ea477838a41ce27ca932150436b8
    • 4574ef5ab0ddb5c0726599e59a6021f2328a46959f80ddbba2ef98e1f7225ede
    • 45d1209a8438d252a1e73a3b536859b8da0cb2f7cb49a55301b9350a66307030
    • 46576a9094fc086954ba11cc77a1ad1b75814d42aaf583a31f346dabb78821f1
    • 479f8be39a4de0783fe1217b0bbf84569767ce6879c4c11a8a88b89d272df409
    • 47d607c25c68b5c86a6ecee5ec7de0170129bafcc77511eea25af016ef3b4e62
    • 47da6e86f72277e8eb094ab1a412b42523fd5d23b0298c83142fdc0740376a3d
    • 4844418a99abdf746818da8ee2f68790548a727c707a4e0c443496fb64491c4f
    • 48688dd08652ebe5b587808823f216872ba7d2645c7f801c896b5b6657bc0c31
    • 488b18bb716e3535347c3fd85d96c9e63869e77bc1df26f6e5afdf2d04d948a8
    • 48d7762be8858d4a7325976a503054790b6f8c4e05f02207e9a7da4d73cfb376
    • 48f25d4ba6e2d6013aa8ca4bce26b16a268b15c1124e95459959f904e5183dc5
    • 48f65f0ac7be8adcd44022e8f6af817f6111c75a75319d4eb5732ce75c06e4ed
    • 4973b9207817e94dadde34b0e02ccc139111df5edde4ba70c3b21508585f7d4b
    • 498db27f76c83375af5483299567e670edb121b8ebd77e2d91ac94086564f94c
    • 49c2764542380dacbc21b64e03a9d4a635706a92c0894093d9443353b23f0437
    • 4a35a0815d0d8ed4bb49f37f7d813afe75a9af31b292bd38e42e1525b17ed9e8
    • 4a3c0153db9b278ff16b1e4b570c4c8d6bd15e3831ac883906cd837148511354
    • 4a4ff39c5d5254eb78f72466bb690c1f238bd8f94488d2eb3fe8fb2933085615
    • 4aea628d7f0159f2b04ef44bc56cea6e7a252405c720dc5c7831d28925a28265
    • 4aec27a5928311a4e3f5877cf3c139b7b271ad545d27e0cc984f111f580a859a
    • 4af6227516e08a63529f37e5f1735e6556d269ce3b33384e3eec4b75d4e5214b
    • 4ba2ec246dde750f39a08ded062c5351733890419132dd598ab64a319726c064
    • 4be5152db2682db75d2e68a082f025356d3c06db1b1d7e0192a8c12647cb5f30
    • 4bffe7c22d5810549cdfb3c67e341eaca10823ef7716138333dc0e48cae6486f
    • 4c0a181f9772c6f120b940369200e0d78f6cf9bb0baefa16c43408671f587d6c
    • 4c3246c0bad23d916fdb0093075f801495c4a4b15dd6224d198981d1e6cc8dd3
    • 4c6ae9621b66878bceefdc27e2ffca905228f2b99ee16f93e7f96ae2f76adbb4
    • 4cbda33008830ace8f745bc060f44082d7a2775344e9f8c632b24c2025074496
    • 4cf896986ffc2431b2e723ef0098d7484fab1630fcd22f8e001badac69ddd0af
    • 4d16dcc9812d641358bc76edcad2d739c8edfec209dbb61c32d9572d17b57ddd
    • 4d936a5e22934dc9f3d4c9b0a7b05b4548fc9732951c81c7ae09111e45f57714
    • 4dbc180d5ce308f9294410c1b4dab744f308439bfdda493c3d5b33c22b450a16
    • 4dd3d4015e14788a44f13fe47876b97b3bf14da9b9d7735ec54fa5e5218cb917
    • 4e6714ea98e140332e1f1507f1ab5d622be61503ab6143d68e3485c995b499ea
    • 4e97b119603121a52825bda9017ee000fbdae5f776e2caf829e4affadc871ee7
    • 4edb06071f6629d8d3dd6eb4b700b1339c4f66a45b021404b577db0e65009f85
    • 4f1574ed2e8278c25a94f985f51f76b6bf988a15fcf7cf004bad5d1c0374e4b1
    • 4f524e31dd49a180487def60a92a7fc56f36675713b4b07229ba8577edc8a51e
    • 4f8a048ca2323488ef508a6b989a8e62489edf7496c5f682f2e855378f452527
    • 508f83476fccfd3a7f0e433dc63ca6dabdcaae808f4b931a7c3e6b5092aeea6f
    • 509643c7c58c7da597f728cca1302fdada646854c1de0eae66c32df4ab40ab92
    • 50d0f44c6ea0416c845b054d6042612dee44f2b6251a947fde5c27ad37f2f0d0
    • 5150e729007cb116232eefb4ddde70cb6b3e336c6d83c3d56b7e130728ace374
    • 5156c9d63d7ef781055ad2f109b26194b328e05b99f203a01dd8f8f4f54f0517
    • 5191236b3c3b572f2b87e556d2c112b96d0169d626389453fc8bbe61e2d3aa6c
    • 51f5c8f97a29a6b58e32cd6b69527282eb16429efa56f05f66320945fb18c9e1
    • 521e1a3d173107e8a66b7077c9ea6df037d62bcaf53ad2a7dd681d755009d84f
    • 5282f453d341fb3e6b33807c8bc9aa4170d7771aae3df45adf1bce14155cdeb5
    • 5317efb58549d50af008e9822c437ccc6025717ae6cc068819e1ebaa95275335
    • 53377e412e752fd13bb08a97847337509a8ededb7778e3801e6f6819093321e0
    • 5340bf5aba33abb00e1093104a0b1fcbfa3d158fe3eb8e1029facbef549768e0
    • 535aefe0c64631a94adba6c60dd6ea7e5af3929f362a47fec7a1aa7dde019e7d
    • 540e25a4641d0ff73c852a6741ff91d009c4a41c0289a532c96776a794e22eb5
    • 543730ba6cdb626ead406b81f41b5ab9695966f7071f50583b25a5748694e4e8
    • 54961e03a16b8d138f9e2492476d807d7c80f26576f6f855ed444e22fe71f5d9
    • 549fe9565a890a14c3b859e4429e7aecc4487dbbba974ab869e79cc262656a31
    • 54bdaa26218855a4ab6b1946f44e56177f9ffe4d178c82d1427133213f205ecc
    • 54be07eea693ae758e1865baa64c06ecbbb3347290769cf0a1da5e24dcef22cf
    • 54bfdd351b4d3868745f272f640b02faa6c7d181da9bd6f58d10662b25979dcd
    • 54c077e7bfa2bb31ec3cc7f39fd8ec7457da3bce13e7badeb8473a042a391696
    • 54c363bb5bf96ed68bd0d20f3dff20b9f228c5c89f32d095c0b66051adcdfdf7
    • 54cecc5c7bf63616584fb36daf77af6cc77c59f4a8208bee2a6307bda14178f4
    • 54da1e7096f9e71bc75c46d636d123f7f107d544bb0448300ee82bf727c2e085
    • 5547905de8de01e0c90ce8cc0f9a45eae349a61d375612f19cfe1a55a2cec1dc
    • 55be3fb042035ffc3edb23688491fc91d396e6a939d23de9d98c7a3fd3cab591
    • 55cb3d6bdd38d2bd24af41886d6b7822ac7deeab04afc760ef497c5490e48b81
    • 55ddf4ea7995b82d745636f76b3b05f824e0371b51ef1585fff49fbfcb3684f0
    • 56857e4060cb55114202d6398d9e277affaa358d1771d83b73cff27b81e0a4ae
    • 56a9512bfba931e1aec10faf510f4ed79966044b5d02f634167a86eefaccbfad
    • 5765576ffb8b7e1807d9b0c29e10586ca5910a69febe1378de5f9b6cd4f065a4
    • 57b37fcc790c81d663db9dc6107a907493a9cd697ede049e20b9126b3e54174c
    • 583b4ad0261f6caf75e3ddb9616d32ae22e64ede114924adb8a41f7c5a838950
    • 58500011874127fc9bacd8a8830521a98a402ee5afd0b4eff6a4fe0fd315c6d2
    • 58bf45e53c6d1b97c630301dcc4857fe9f6250e0b17394dea42e38148a6e527c
    • 591aec09f69b09e965e1015003643be55992fe13eff04a682ac3a1c960917a5c
    • 595eaa263fa7528c87931683990a5d13d19b68eeabbd5d51c2e1463f0756ba57
    • 59f507c69ad6368dfb389cf4764c60350422158c73d25332a361d4325f97bd87
    • 5acf8e9a00d6aabf4f08877bd1b31b5bdb82882c25b5e355c28feae20685cb17
    • 5b33189f55a90ccc687fb33f1dd9c2577e21f2ccb6dd846c7e578aedbf765336
    • 5b49354710df8b68ff09801430fa658e2e78ac7a4294d55d992935bc15fc3033
    • 5b5596ae4678858eb0d4b6f313c8e067db90dad9ea43144210ba97a9d0c5d065
    • 5b821caade1447985e4475a56c60b5f055ff997c0cbb83100b9c5d7b5d24c69c
    • 5b896dbb849c985858b3ddbc5224ac0127477d93f8cca70ba883c30fc809f850
    • 5bc92550a2d1dc58e486804d954dbd53e57c29e3d570c9908220340b188742c8
    • 5c3c08b176b78d83a86422f52af6cff87457cc9ae2e516df956b619e78872e68
    • 5c4c90a64ec199b213b6a8ca9408944abf3c3cf9f0b27dd3200a788738f4d12f
    • 5c531a4bc08167314a30db9346c5029e22fb1f2a54d167b12cc2cbf8c73ea2a4
    • 5c736ef3556e79674ea64f79167ff295d1087bcb67f58d1988c3cda1ef442cbd
    • 5c9d77c91ad6cee5290f266af1a0179df0aecbb91d9fabae21b6a1235607c7f2
    • 5caaea5ce6ff261dfb26844ed97b11bedc6e4ad84d9234ab5379573013c5f673
    • 5cf495e38ef6732d236e3429531f5ef80c1158fc81d97dabd2bb63cbe6df35c2
    • 5d1009472faab5b512403f5a07ed9c3595fa9afdf4e7dbe95be1bedc3557308d
    • 5d7365ba3289c55b5beb1a0eb08351fca2327ec39c1e343b44f40b62a0e9b00d
    • 5d8d04b205e022c5e156b4c30e9d49625f38182b60139cdcbdf6d9d376301759
    • 5dec7b1b36a6fff9e2f09de934bc399e3a1eee8751248151d9efcde0546da543
    • 5dedbb41fefca549038f64b7064cedb6bd4982cc2ab195c7b23ac12963dcf1f0
    • 5df8072a441bf68c5fb7c5de9ab8c5061c68290e6db7acf25fbd45e4a6ba7baa
    • 5e2f88ec98e388d01df92a7cfde25c50bf0ad3f649f9eb02fa829f24643a59cd
    • 5e6849806c10402894bbdd72cca8f2db929ff46b9e53e5f7357a3518ff98f94d
    • 5e7a982ee897fe3a61bbe90b8a36df58383546d271ae8b0ceab1736c61172886
    • 5eadd31aabbd42149e40304d1e755df94594d87ed44dec7992d0699cf8fa83f4
    • 5eb09ae5314e4cea59bf9fbdeb417fad7b17e50ada2ffc966970607e24b0d656
    • 5f85c7dca6dc58b08264107984dd257b2efc76dc755b26ab7e37ef0ef5384351
    • 5fbb95ef165279af8d548d32b4d2893db41e5d34ced98af5f4e0a22b10f376d3
    • 60373d3293031cd5cd9a7bf01eebb6c0e3d321d8e7d31b13dae6f185443267fa
    • 61076a4b553e5de8f1c2cdc01cbbeb729edd471ad25697ecbfb7de6897fb8b8e
    • 6127c2983da1219b14282f21d376ba74c0fe96dc538bdc4761f751f42de471c4
    • 614b399e2d57daceb1d7f3a28e09b5457d2321ecc483d32cce0b19e3db5ea367
    • 615271f346dbbd463c51e3411351f0f62097bacf602c2f41dd034b6b85be4937
    • 61691f149d6f229152d6da087d409b9d7eb56c96791d3308923e5e1b2ecfb772
    • 61a4b79081deec65655ecda1769543f7a6c41fd2fd5dd330f6b8281448baf574
    • 61e8d7739740c4d2c3a827f794f67a3204c67ddbe2082d4413c2e5471c7d8c15
    • 62741e9b84dd393fc338e249f4367acc3e6dbeb95b2677911a75e9f890291f63
    • 62eeae2f097653e1da974c91e367502d2f1e1afa8bee6ebdd82ae46a73a7a7a8
    • 630033cd862e672a66789bd32277542eb44c64b818aff6fc2ac64f11a3655e3b
    • 6485b6153cb4456d01bc1b7f1c587aba48d10450ea5ddeb7488b2f4f0fd8c36f
    • 6534c166473a63c70e634cb9861f98e99c372373e567ab5594a2277bf14021d9
    • 65987c53215c689661a372e8504a736d39354b5a28ccc7b3028d46f56b90b44d
    • 65c8a8dab9cf4cb2691a5687f8dde53c0e1990ea823447568cb5156e2381e5b8
    • 65d09c6341b4c7eef23e6b6f54deac0e1e9c699b15308ac0a73774e00c57afaf
    • 66c4078add242d9670602ed661a87315e0145635b1b841c0a4eae0e64467a57b
    • 66c872b93afc8488e576b343182f5ea9ef986a51cdde46c6d677df02474cd92c
    • 66d5d40aadc45af5c54388772c4033db62575fdbded16207b19e64a398fd0b38
    • 66f7bc088bf1294ca0891d04ad963ed713fbd3f7f2d1a8e28417bf2d9ad23312
    • 67bbe23868cf36a1d7a3b5a53ba0b0c5d46497a62ca4f4d7dab43dbf57bd5d38
    • 683202f2aefedad0c49d95ed0814329499ffe98e46eae58d170a221dfcb517c1
    • 68a3879fc89adaf4c537320c84d5d9c69526d19546c2327e1e42a30e188b6f5a
    • 68e83d6bb16a8a66b7185f1371f807e4304e22a936d2bd82fd126df1a0f0a95c
    • 692b8b1cdd43f56ffb2b567192d753833897a55d594c49873326871b60e5c450
    • 6945a40f2e2e5fd3363b7962cc24e1b608e980684c3ab72617b5de324617b47c
    • 69dc4d139aeacc638f5f5095875b2103e2547af782cb5f098a94bd2efe5b3eae
    • 6a04318988f1f7e02639d26f50b56cfabffceae400a00af3e722e6b1ce8e323c
    • 6a05826d7a58715805533da5645a9366e7ef4f54496667ed74ae793f814a7924
    • 6a70c40c04e819df8343ee33128b0ad2472e7079bdac227fae717fe81eb52b58
    • 6aa00a1b7a3dbd0e4e75e64f7b890c06f2b4431156e6dcc8006de9b58bb81c6e
    • 6acec73b8d96e38014fe3eb52630d83e0eddccc7fdd477bacb414b9f753f6a9c
    • 6aecfc2b6c5ed334e0351aaf7011312b21b8a4dd05013e70f62cdc9175e63450
    • 6afa18614294f425e695a8cb5afdc1c3d9695cb4c74931adf0dd9677741fcdb7
    • 6afb4478e0b2e7a87531c7625c4ae70639d72ee2623bf5f44abf7c277f5bb8f1
    • 6c556ff61667b11df5c40a36ad0d2f0c49e977b9374245a9d204e059ea25988f
    • 6c7d25c2a3671fbd13a4e01da6b70ed7b959cd02b5fef1f8d5e7930245f4d9d6
    • 6cb69568a811a0f4edfb20ca48fe2168c57783a9e4c03811e3168ed4167f9a54
    • 6cbe375a0bbc67f565aa9167aea0301d7aff9423cb2d6398e7112df67a6be5b9
    • 6e28135f5db78dae5a4a37d03ac3eb8e873246f9ebadc6f96f52c85cdbf56106
    • 6e29a175de8d7feb9695b73e7522ec601bf07630add876eabb5ea99b8231fee8
    • 6f47a01f6c54a225fed5d6b0d405d3a0a266f7c2c79c67c0c6f9dd5cec4d9ba4
    • 6f627b6033e984c073582e20d81587bc9c862a38e97e78ece64cb70bb5cc8cd2
    • 6fc65237270d952929894178f32888418b4f13b6b89a7ecf3128a0394f253992
    • 7041d28540e68837c89f2e582641bcd50d68e89c64a6a520000ddf5e77469f13
    • 705e6c7793d0c642c33f83d7fcd8adf1a49075d00a976ea462b12f7ed1dccd96
    • 7101ad0a1eac639080341090add8701c7584b6a08e44875ebc956fd55921c2bf
    • 714fbf7c398b63b882f8479353a87d234553350add0b17ef510847d00e77d80f
    • 719b321486096c766adf4c2e808e5bfbcf1bd51bc4fb5f1802592ab9fcb77480
    • 71e0a8df7ee0ba3acda44c5f08ecf551dc11175d7d7d1e010ad152e8426246e9
    • 71fe22a7939371b2bc6668dc7f5d1c44ad588a89263f6b9520c8b0cadbb1cb38
    • 720fc8901fd5696f0cde9e2aebe658c6e81f494cd64b23c5920dddf07af6c86c
    • 72107abc18aad5aca45c3789b86e52467b909ccbbb1ef6893eefd674789d4d4f
    • 72358bcb3a4c7735616ee66e0333b7a77fff1fe6a5685cda6427189c4c2eede3
    • 724181223115be71732d7dd37e38e598aef879d9bfb0c7f341715b045fabe145
    • 7257d4002bbbd6d42cb82ea9a1273da7c7a39fc5dc7240ba973c0cad71eca0e7
    • 725f633d793e38009ffb547ad9c40cd00c9641d0903acfa48c70fbd514e6b63b
    • 729a8d00e6d7ed26017752343b9ded8935f953cd64461349783003231469be9f
    • 729da5cc471cf7aae21f5497dfd2fffb5959a7cc3c77aa4ebb97fe61dd73fd00
    • 731032c9fd51d19cdba5f31199aa16732eba230880fbe051fca4c9ca8900332d
    • 732fba9842be8d43f6ae8077f47abb4b40596ed5d5481695b18c006df066a6b2
    • 73c63edad2577baef0e2b3157737015f0ab701bc46e4060d39e9fab198cab0dd
    • 742b84225fdf50975ec6ca5702ba9b19398803f78a0d97a0c390f414a587adab
    • 74425e746c1a5da502a0ba3ad5225f0c6d9a0adba8fc294f5a7e5f471298d575
    • 744f0f012310a68acb6261ff14c4b37341c187808683de18ec0bd622cf77a45a
    • 751625424195a9c2d261f4736dbd53282c36668501de01d6bfbf42f720c8f00b
    • 754e451e9d8cc8f9f88e0a89bccd1d1df1dbe082e57da1e3add3fa85d801751f
    • 7583e0b9a0f46fd66c4a4286e4a90575ffd586766ef06b6f90fabf369136f42a
    • 75cd0e5f3afc16754fcbd0b36855ee3cf588053ec790a4135a259567c2e4ac9a
    • 7658873d95e7906a508e9512ea5c9eef620f3932fd32a2116a2582feef92c312
    • 773dfa50ae57c3f8ef23b942a1efba8e76058a30b7a090745e862a7c3f40c619
    • 774c0c69f79dab95c6fdb92cd7a15c8ede23a05db8125722349cf31a8c555b8f
    • 7757f9c3f4116b13ec4d03e50c6b25315b7c9f84ae14d709c3c64c88383f6c08
    • 775b9319de9d55f7f7b20a8e265d672d1225f7957d40805d153c01b1d2ab603b
    • 7772c5992f5670a4a21358156e43c5c32e01c64e1c34ff4033b15834bea5cc88
    • 7790448c4309e0add0dae982b7764fc1a0a2810f38afc152faca3c1f7dbe98fa
    • 77ad453a35159e251f9c8bd7e9c9dd64e268a0bcae1072dbe6ca321a22b22be8
    • 77d6205ed87207b99ae588fae63a3531ebfce431fd604065f39755a61c0e846c
    • 7822ef236809e4d78f0b41062a19357d5fde46761d71612b5ef77e4730969973
    • 782b6b6492b23d0b1b6a8eb3d6ed0b8c43438789f9f8bb40131b4960ac5dbe40
    • 782dd753b5d896a6746f3f7f087170605280004c8fcef251aa09782ee224a771
    • 78429628c58a1419f9017b616eb110f0b46ed5152e2b5d29ac2b542d9f7ae0c5
    • 789d4f55ee99f18a80ca0c1d7b9e75e71d489768514a9b8209aa16f752b80283
    • 789d89f6d77267575abea89d3724babceadcb5cfb8725541605203347f21943e
    • 78a404c263cdb55fe99981bbaae8abdfa872b96d3aa60c46096263420826af05
    • 78b7173db3083427f157431db0326898fa683fcfa58d9b16416e250db62ca33e
    • 79101328fa4b1480d0a51190bfe78c9d3fb58fc6e8c5b979c41e2e558747e5d6
    • 7914fa4968d90464a04612a646b6630bf66c3287336b64733dfd80d8137783b5
    • 7943fc20199ede2f7a2179db71a74f681ca9cd40c6a90f03a4bf4c236e1c00b3
    • 795c3e7ff1ff35a81199315e5839bc9371311e0c9006ac05f40c1644d9c919d7
    • 7a47298c178337026d982dfeb8c432a19f144b20053f6eccdc08df571f41f6f4
    • 7a8337d53977925f10b5a3535e612b1bd861cfb48c43864d7e0743b97a68bbe1
    • 7ad8727cf7f6d8ca4e01ea0bd7b6f2ffd3d6cb8e316bd7038c16c3c710a03804
    • 7ada616e082bb065f0de1c38d5d93ff291315bcb67aad809148b3abb1ddf1d6c
    • 7af1d07069b1d1e5d056f5a83320f12c5d01e9aea1c9f076b0dcd64cef8f2d32
    • 7b24d9f1e04090cef92a0129a06ab908fe2ad746f0b7cef800279345ccf9bd4d
    • 7b3a8bc4a7e56074f18aff90550f34d355a45cff0bcab331f83e66a3c01bce8a
    • 7badfd5c24bdae0f3123d97686d40f6d8c2c6056521e0a5537051c3f6b934d63
    • 7c2854b7a65a291e2abcd7e9ac299f399b90001dc798484576f9550be0078c95
    • 7c5df2c27c038438ddb7f28a7a47b1d66df7ad0ae0bf8ee665b57e4f58de0e7d
    • 7c5e19184af7e2e3f3b8551acab2c79e356cc0f2e976231692976188cb8117fb
    • 7cafceaf63133d3af8d66004ad88dc6ecb0a6a5bdfa2ae6caaee620ecfe122a4
    • 7cfff3761f85cad5a193bc5ab58dd594a2f19359277d6adcdd7a0adec7fcc3af
    • 7d0a46fa2384a8f8d4ebc6fdb12a0bd117f496251fcf70827c8330400b2d98d9
    • 7d10bfcf77a4af4ebb9535f0455d643991215dab1160ea05019155f495d2877e
    • 7d20bb4817c882ac002fa4881fae42fd0dd6d61d6792c6e4a71e71d6141bad17
    • 7d5ed3656089cc5a3a891909d2b877710a2face485b56f6f5abeb9c9480560d0
    • 7dc6d7d99091067f38d7d9f51953c2d1379f765e5443dadf117f5362ef3b1c54
    • 7ddd19f77d67c691bd8b135fc32047427e0a478cf96b156351b1b77b6cba5912
    • 7e29b8c640cf9f190a9d928b328f6daf820c2794ad6c9eb179fa6c6f674a08af
    • 7e4b64141be016ac9d9c9277cde2c6df7d2a55488db6cc15cb21a30494a0efc3
    • 7e59af2181455b016bd43aa8402ea0b540f6b3678aa1372ef080b6bb02dfc955
    • 7e5f788bd45a57ff5910aac04897e287f2a922303f7e329ce476bda2745fb3b9
    • 7eb732d4f930eb24eb53c07dde82b587ee8d2ec4f200b40c8711314ec37c8376
    • 7f2ac28ef4a1a1699febbe97134a3b4433da03d934e006cc41b975bbe3b89bee
    • 7f6deee9e0b82e0895be525b2518e4baa8e6ef7be31037b899bf54fae65072b4
    • 80443ebfc075116515f5bb9216a44cdf2db39fafa93a3b896ad36435640f09d8
    • 805b9f7ab6133d68dc1763c38a40038e802afdb296612a2e51e8ad76df29852d
    • 808a207683a19f58762685b81a2e8eb9472ec1c6d8db3641baa948494bf2708b
    • 80dcd49245c2ec340a3eb03b10ffa3119b0463337ae1f1bfb9bba9cfcafc0615
    • 80dfdc7b0e839af37ce7ba5e31bdecad6a1b964918098b66ccbf88810817d22f
    • 81425306531b9d6ce72af5e6a1047c6d028d9cb61b47611f0f379f5ec964103d
    • 815fbb64ad93a18afcbb523e2dee131883d0fe00afc7fec97f1e8f5f4f65eea3
    • 81a36cc4050647acc6d01a1ead58410606543c6988bcf8e3d52b04f8a8b63cd0
    • 82877534115d9eb8342a7d6a0793726620d3e71da664317613722b45a5c4646e
    • 8333ee0bb9ace28c9a4a04a9c5339764f9b877b3ac1eb6159478a8cfaacf2e81
    • 835a840780506668469a392fdbed5aebb17c84a559edcab7bd5a82fa7b0c4430
    • 8403798da528417e21f8052dfecf324f22fe0b6faa97f372f28e562f002b8b61
    • 8454296a2c717dffaeb7ffb9b508fae3fb58dee16063e02afa3aa3212be06872
    • 84fda1b1518b42db00fbb7a9f3c8144873c509c090c9f5ce399aa969a9e219be
    • 85484dfb37c2cdc61e667bf0c64e86c7f1210b725339808f8f1d9d77ed3c9785
    • 855bf4e2ecc03d500dc9991558be15a740c13345faa82ba03a91ed52f192ed37
    • 85bf11a3c090e2eafb29a0f412a6a83d1b1c47b0c38e7418805123f121352d04
    • 861917d0401ce9c2d490f24be24f3f1a92f2e023dfa6d0964bd24f5b613cd2cf
    • 8640d930876c620b81b382e0bb0603842c162a0561680cd112b6d5d06f7dfc05
    • 866f2738b194eaeacf0222a0f0f5283d624eaaef76b52b337101300ea470b36b
    • 868e5abe8616dd3e88914468183e89f2689239a1c7dcb92688f7b75a333bf2d1
    • 87711ac6824629e5ceff7d37db96ba0e9430cad8fa319dea9dba2106c47b65a4
    • 87d81a1883a36f63a4fe49f2f3ca98bc0afa285fa4c8a6c1abbe9d6dd7e4d0d6
    • 87dbb4151bebe3d40c782ff76a83b907c58d6c2be0abdd27d2e1a1225eb5cd38
    • 87f82aec9c182bba0f22c556fb4f50a3f7cf86a21513dc7654758a8b88eaef33
    • 8870f0e78117ab735c08c01e05e0a3bacff10ca7ebb8c1e3cea9644f1bc5e20e
    • 88d832089a52893d9063119de5146111e2377cfe589f7f5df1944768d3e8af4c
    • 894465740fe37d30d572e05c9074ac63945e1493e3d36ccd82d699d4fd6387ef
    • 898284024ffb757f4963db5ee8638f5e7278aacd3696eff32e464aa43d3e4b1e
    • 89b8168840a4ee93fae4d4f8dafb1ffa91de376b6467c7ae53965b9dbad69873
    • 89c2f4abb2645df286476e5e73eff1040d613aab942641a4695b1eb0c45e2cef
    • 8a1f21217de763b0c129ed56f046e6cadfefe80bd5fd21766f351371831197a6
    • 8a99bcc248aac1910ab83d0c8847c39c39127afee9c83ba81cf104eba1a25995
    • 8ab1fdc7f99baa2c1b793d76b61b3f18812355b6dba7a3d7e8bb1a4f70f5f47c
    • 8aebfe422f1d176ff7bed14b772485ecce1112d8ef3fc166150888e401119c80
    • 8b522500dff3872505e1f6c5e037600fdcc1e997f7d0c52b475f1975a077a2d2
    • 8b82e260d695b5b173b4c3af2596102d5bd29e842d151d8d5f4401b3b8735582
    • 8b89e795402ebe962eb634565487cfc275c0188c4afecc664ecfe52151a00de1
    • 8bad1da54f90e5de59e12419315d0546c4a224ff2d5cea1c418c916eacba12ab
    • 8bba8fbaaa1662d924a9c6c74a8a226422f26049f23160664b7acc24182a00cf
    • 8c99409ba10f2cc12ae5d6a8b7990588a4242b1fa2f009be1bff6540bb51f780
    • 8ca02b4c01b077cab87f0e19121490728eab45ae226b687e649516e06c8e89a7
    • 8ccb9de780609b86647fb927af3c97cc48a956b85649e965073fc7da45fe665f
    • 8d12f78caee81741faf52fade92cd6383efd72849cbb2ba9f17d67b2aafecde5
    • 8d47ac28edcb3c69e1895e639772d8277fb27cdc0f873d544eb0f7643ac07446
    • 8d56d2894944db5c1a9131feada757ee33b103dc5f23a4340916d002654ac276
    • 8d7ff403f998e91177d0f32edf77269ef0e1b8f82741d051e328e9f7804d1daa
    • 8dddcb0b98bbfd0d6171320e52e6574c302a8e0e16e03e8fcf2254fb146c88ea
    • 8e109f1c5b70618bac159e6a2b7e96051349df5ead5704e7b2afa4aaac40c61e
    • 8e43f3da6c773c3eab40bf8c65b9e31d496cb6ff8a587a3b080f17b649469f27
    • 8e82f2119da9fb57ba220b776b4d899bf117fb1b80d52b9ccf5a57715c83d561
    • 8ea495c339c0e8f4d945b97baa50399381948e5c88bc84cbaac236c8d735e4db
    • 8eabc2123c0c06b959ae1bcc894c0127552241f59ed5547a44a672d3c2d76b52
    • 8f1cbe7a6a91f1584012565c17889891ad50de0377f6cf7d092bf60cf0926e71
    • 8f6a9a8aa0a376ae284c4af83de3a7807094d53ff2d2eafa0566031d68fe4021
    • 8f8ca16c5f58725067cfa2f2155fceedcbd8a8ee3da8f19bc14d598e17178ce7
    • 8fccf1f44d7ffa40bc205cd0a0ab91738c4527bf12127b4added79ab38c008c4
    • 9029b3bb57b3802039d33ca73297a82bf1ba65f8a2a717a9d086e0b493b4ba20
    • 918ac724949d317d5a1a1d02c77448de5953b55fd82a87711141f3971ec7c0f8
    • 91f3dae1d0cd0ff1c123027505247de5a73f4c53465e511b534bab5d0ace5825
    • 91fc90d129c45b635c194c14938a623735e8b60e2bf7268d204298522be981dd
    • 927a4459c81f0c4fa6f931c65c9d74e9c05e2a02190b3a07ea42f5b134445ee4
    • 92983959f32f91251a239427cdad6c65b86176453bc8f262e5e511a3ea772645
    • 92a564fa89a7d38cc3a64e18de6f75b46fc61bce460fbf7faa719db7782e8009
    • 92a7f213923f9eda3eac1ec071c0d67b6a4c82bbfc161c82540151645b5770f8
    • 92d4550d3cfeea8fa9a25c9e49bb7a58816c449bf8736fa7a00e3a2f6563010f
    • 933dc5b30b6e6d4902f79bd85820e948891964a338982903ca5411cf6768d802
    • 93b6bf45a829152356f6c537174a158adced80ee28d02d806fca1297f2d360c5
    • 93d5e6d638f3afd217f46256062461c532bc4e1a44b7eb1a6147e2e7867318ad
    • 94aea5ad12c430da98dc30effca4abb30c7f2c03530c36c643ca498bc2a0e672
    • 94b148d3cb14bc95729bc6eb78df4bc3938bb2eb69b818dc6848e09e2902d8f5
    • 94e221b1fc63b8c57b907b75592fd32511232b73c060453c7aac26d5ca206f61
    • 951769a7dc077449b42bb55cd08ae029eb5f99d50bcf92530d5fcf33b761567b
    • 953d303e57ed2ca90964c5c267a43bc00020873c09fba16e9b9c40daf0c10acc
    • 955e0bb09793564be9e5d7f1d9008d5931138948a3a91f38968ef9338948f2d7
    • 955ef9b862d20bb85e48866bb2e64a322f65ad287ae4e0fcd0383995105b769e
    • 9579be513cc7906b688fbc4affbf5164ed7d52c06b49be5fb204f3ea6f314615
    • 961e886c7a3115e49d08bec3af2a35dd447110bbcf1571f25ceda4687a09c1ff
    • 963f5efb4ace877f2ffa5810e8e0ccb8d6c6e56fb61ddb1f70af462b9f0c80e6
    • 96675533e81ab4cbbc99b6c92ef51267ca8af5fbcac855462ae2f80dd25fedef
    • 969a4b0b50c2c88869a31e7ec97d05c11599518ddbe48ba9aeeb6e7d619db241
    • 96be07cc2a4933a2a3fd560ccd7ba18b5018a2f3195fbe0c8133e0740e01a518
    • 977934dae9c712855e3ef21b6480ecadc533fe1165e991b88b6404abbdc43e7f
    • 97fa05cf501a45acc27b328f5bd69bb05307ae5ad2c78d877ae96e10ad593836
    • 97fe95825c1abf9ecd0ee653808cde52071cb1a7b492e4df42020cd538f3619e
    • 980387c092c7f4bd7a7cc910a08606ea0c881e09816bd27056476266c7a3539a
    • 98740e91565a9b6dc3dbbd91c0f233c69dbc7f4860a4435de9d015da50523637
    • 989c105265a082dcacbfb7bd6966769ea8affd5511953e5061a999b1ecf873c7
    • 98c260311501aa5706ee1f0c4843f0976c49c4b52d9042c4a77f27984b8b49fc
    • 98ed68c0867e3f6d3e50c1f8c77ae0251bfda32a92c5fec0d580e9c5f5bb2214
    • 9948fdd6155a6acfa842a868f9aa9f027932693e54cb0f6bd7f32d89729665a8
    • 9949fc734bf8a94220a74e3ffbf740f2218912bf35b135688674b96bcb63e23c
    • 99ac601254b4fc519a7dae9519163594bbfd6ff76abb05e8b4caf350101b7d52
    • 99c19a3f664ba03ac4a0fa590294a0a8ef629bbf3ecd3f27c91a6a54ac87bf14
    • 9acfc1dc59076fb7bdfad7c2a2750c09962f8b30a81d04ab1f3ad43674443dfc
    • 9c5cfe01e574fb30e0586f6a89994c36cf4faf112d420a1f856e463b328dc5b9
    • 9c9084c0952e4527facfd21841a29d6f1d68898b918997f090162bd024295413
    • 9c9883138c2b00650fb6a66e3f9947647013aff9987cbc53bf59452fb7b67c66
    • 9c990b24262fe45a08116575aa0076b5a5d3ea65fdba85fce73d7000f24dc7ea
    • 9ca6849e2117bf1efe4d84231b337d41c900c10799c975f59fa6f0295bf84f6b
    • 9cfb4dba5124edd2b8c8c4309e60130fa31d9a78bc2455672fbbf71dce9f380a
    • 9d30dfbcfc66632891f6033d5407141d35884f25482f525a88ee2582cb75a42b
    • 9dd4bb3d6e7025d1cb339f7662bbb93bc2488a50989c2b60cf5f3201110bc02b
    • 9e51bd00fbd4e039f2292f966e11724ca4cd033acb653261a2f08229de7742b9
    • 9e690a7048ed3099e42299c65b55b9102115f558bb6c6e606cb48a7454811e59
    • 9e7bad45cb699abf79eceddcad7b39230e8792aa9705569fdcbf13d0b2e5d478
    • 9ee1d16b40765e4310abf15f4330679d90e448a4b618ac5fc35e8229dbea7160
    • 9efdc81738f8f8269057721bdad07b62c3f1ef1541a9138df6b77a44690ab570
    • 9efdf93ce81eae71da69cbc65ad8e98d0409a44d1ac2da8a70a4745a9a31ac8b
    • 9f0f77b9fd7281aff0937961b8cc069e002e5dde3e23bda80aea507a9f38de66
    • 9f2117a874400e7312579419d7e4ac85c1f8636fcaa64f31344173d6b3b4a4d7
    • 9f686eb2bffda2afe5e5106035d5bb1d065de2351cfa89e3a97c4c1c2a954586
    • 9f8579e2fe43f9f87c55fda5084c02bde38f51f142458f82a7368f49e2d1ae6c
    • 9fb10c1dffbc8c158c77d69ef988c7de6c32a583b6990c4ec18e2fa4d4ae08d5
    • a0d4256197049822db7373bd1a22381b40ae4edff110ccca7ef440f01c385e95
    • a1eafaa48f938cde5c16c3fee344aa25f27f374d82e454ef397037c8667091a8
    • a214c8757558889af9d71a452d28d988251c9ca20fbc2046748d7e58be9ddf85
    • a2bc0d17974ab423cd51bd97f73e5324c910ec434ddb896dc81f56fafd777cfc
    • a304b690c021c1687b35ff5701016f2717fdc96576cbb707bf3f4f51f13d17c1
    • a337eb327e6f50cb83b3ab2696461936d62722f73b2f63e3e5f7a38001e97b79
    • a3ab64ebe072c2e007614f09a5ed3aaebefc5ed927afceaa324e047e034399d5
    • a3bcf5748c41b5a660006160d7f5f82bdebae33a89e67f3c947731183901b1de
    • a3f04aff82d043fa2142295d3c817440664aade2c74aa116e29a8a7d82bf4d15
    • a41beb97ab789940aa3b216114ab4f044ae48a50e533e99a957d02f2bf0f4114
    • a43f5c28e8d8580fb310afe23edfd99895f3034aba48a5e740f4ff8790505844
    • a443bdc0038b5591c94b1a4df47f26a37d04fb0cb52c09d313d5409633d6e204
    • a4773fada0b1cfdbd5d51979e5a3112a8f9642b403f3c55f6517dc4d3e7862a4
    • a52467675ba89c6c4a20cbff5df9ca821049725d829ad9a8ae4633c2a69ea61e
    • a5367194a8ef63a2c60c8a712cd6bb4535b37f8e20d25ef00466a5b81f8616bf
    • a546dfce3bca84b49c16bf678e564f8e5a4c8affb79325d9908f4bb2e0e307b0
    • a6048a6b83d233554e90def27f4e4bdc54e4ad406545a206236076784bb46775
    • a69427cb9ba043fdd8c5f7028b86baca8ee81fa65ff51d358be3d7267188bab6
    • a6c172b0695aef4b29e341059b582242d522720bf22aa47cbf464d35877b6b9d
    • a70d788bf62ae879fd4b9f3e522ef90084bf368d501a604f7a2c17daf723abe5
    • a735d36836642f558d26441f771319b5199386e48595f6011f0b9f5e1270140a
    • a761e8c412dcb7fe1e6437e5e47e082a1a1cacd7af2fc0352b1acc474a44ef21
    • a834972435a974228f5c3356bccaf87be39273691716eeb080f0cec321ccd8f5
    • a85fd1739b6d26671ffac3aa9fa3e93b5042a0c1fd4ecfce2ab1c74b9b2c21dc
    • a8c33afb2281ce473c7a13c723c65ea2356547e36d6c804a2916370783d05f48
    • a8e8943fa0b24cc1bae6e1f7a60e7b3fa320e6c32a3db22ce026583a1780d98f
    • a95264fe662a1fd879bb225a21d7f08584c28819d4da3a228286bc4b13b34b5b
    • a97a6a934621ff2dedd3ee512647868856d39c81c99251e3cd5dd784b0618483
    • a9cb2d85d8bd8253d7e107f5d102a343e5650544870ea25fcc1ca7f2f43c215c
    • a9f54e135dcc5b75f8c0208d1af567da0780a5274ecaf32bfa282c78105d0e21
    • aa07549dd3c6c5bdc6379b464b2ee47ea78fcbc63d03735648001dba59cd00b1
    • aa16491da5646bed2c485bcd714797eeeca4be1b2be55e782c69db1d72526606
    • aa1ee770f79b45d44d6d744594ba5fc7f3f192ae4ecf31cafc6733a023e6940b
    • aa67d14fe6b46c2e17832a9b1fe123182d7c55fad170bc3bce3a6c51b8da56e0
    • aabee91532ab2f8ec446f07b5c75f6c19b1e5bd35e34d331899e2b37419dae0f
    • aaf42879c8cbf1b6989cc5824b5a79be433de3bea50e2ae30e60ed93fcd7149a
    • ab56560205449697356ec1bdd2c2e540792588ced8d90d2c53f7a6bf83dd0b7c
    • abe48d04dd10dec41e301975ab3fb9742531151e57a150d53c3ed4ea93a948ed
    • acc3b6f9a9fd461254d34a8d5cb9945fc416211deb2334b37a15a0106ece9bd2
    • ad6c734b2e91494dcfcbb6fea5f5b87c8af76f05d51a3efd3fb0d192173a7597
    • ad82ce69fa20bcafc9af48985bb62fa04bf0157c55b3f3e82110e4005745ca21
    • ad8539c5123e92d4a3edbedf5f325fe5d0df88f6e9021f307fe257f1c1ddce1a
    • ae3ca32e777165dd6e98cdcb5f3a4b998531e44d001239c1830a4909ca52fb04
    • ae76b0cbfd6f8075f9f596759d17f085db6f12f148995e10e8b405a5f36feb91
    • af3b4e62982b7a672ab764cab6fdc56cc16671b2f30fac118d48ceaa775d46c7
    • af6f66fb8ddc59fb680f27c46e5ae854a06a7d28cb280f9413b6220358b81db2
    • af6fffdcfa723e8a8dc06987e3ca7e55641b563a0bf4cfef370c7b7773ba2b19
    • afe200db0c3b9eb385ff71e49198569fd7cef4e5a47cb9f85ff74c1509a1202f
    • afedef5ab16dd611ca67d26358dd05094d0db758b8695143c05948fadd78f59d
    • b0ee2a2024a8144bf86c8ad69833dcbb867125b9b9a9cb9128cd11bc3197267c
    • b17487e0f5410a4d96782079027585083243fb8ce48e805cf93d99dc87c15266
    • b186f415a1f28de83acda61243149254b914ea2e8951c3dcc8b8feedd3145000
    • b1a71e761e6245be7b478ffe0f397b716f0b39b04aa10d9093d2818380e05839
    • b1ca067d2269f61360a0822dac016a65533f1ce211dff979b0651f54f20ae4dc
    • b2095421c1b92206206d29c681d9688a2f1f38ff57cb983797064133854feb21
    • b23cc967618567f1f0e9bcbe069e7e30b4a7c24b4c72a6bb08a424ea1bbcc712
    • b2fe89840607c970185d3834190900463492f44bdd3d8fe3c26162583a0f5d9a
    • b3dcaee0e469ebc1b4800f59846cc0958c1fa02d920d351703fc52f668094152
    • b41999939d5e1afd5c51abb04236ef9e5e08c768a6ddced4f1930e34e498f516
    • b4509fae0039275c4314de087dfdcb8c83465a740e5c320c4c84156fbe7b3fb1
    • b48db0c9c3aeeb090f7a04d40ea5b6b553ec6f1cffd961c81a120e910fa10fe9
    • b5f4c6862501a15ce57573d6bd8be963806709de65850931bf3efe28a5c19cd3
    • b61806bf4988f9d86981bd92806d1bdfc3c330617687e7e2abf7e491bf2a33ce
    • b67d7746fb4a2f4bee60c5824dc6181500d28abd999a543903f11ca2d7e26492
    • b694f7a802784495c7556b87517d568137d597e7d0f64bf0ff094115e15619ba
    • b69c57f21917cdc8c7acbe7fddc073f96adbc33338935c178025a580850cf3ef
    • b6b815d069037cc10125081572e3077dcb722b5714148738703f01282952e390
    • b6c4694f6b2d0df3c1488161ae7b2e9255b743d3821d6ffcc5db4c6e6e90b746
    • b6e66f58424c706ce17ab2eb10172c6f066a0b433fb3428ec765e036d8bad2a0
    • b79d21a2c4f60a2d7e7958ae17cb526b7b7487da71ea600f400a39a2f8f76579
    • b825cbcf333a9de0d74b9c31da8668208f535523e65b4ca28b6977ac73a28c22
    • b84824fc139ed1636f4641044313cae737e712b49e61a715a691c7d531eb7c9b
    • b86ef7de26f674d3bf8ef3b4fae16aa815ad67c82693584bab5e69227c0bf0f2
    • b8ebc6e50997f01fbe109713c0d14fb054ad2aa56234cd843da14b3a912a3a03
    • b8f2f11e803bdd213d30a06bee7c9ba40a595739bc860fd6023c7463f60866d0
    • b9389d8674b88ccac5b60d8cef734e63081e95ea19080b9bccd1ebef7c79d23d
    • b943ee24f68cadee9f31d63780c6f7a098838e005f2e88175914c9c9620cbd66
    • b95d76d0ac130b6c585d53c13a53373024132294f38979a4d024d155e639f898
    • b9bd228230b5d6637156754961888b36840267ddac48da472dc358e1eb0c226c
    • ba425fbc303b10a6462ca3be34e9263b971f643a512aa76cdb49e94cb0106d15
    • ba6a6746d8b040c751b7538e9a498b3d5b970e9b194ffeaab867457624f4062c
    • ba917c07a06ee749c165df0cb43ce653edb15a382ce418993ce547e1e928deaf
    • badbc156403c6f946b1db80c41f15c3f566759aa0e6e2d04fb8d2477e2bcf56b
    • bafb2a4ddbb1693187b4c01675c24871c3aba33e1bdf151c4ed6b561d4876382
    • bb0d004baa01febc8c1b67f4dab772f244243c28291d9d5b849bd76c7a3a92de
    • bb7fecff1a93b8e55e2464f8f4fb9da5037881d200974eb27272732ab1e8d2cc
    • bb83d8476c45fd53c77f407f2e5c54b0b37258269e466a8cb14c4545df51aa6d
    • bbaf4d33eb75ce4a636e7c3faf03e7c6a3578974dc9791d92f3ca0eb7eb46ad0
    • bc1cba1f1f230c66dd6bac91d542290219f4f12fc6a292b4dcaa5bce913ec65c
    • bcba3f1a53926b20a865b12801b1a679c488d96ac7403375cc56a2a4645129f6
    • bce5af742365cc5585196edecf4b83dec5e0e2994fe5eed4f30b719460eab6b6
    • bd9e2d3d95302a3233c19c7152b1b85d68cc02fb66fd3ed3f00ba81c7225671a
    • bdded8f5d219eacd8f41e08aaffaa91132e8b173f2f5b9b5817d6e7dd09dceb3
    • be0c166df087b1ec844902a0dc67623f83687d47fdf66c71b15d5f54843963de
    • be1b244a6ce27439cae45e8084f991806fc3acbefdfcb260e3e47c0f2885947a
    • bf0017eef07a4b5f68e87df158279b3b4dc70a77df4491542215e057628d484a
    • bf30c93241793ba257ae96070199cf67e2110a72d3139c6ca56395d29a257bc1
    • bfc62576735ae943ce72fd8a85aa989f79715c972bb6e2843e1700d56c5a6bd7
    • c057d509b05259b37c94d016405bf7daa6fa4d49cfd33f5cd3d2d9dce54b8e2f
    • c09e216264e7aa6dd3ce70471a9625d97c368df0e6d61efc5cd1fa521b096472
    • c0ef9fdc0ef4d3dcff4bfb46c14ab2a8a58fc8b88b5b7b366d348a55ba43887b
    • c10cf8921878e684c4785eee25ff9faf44ec4cb28bbea5b6d28eda679fc9ece0
    • c1feecfb4a45bb378dd6144bd40e921ea9d681075c367a08bcc339310a14fedf
    • c23196fd0fb258a706bd59696cb35657165761e68d149d30cafc1077606ef7a4
    • c2474275707448042912facbb9fcb13cacca84109495234e48347b499b46705f
    • c2aa8dc6078245c553e9ae03025fc517e2ae3a2a689ca7bc50734f46df2f1383
    • c2b098e57aac51928b46c92912e3db2f344d2b5d15b4cf6e23cbf2f4c7a157ca
    • c2cb7dd51db6076e7d0aba2a9f5f2e28ac300bd6530c3f17b0c8633667afcc91
    • c318e7820d6c5f6624782aaf23ed175e87635950a356156b4953583d2543709e
    • c392f184613f0e1405d7e5a42460337b8de81fc1d5ff381d294211d46f56a478
    • c3d4d7c4dc9b3f6b3a17a386da162d629ea444fc94c45de99fda66ae95f5300c
    • c3ea5a968da1d464f9a73fbc1882a7a72a8fb60a33218a0917bdb811ab0cf420
    • c45b11927f2cd1e34e350ac882ac8beacec865e577f239e7f92629761f02df32
    • c4a9a51baa061f84d9e5240657bd3196354c62df5b072350a0dfb0943c517acf
    • c54bd4dd7efa6d8de4996de388f7ab965fab8fb91c52f654c4c813c2affa93f7
    • c66610323d72d531e72a54f842ee1fb2770dd9ff3f2a58668148d9be230fa425
    • c68a233415e6fd4f5b011f569fce2fb3d63399508d80e4dc346fb1a22beb7dd8
    • c6a910575fa1973ddc1c81f781f7e57b22a954fdacd382c4960182177456fc08
    • c6eb9618aac2a8840b57eb62970d8a59cdb1c294fb8d46f47b8913d7eea5143c
    • c6fa7cbc29bb96faa6e5fad1f42a59cd32b1e54834ee8e0ed3708b6872ab264e
    • c72cd0056695237b46252609a7131e073cf10c5424d3635878309657160d1074
    • c744fc685df5d1b4772271e541e39357d87787fdf7671aca250ab76842e90d9f
    • c8280d211b591272f4dbe8f6df793a6230893d11ab9e194e2476fb7b52e91e64
    • c887ea6e28357ce9d20082a7e618447713b4190304325c57d866d478572c49b6
    • c8ca8f3e862bc84c898618b2e63d2a0e885c519175bf4275eb508bc177b6f98e
    • c98d72bfc9a6150bd621ea940a732e6e78ce0276751c9d61effa103bedfc4fd8
    • ca45c0fb4de9003166b3da37f73a7de732dff614b89fe30182084996f6458e6a
    • ca4e3895db5b66a509f571ea885b0cc806640c55663b96a6a1b038944ea47a7b
    • cabf9d8061b65ff60a93be3191ef82418e149b56f2af17a86cb87956079f407e
    • cae231fabf08720ea59e50348d466b759012404d9684b8971cb207fb420e0aeb
    • cae40bd9277f25402475a5b9d8c9e58aae2a362e2a70a10e759db05c9d5045c0
    • cb4a075178e21acb2efa9964d6e142cf6eb86abc5ed776e41eb6e903833126ea
    • cc3c836cc9c944d0f1278547859622f9c7e8c178f839bf8fef611364bc7046db
    • cc60259d842792fa92976dd62a70537811719eea0d0e6576b2409c58997157b3
    • cc6e0becf2730e220cedec78c5762ba099cc596a58460b3a97b4d640fbd650f1
    • cc88d2a49c76f0430e6b8f873ea11a32d416aaa1935400bcd91d76983bcbcfcd
    • cd1b18c66c8568fc739b1f9a6322646352eb727082d621c38ea9fbace812eb77
    • cd5692271a2fb5b5a552b00b0bcb219e957b287b562cf04693774e87e90e7b02
    • cd8a8561d8f26b44ee55bca44a32d8e2dba22c9716ab1975c4584f728db4524e
    • cdb341365e41709eea2d729a20bcbd95c01da42531eb101b7493d887f2025cb0
    • ce12e5f06556ce3dfa789ba1b0b79b5491496a54fad002ac0e67e9d9f32f31a1
    • ce70a734a8a20607bc44e68c7caffee2861f892bea55bb6a2e82b3e59fd80e91
    • cf012dfbd565553f3e8165e620c5ed2b7c5fb159a662cf8fc704f904545b9f02
    • cf4e969d2144ef800d5106c9c0ec1bbff409a93fbd8aea9ff7cb3041732826f2
    • cf9ac2567655d9583c30c379b3d78d89e891898ceb8fb0afa3b67c99a2ae6b92
    • cffce2cdcb5ca85a8d2404f470aa4646e71ee9b6b70a2f7ea34c6c3548ce4415
    • d0d23d531173396030f5d512afafc8074d6d0cab4d781491001d545c89a14fdb
    • d1a2aa6d859a696c8801d7146a5d4a8f99593d19655e24cef938083f5421bbd6
    • d1abb9ab8ecf6631549117d388653b8c82ba1d7795b639176515eb1b0f7f4777
    • d1c5d79c1ba2dccdce5382afdcff872cd611fc35ddfc567f648dc68719ec1305
    • d30e8fa71ae566c87bd7b5d347904fa5440cde69183a86988f49648a3d0b0c44
    • d3cfa9d27aa5d747b9f96b2c2ca77712ae9e3cff924290d82b3dbef1740a3cbe
    • d3f0e9dd4451b6f426ce737d550fef02e9db91eb4003dd473fb03e7fda0bff9b
    • d441ec95dd827054a19cbffee26f6a44f4e8fcdd47c3b387ee3b2836e8e6d7d4
    • d49140acc126588cbd076b972d897ba8103662ea37c1679b65a7c928255aab94
    • d4f4e0eb7008ee12fc18a0a4d4a98c50982e416d3e72199c86e6c4edb7148215
    • d51ad65f01207e67a5f5891036da1ea23f1d235dac6bf09ebc277d81bdd26c73
    • d52108bc95299a10708ee3548c89ce1656667786574141c020b0e8639085cb51
    • d54067c58834b0fa436b290a6e14d612d70a6d32688f5b637015a39a73d34ecc
    • d55deab13dbfbe72f87f88f768de6fe073bc97cd62d5c8181567e2e708e32529
    • d59df56467ff262756de8d5ecfd21a677487c7fe09a1d2009ab0ccec97faf4bc
    • d5ef0233369d06c449111903fcb86ffe59528c88616548ccb3ccb71274a78ef0
    • d5f410f335a4dd08951932895b3360207b9a5031a1c50ceca1c65ae1d2f6996b
    • d6179b68327aac3bd33084a9b97ff6f6d8014d1312af811973e92412027c3608
    • d7049cd3e0baa9f6cca0ea6592ba850d45f10d5f5b3fd6645b0396da85a8e0d9
    • d735dc0d941109654861ba21b26ffe878b17f4d4e521333b2ece302400afe4c0
    • d7c635cd08b1dc2cba65a5c4f50f649759f19722c425246f76513f95e22ea574
    • d8025420821cc83221e33b38383ea2adbd99ae8f5d024b465caa9a8f4d33fac3
    • d863f32dfd8feda89c667142d958a3ee45b4d2071b9178111b87c6813f4f99f4
    • d874e12e8afec3ddba8c23bce16e1eb5d220f6b4a96ae620bac6fa37d34b1bdf
    • d898c8055c8f9157b7cb3e6af0017a75d35a9e3cdf769469fad1a2eb3a0ccd47
    • d966db4ccded440c828494f1860ae4e0783285ea0eedda2f362a25774073e73a
    • d99b602f5d82b98bc6d2bfcd8c1ea3b610952faf8e43aa845554180826b0fbc9
    • d9d4283e46936707ebb542ee365200592d979af82ff9c9072ea9365935e03dab
    • d9e73a14b706814c1b1ababefb330a2597f5b87385876a1ea51f494f5eb4eca1
    • da358c22b270774b21492c724f80abd4eae950516f76a75c9bbe8f9d7fd2edc5
    • da79e54b5112c0f752511dfbcdaa6069f97302fd044003120719860aa0896007
    • da8d6727064ed83e3b6745bab14494600e627a392d6e94b9c5e8d09118e6c28a
    • db480e3692a03dd848bd5591055efbe3e20a702324e34b2e7b7033a960638005
    • db8a71aec07287faf3fe55f433439cbc3e21ab9bb02181c4c3b8a50b0485463a
    • dbacf6f0d68c7ef8d17a84c945cfa2af580e0b465df87cd220cdb22839dedf32
    • dc11f9c20c73a9f0aff0e7d100fffd0c2a98a86040f44576ed4f96c5f08d8cc1
    • dc6c4db8fc86de35cc14273405cb32a9e3ee2af64d5c57066c3406705b3547cf
    • dd923c6ff1e4033b21e0ca8ffc9a1b7117cf7acbab491c21d9e60f8953b5507c
    • ddf30d7f6d791171ec8376e718f11db6491f86370a75a79ccaef804a7a9cba6c
    • de44b60ef0d16a2af4fee9ed195f7a5d800ee2109c3754a536f007040b8a0aec
    • deacaa48f0980e184d9ad23511043acfef88fabb5d6df8358790689357233697
    • dec439ec4ede863023ef7e8bb23f6f4c89d61ba77619acd92d489fe5fd790a40
    • df212de0bca68c2a86e01c96b1d5258df4c04470f6e31870695c844f08216c76
    • df7e2b7fbddb50af30de4c8234881901caf79174ec39609a90347ef926665a69
    • df7e3b26ce25a35614a4da4bfb2dc01fbf91c3ec6e1e46872dfcaa0f8064a847
    • df9b6cdc2e59236ba8bd48e5716ac5690185ae26bdac1ed7ba04b2b05e8288d7
    • dfbe1fbdce0f306140e9323765788c3f63ba9baa78fbfbbbd9ac6e79acbf514e
    • dfd807a6462156773cc3c2af511311acbe2254fd3ec31c4b24fa733a28dcd73a
    • dffe0ead21a8f039a331876bb3f08dd17557f87c01a88894dab7a50747110298
    • e0cf6ed13c9d5242404be21a098617f38ddcdc0994c63340b5230ced15d3f7fb
    • e0e3a431714ef92a77924cd2185409eedd081de4195cd908730406879f89c5a3
    • e0ecce64ed4f3a185110ccaa1c5a07a23fc6ac14f5988314e8e54124ea4f8716
    • e15233aff95632a96c4e05fa4578650c895fbfb34c66cdba133b0009a9c7b57d
    • e18584512d4b22ad3d52dbf70b8b54e4bc8974b6231547a5b696c01c37846adf
    • e3477458dea1c1bed50948a35bcc2463bce244fcfe4fd7105d84e15c7ffa140c
    • e3493cfa0da4aa829e5796a6276483322faf75c78b958db7fb8401c5d0c43e49
    • e35c8a6d770e873fe1bc098831c2eb4021a7fbb659644b74f05a4d82ff0005fe
    • e3dcb8eefff82e155a5a9eb764a64e93500398a6c51959d05aff22a09d3f6535
    • e4247f18cf0340a18d32a8e03e1da8e31d8c4cf889186a4efc42656d29c340ba
    • e4eed01e94afb0aea8e737a8f6acfd629c093b1bdcec3c593f4ead7906e5fc28
    • e4ff23f95d5076ebdb0aab27ccffa708e2d010c5201c0bebb6fd301f89f069b3
    • e63456160049eb6b9271d80fed5f19161ce4381f809be913b7406508be734ed0
    • e661ca5fb7f901fe1f32232034fee4f2a7f9de85e525659c886d3545f8e6fae9
    • e66eee8be95e1fa21acf62aed0651458683a45c6f547b9ecb0b4cdc4042ae23b
    • e689ec23b2c00c9d685f76ad755534fd9c75faaefe5e68475cc07ee1fb1e2531
    • e6c6c64d71481c9cabb1378897a003e2c2c5a31d02c9a7c38f0b7e23f03b4ead
    • e6c7b8a5996423d89b655b8f567031e252bf187a949f80425f6d01df2d060998
    • e6d0e6b1aefcb72d57aa20630e664e58e803c253048d27cf74d102e90a80fd8f
    • e6e402f06e2847fc590fdcf2e51e05b222909eba5b20a6533d7c16a74bbde0f3
    • e78ad2aa3a00a0f177f883e1084c13a43a2d429cb6f57604e12e1cdb18b3d274
    • e7d57b51b591b7583e6b90de7ee2dd72736e9664510964ded211a397b683b7ff
    • e877c7fe7672b8d76fd9d1f1b61e0c19ba659c5b1efc06127d408b1af7155262
    • e9bf42de4ac978044ea795f20311d328fdbaabf6ad0f7403a204e3d263e6fab3
    • e9d2693dfa74dfa8b6189d50674b741b5576d0d0625dea8480b94931bd3a86ef
    • e9d99d5e4e122b49e1fdd73f53131a914e42e805acba02946b7248d317f330be
    • ea07405a1224ef44ad001c8c3cac62a7c2e4899f867ace03067988a8e002e4aa
    • eb4aeae5bbef8efcaa09e94dbfbb55e229443cfeff29ac747a28bd1a5a9893bd
    • eb4dd14db26ac3a8995b7a88e2a36345f8c575de9865da96bf20c6bd7bbcba62
    • ebff97b324920e745a8365048a26309c2e269238ad7d7f3654b749f09fe01202
    • ec5e5ef8e1c3999a33f47ffd7ab48e59741457df75de715f02e8dfecf5c589be
    • ed059c0acc8101f1bca935729e73f312d8c29939d8b9d952b24e5f0499a88c14
    • ed08d879eae399d1fdf667b9625bd27eff93e88095e3fff0bab130d814362487
    • ed27fe1b0a885e3349e8776999e1ef939166dafb1f21d2e2510be60e46b89bd5
    • eda05ce64cc8af1946965a8b0a8c321200de610e84b889dd04534b3900f1a0e9
    • eda80d729d8ef0df283268aa2714a6a6c8b5b2294abdce0c3a9b49897654c2d3
    • edf5574e6660e5fa50f8b154ac6f2a9211f3a7336d227df0940d04ea463616f4
    • ee028afc356d78071f8d02c9d09247aa0fd3d3ef830322da26ebc7f9b8557b99
    • ee3745a11e4c9d3ce0729b10668d43028899d5080e1a9b93664b36515d69a695
    • ee46f1f5989dda64c2f3779ed4c4c0b36bfa52c2ad2be887fc333ad4ef59967d
    • ee9e6a1a0c2e0502d3581e05f10d9f8421930e59b3f62ed75a6c5f486babf355
    • efc98810fe9c9d85fd68347d6256eb9951c108609e678d86af26ebcee751b762
    • efe0840adffe8243c9560e4519add79182c804d09582bdc868a3d4be0b8b693f
    • f050cbcc0334d0a8769fe7e3819d3f3776e10be3074f596c497f3bc852a4cf57
    • f09b5bc79b13fdd97b898e708a2f11a3571e119c47b6a5c426d614fe10fe431d
    • f0d4caa6359a5807d0e13d3488718991b5cc3c63ff35587105a2af8d9a2a3099
    • f177bebacf8316e7faf5d9babeacef10b928854b88b8e92ae088165e4989f463
    • f191a95872812d12798a1366208ec27f065633250954dc5396883b7307153df7
    • f250f61392d670b51b337d8bf10bdbf84341b33ac50aeea8ec045bf28c9398bc
    • f2fdd0c8710aa1d0041ce0a8c73121776fca535695bcb5e494d7f6b1166d0aef
    • f3211d9a8bc8a8e4f7235690ed64a1139610f843bf4082c9bf02b72b10c34be0
    • f4005629e2501fd9cbe96e3820d7f24b628fbdcd89837ab79b04efc732ac734f
    • f4027f0496586535e6fb21667ec629d1e4d5f7c0f264ed8d076e4742c006c213
    • f434147c90c7a80eb72f9e16ffff431bfa71e22fa228e2248c216f51f584bfe6
    • f43cb4d825c121a44a1f6d50d173c1ac427e728392c4250ff03920bfa55cbb7f
    • f45b1bc6a5bb085c8352bc9895e45c327c6ba5434f1c0852b469ee1cbbbbe7c1
    • f4da205e04954a6309e99bdff72e4eb898b029de2e8d7a811252f51f3d9d3abe
    • f52193384b9ad1c0e34fc7d2d17a054c54fdf43cc1e6788acfe56eee89b6cbd2
    • f5405bd2f3bb2492b0c1c101bbba9f7973608de0a4c3258639635cdca1e3104d
    • f55e85d7d61298a71fc9336f4f5c41fa9a571f5c82d0b06ee4c50203716f11c8
    • f5b7e9661e8cd070b2c5a916f7c6fafb50f3dd137925c63c6f171c22ad623c4d
    • f64c1f6dc8e2e06b91f6df9501a7765a0fb78625745c4b096f6f1ad0f7395259
    • f683787be8be80e162ee032ed09895c8ba8e05d494a102a133c20235db07ae2f
    • f6c52eb220d6120ac89acff62afe9fc3e92ae591f6555825558099781770c81c
    • f6d677afc657d4ba99d5679ea6feb20e415074f2080b38889a817b705e650c90
    • f6e68450e1d582789ade0543a4db69ab0c6c628b739da50e7ee287ce1049a4bd
    • f73d781b3b4603066fab191aa7f7ca270617438cc978f468408f679dd3fb578c
    • f7ab00c514798422b29619e120fb1bfb36b41c1124df615428ce219580d6e081
    • f7b20c48737764682a98961d25adc0bb38665a22d01b72d3c97e507d1655db4d
    • f7e5e5a633bae7d5d911ee4adcbf21f240c74753212249fb2d1dd6a58a3d0eee
    • f80a19c32f6db96e929a3032ec49f7658b5e9be38f620d843f0fbc7178de89d4
    • f82923453f2f4a4f8b09700690856d8938e09248f570466dc0f2727d893c4eb3
    • f89220bc7b9ee9978f93ad21d832931a92782d52d08caa2677b35b80444146be
    • f8ee888422195248d11f6b402a7a5c364332d53b048194b43d7892208e3e8d51
    • f9578885cd83478a5717e00661ebc1efd9a02aa0352f94b7abcde8085a35d8c1
    • f96c021f1aab6e45be7a40a579dc0b96daf24a3b620eee7ce5765db5f91792de
    • f9cdce512240b2463f651c63f6d9aeac64f3868f72e7db245495bf95f0d4db45
    • fa130561588ea06f030a96e13904e4eca953a0b8022192d21e6d7648cb23311d
    • fa2fdf8e979ad0dc1651df84c83115559996a128a84189967920c234c43b2e72
    • fa54de4e0402c731acb59d7e4736506996ea796cc5d5962c8a8e53edb2c94fe6
    • fa756495db35919195a0309ee16eb4c48366d9d978a8a10c15520e071dd7346a
    • fa7644fe164a6ba8bf790f777a8e8f5fa5e8b2fcbad609464046c165f6ea9431
    • faa3f689c0ef1a2cacf3de44fff41169185a17975325799fbb5277efce8cc489
    • fadb56b1a7a8227c87e901ae0df5cde986ded44ed57eb8a2ff6c279a7f4266aa
    • fb5639ca63891c1105a04fcfe2bb8ba22f6b00f9a36f598f0511ecfa29043fe3
    • fb90705b8acf4a971f7c0ba8b3002a5feb9fde30938dd1d4d7bb80b4d1788aad
    • fbaf93724dc43be327375ef6d8e1e103d92ae5947c8f703e863f6c5ec26b537d
    • fbb85fbb73341de35222188ff1b9bbde65a449d949d7ab08762d8c96f24705d5
    • fc0b9db42ea016d4c3584ffd7c37a7770d84e245a6df04ddfd0c4b427a53ab2c
    • fc813d4aea405bfb04dd63d5b293e89ab8b82c383356636afa7082163b415aa3
    • fca64122fc7a6aea1d5a3efae2efb2d835ff9c74d8835bfccd5872151a0884d7
    • fca862629cf8de75af6f12b6f310fcd3c4374d33a03d721624d6d81f5acab78e
    • fcd37e52ac2dfeb81bd48f2315b3534e55b841ddeb637c427089352062fccd7d
    • fcf14a2ea95df7da4ccc1ffb8b772420aa5ed32dfaeac6374fbf912f3dab132b
    • fd57fc3bad943feadd329c2f76122c016b3c30fbf667666e2ec353b2543d21db
    • fd58dbb94352fb2dafe3787ef9ed3e51f392f58c2c32174e11bac50c79b20f66
    • fd838b78662e3d8cb9ddf4cf0aa90e845bbae0df1295f7970812a2069e6da576
    • fdd222b851c321c352cd4605c9dfae27a0dfd08d7c277bdfd0eb62f9b68ca753
    • fdd4f7055c3c36b9e75a62226f1ecdc4691716824de52bcc78d5deaf36e425a9
    • fdf06c52595850a1d9f28174d4a6b44f15691d07d75bb21762a522f4e7f32588
    • fdf7515be7eaee4d5e0acc0056a7c2e7c188e439ecaf927187fb273e5b29c0fa
    • fe525ce0c7407a0f7aa4d38a254b6d2847712f378428e67822f891320bc0f26c
    • fe62c7fce95f3e201fbb6f4a5418f83dd40dfcd53e7eed4d113f81e423ca42e0
    • fea89256929a506e3c5871f7650fda2a1f48c40cb95db5c5f8e89b9ccc93b1c2
    • febf7d0e1d8731dd8a038b05c4ad355d7997462c8be58fc1a67e781c2cc5eed1
    • fec51b64af3152e3ea86d4cda079f34e6e14db63111a502b1f5c889890e8687a
    • feecd42876e585bfb8aaa6f42193c62f75f1c84c68742a80e02201437eb73914
    • ff1e75d94744329db4a8062dfa6358cc2e37f3b2b3897014dea7966d34d5d806
    • ff226f9ede14ca25f33bfc605b02d638ec699a2334d021307834e8e4bb60741b
    • ff6dadaa3e2eeddbd671b3bf5af8105760677be2b23bce4c6a4297be394bc066
    • ffa3ac18536cf1e25a3ccca37ac23adbec0dcc60c95485712d950cfdc7a305d2
    • ffba43ee9edf3835d9f8e7dc17fe5c9208c6d3317f8792f5488ff016f1793eb7
    • ffe8b1ee9ba373ab220d2cdafc1d69a6842d4fe293dcd58a36a20932c3a3f7ac
    • ffea18ea89786e896e359db865509c32f5970bf876c287779067a65cdca4d28d
    • ffff3bed1f72de5fc3b9e42dc4c283e9b87b649e2670ae3c67bad9187d485ec3

References

[1] https://www.bromium.com/dridex-threat-analysis-july-2019-variant/

[2]https://www.virustotal.com/gui/file/9cfcdb31b677f860b277ffb52425a27efdb9544bc37982d6f54f038b94433ec1/detection

[3]https://analyze.intezer.com/#/analyses/b59ac459-bbed-4a5e-a988-9dbad1086d15/sub/5d08a8f9-3a80-4756-8944-d4918facfecc

[4]https://www.sentinelone.com/wp-content/uploads/2019/11/2-image-of-Dridex-1536×864.jpg

[5]https://www.sslshopper.com/ssl-checker.html#hostname=https://91.83.93.104:3389

[6]https://www.lifars.com/2019/11/the-emergence-of-dridex/

[7]https://www.lifars.com/2019/11/from-dridex-to-bitpaymer-ransomware-to-doppelpaymerthe-evolution/

[8]https://github.com/EmpireProject/Empire/blob/master/lib/listeners/http_com.py

[9]https://i.blackhat.com/us-18/Thu-August-9/us-18-Bulazel-Windows-Offender-Reverse-Engineering-Windows-Defenders-Antivirus-Emulator.pdf

[10]https://app.any.run/tasks/11c901a1-5b4e-4756-b6b6-413be49c39de/

[11]https://app.any.run/tasks/773d8847-9e49-4e3a-a258-d07539bf8edd/

[12]https://app.any.run/tasks/f4112211-0e3a-439d-8982-1d3488a069e9/

[13]https://app.any.run/tasks/64cf60ea-7fe6-4efd-9895-8f1813482cad

[14] https://app.any.run/tasks/14b9276c-e878-4996-af67-dd99e284db8f