ZeroAccess (alias MaxPlus, Sirefef) - Page 40

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19066 by EP_X0FF
Wed Apr 24, 2013 5:36 am

Fresh Sirefef plugins.

all built 23/04/2013

Group aid_1 , x64 botnet

00000008
80000032
80000064

SHA256: ef8766efc0ddc7a56a71dbcc65200537988163512c70f9ce8cd44398943de5ad
SHA1: b13bd8868b583578c5146afb237dc55b85512158
MD5: 0c3d0bf1eba67f7bc674698e5f5063d2

https://www.virustotal.com/en/file/ef87 ... /analysis/

SHA256: dbdaea813662144d3d37323ddab9c9dc63501fb09e9da3c70325be5ca816c92b
SHA1: 48c3e4403b2099d7ce9bbb89ff0f0ccbf77981f4
MD5: ec42457ade8c59c6479b44f8a6636f6f

https://www.virustotal.com/en/file/dbda ... /analysis/

SHA256: 740cb7e8b404081db03b500fda84b8baf94d2cfd5294638287aec848065ac1d5
SHA1: a065922e48e274f827bc8a04091a44632d498373
MD5: 2350278451ed723fde51380fcbece2e2

https://www.virustotal.com/en/file/740c ... /analysis/

Group aid_1, x86 botnet

all built 23/04/2013

00000008
80000032

SHA256: 05682aae61f3489f7320f384bb58915be85b42d30db4f4ed0a8d659cf2df1e29
SHA1: 0175c1ee2d3e3210cfbfdd52f2c65febb547515e
MD5: 36616e8f309b35f8e090068690272239

https://www.virustotal.com/en/file/0568 ... /analysis/

SHA256: 0a4ff7b562e94f1aae912473c65e23551f26025bba80b065bfd51d908f2f0b42
SHA1: 2587b2a16644839cbf08f2943fa21cc0c8dd6e5d
MD5: 8d8ae5a1c57c3b441fabdb83586c7d0e

https://www.virustotal.com/en/file/0a4f ... /analysis/

Attachments

sirefef_aid_1_x86.rar

pass: infected
(45.04 KiB) Downloaded 86 times

sirefef_aid_1_x64.rar

pass: infected
(82.3 KiB) Downloaded 86 times

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19177 by p4r4n0id
Fri May 03, 2013 1:45 pm

New fresh sample.

http://blog.avast.com/2013/05/03/regent ... f-malware/

MD5: 29A35124ABEAD63CD8DB2BBB469CBC7A
SHA-1: 230CDFD0586A46386BE2C384889B8B67663B5B2A

p4r4n0id

Attachments

regents-of-louisiana-sirefef.zip

pwd: infected
(154.06 KiB) Downloaded 103 times

Keep Low. Move Fast. Kill First. Die Last. One Shot. One Kill. No Luck. Pure Skill.
http://p4r4n0id.com/

Username

p4r4n0id

Posts

126

Joined

Thu Sep 22, 2011 11:36 am

Location

Israel

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19178 by EP_X0FF
Fri May 03, 2013 2:24 pm

This dropper is equal to http://www.kernelmode.info/forum/viewto ... 006#p19006, just recrypted.

Payloads

https://www.virustotal.com/en/file/e98b ... /analysis/
https://www.virustotal.com/en/file/9a9d ... /analysis/
https://www.virustotal.com/en/file/2100 ... /analysis/

Click fraud tracker IP's:

194.165.17.3 and 91.242.217.247

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19219 by username_sp
Wed May 08, 2013 10:25 am

Just found out there:

https://www.virustotal.com/es/file/88ee ... 368006115/

From: hxxp://dpskamilzabrze.pl/tmp/sm.exe

Username

username_sp

Posts

1

Joined

Mon Jan 28, 2013 11:05 am

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19224 by EP_X0FF
Wed May 08, 2013 1:47 pm

username_sp wrote:Just found out there:

https://www.virustotal.com/es/file/88ee ... 368006115/

From: hxxp://dpskamilzabrze.pl/tmp/sm.exe

This is Sirefef with services.exe patching feature, equal to http://www.kernelmode.info/forum/viewto ... 553#p18553

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19281 by EP_X0FF
Wed May 15, 2013 4:08 pm

SHA1

Code: Select all

0054dbf9ff5d8a4c24739611e77639c8022dc4af
00645e7fce65fc185bc57da6ecd0f75c92c073b8
009a9a5be8a78a98a9f8e4662d50276cdf6515b0
00f2c71c87ad3b2f0f4dc84faec2c3d53dffaec5
010547bae65c414cff855269e1b6c36320ca9e41
0168f584d9513893219ca36c725d1690e4418574
01abc3715173128b28d559d556681addeb06724c
02265a24c0cef4cd4f4203ac272df6501029ebd5
024b78de81611f76fdc2037feb58fc46a1ad3913
02a62d670ef72176ae7742aa13ad9e6cc933e8c6
02bb7678df2988a053c30fe1dcf5381ff919aab5
02e6e5aef557cd60929cd491c1f779acb223b5f3
034819f0d65c4f43ed8f66358b5075f9c66c2442
03702aa1e05b994bd5c373d4269edbc2017a1571
042a0ab625121dfde2477c07a794a2bf06f6af6c
04c77e59530f3a07da8d1cef562cd662a8791065
04e4985811443f5b02763025cb5adf2b4fc64d2c
05b89afab423ed45d8f8d620dd487cc41e8eb722
05bbbc7accdb45f3317057b66876d067ab18c034
05bf5f89db8a6c875aff5780aa66f2aa48d481b2
061491edcceb44c945f9c848a94723967b1adfe9
0649f48ca2bd8e61e24134f8006eabd17afab742
06bf2cd479f93ea0e8dcb658b9b4ee2a2fe1affd
078150303b1ae24d2e0a0ffb1c36419f5f34f850
07836dafbcd51b1d6d758093478bc381a8522299
07ae4c7c12edd74b04429f4d18d7467dc69fcd64
0866cf390d0cb79314d3a728cde80ce9472e995e
087ccb4cadb9ad76e91a53bfec75e6a63b934c80
08b079b12e2284d6dd41637982ac07f09fd1046e
08d80eaeef234b360156ab96c213012d4c235436
09bd52dd2fe9735a7f619117707c76cd4909a60d
0a01eb4808c49d074ae1ab5aa855c09b75548023
0aad35024a825825765b51449992ebcac736c28a
0b45a7bdc9009225285bc809cc27df16988d08c3
0be164446834405b0b7f96ea54d4ad317fa6489a
0c4f33fbe8508dcdc9627468b294b9d6e8842b7b
0c6447d293d7dda116d1ea57156b50b3065f6716
0cd093d4eb23b26289030bbe7c83f7f0a97054e6
0ce421a8e64d8243fdd770fc6674e1559f430882
0cf58f3e6d0ba79c5fd1c83da1f503bae5da56a9
0d373dbe3b4b1c79a9859c042f46da3e0eb107f4
0d3d88f31481e481fb54086911b3f30258ae16cb
0e08288e24798928018dcdd97f0392592984a906
0e63d17033c0a3eba45ea4cc0c8c56eb408b7321
0e772810aa0e8063786f5f8e1d38ed91d6269254
0e867c012bae45c73d19683904dd78d2493532ab
0ede6bc36fe57642a7fd71e65ca02209cf8d2693
0f65017e13f4c1a63f148e31dea697d53d3c5e3e
0f6d8cdc36333db05d9e06f34d32f19b8b1826f4
104f5a88ed197c5cd32560361d3d688c3a983164
11311e73885f36885785f69354dcb87593fb30e2
11ac46766daacd18c2a0e79c827a89cfb090450a
11e4ac833f0344ff79297b3e756f961151f18242
11e7bf1164d32810dad9e243f6086d8bf88abe68
1244b16279e94521324df05cfab85b0e5fa21e3c
125f05b2d90389cf424ca40a70153e0489cda832
1293de5e96db9b8c8f58dfe10a1d1e4a03a7d9c7
129a502842f85c3a4e6b24aa95f7762937dd64be
1301cd518f9f64fb6f091882f135a4e7e0fe58f6
1332dfcaec98cc1e3a17dedb8faa1135a64e8ec6
135625c7dc491f87f638ae4afd986221a0c3e9c3
137410fb7c11898ad9b178fd5293bf6689912e79
1447d2bb784362bbf8de1a7acbb893469a977609
1454987fba7d9a7a64084917f1833d6b4af35852
1495956e03f1a7a45601d1085584e66258c571bf
14b5d56334819f6e60eafba7a70cfea606488163
14cecce00c3b47b46328481e72d107998c44304d
15018fe1bd08144a481c40626f8b3aa76760efb9
150f286056206df79e415ef2822f2c9dece07538
1511bc46695f0732e3218f058b5a406600d48813
16041d7a4b044c036c6aa03aa73bb9867d85fe8b
168e70bb3dee93e942fe82d7800f377cde48f515
16d6d3ef9be22e5548bcb64753e7980d3197da3d
177be3d806bff3628880817dfa091a005cf56d98
17a8c8abdbfc25ef5ef1b5f5c6ec05437229cf00
182d188050b7338795c3ab795af53c5815abbf9c
18e538db2a85f3fbaa18d7b4380bea58f2eaef62
18f45976e530074e4039ceb756dec931e4a298bb
1934dacb9c854bf293e1fa01bc49982579d96a2d
194364518c8c43a9887899335f5f09da960e9d1d
19d4b4a3e2780825083efdf1bee2d16c48f2ad2d
1af704782be90f50c7abaaa6a88a598cd30d85a9
1b7144b315f7292c38f1f4078b9fe661021a5fa2
1b7f133b0936324dd1d2cd601dccc07979edf85c
1b8d86c2a8919e88f1b4abd5f7441e292892c078
1bf4462ceebe56bdde3e7b86ce6e06db13e8c7e8
1bf788a25c208683d50204f281f3f4381ae43c7d
1c092e0bf2b796a980fe62b1248fa466a826b4cd
1c1a93097985b001a3cc309abb2524aef4dff3d8
1c62f826bc523156b80e510b5252c90bbc65dfa0
1dc6f0d661bdb0a928d1fff1dafc0b55132f18c9
1de9c4b202735f7359d43bd72e79c15c0b2afda3
1edceac4ae8eb866c2101674e0f9ace7083f2fac
1edd901229b164a3bb594517e8ffadc688d50283
1ee37a7ddf8ad5854a26699c24ce6bb9d586c818
1efa96b1578640717ed231ef2ccf89dc6514aabc
1f047403f060f37eb0614ba439538a105bb80a0c
1f098561246d8f8774ed33db2cc3b95cdf5814ef
1f0fc135c89d5859ce0ad6be6bebcda35a5d1426
1f375e1d4a6781a80ed5b8eb2b1ec80f9d5f2d61
1fe42bffb23625fdb970acfa387861ca7da1c830
2075ae2afaace49f15b99e136c83316dddb38633
209ecf94a0faab3c9f6c8315acb3e1d7b665c526
2112241d6162431a542afcbfcf3820cd36d53896
211e29097bbb5fc64b90cb2ffca5be61e514d129
2127470f615a9f32ccbbb944c4647f2e86248cf6
21b0f85162d32e8c75cf78de8642212949bf74eb
21d0c24cc7a1d52b01be23b6b12d6e5da115c5c2
220ff15cb74535df4c31828073dcff5bf3302b45
221e20b45cc9735dae52ea4251d7e85771423985
22c42a2841521c40a7ec3496f37de2c6de4cbe97
232efbf2e13866fbeaf702d39845ad837dd9994a
23a8e193b4584e9832e69d8a1f6c9c1c62116fa6
23f536d5d5fcf91588aa698614663d93d92d41e7
2436b0d63cdad2efaab223251341c8facb3db280
25548ad65dd4c1d6c15522558076fcad383fb8b1
257aec95ffc6bfb67a6360f8bea39e71761fb62c
25d0ed32a84fef6538cf93474b6f96f02144e41b
26006589c57ec268df10ae8a640f3d9dca97d4bc
260952bf94511b9e12f97678fe87a84ee8dc668a
260a09994966e2770a92e64b160b812057add315
26a31245b0fcb0913bd63fa469920c49332df08d
2713f593036c2591ee42d96989e59eda8b804663
271bf8a970433737adf4153d6af643614b010dc4
2723a439e7b77b0121ac4df532059dcd6d34740a
27ee6ff5929dd16ab42e02abb8b67a5a47e23d0f
2808859eae3ac23c8d80af57fc3d035cc1979df9
281dbd4ef63acf1efd5be8740f11f9b5184ab0df
2917f7a167129e38c67c2542a5e25ec8c5bad60c
2949bb99e0e023f1b7a2297d2b34a68ec96df64b
29619838a9813a464774c0cbe8e75ab74c387ab2
29b3d5d7c250d720f37303093649ffc4d4b977f9
2a2d9a882246e47892793498b115ae3659578045
2a6b1583a2b92ebc727232c0cac5bd436484d2da
2ac153a1acde79ede78559767b4753f3b8663e3e
2b19a85df769026a6617c716d3cb6b04fb722218
2b283954611b6c460d95824c2c765421ee373523
2b5603594fe80deb95e9806ecd03aadc19bfe09f
2b9b5fc097b3e6f011f84ae8cedee087de0ba90f
2c16280e308ef41979ddbc071ef6d9138e0426a5
2c1e793be69f19f873c635455e80aa4225833a55
2e4d534ef9929fa1911455e0b408c6495007ad78
2e69b9cdb2aef5440aede2b4fdb127d6605da05f
2eec22a8d80cb59b05a3a6b95cc5d53e14e3f26b
2f142c83b1d265e0069dbbe48ca0db1f2970babc
2f6e4e80953972752e6fa803ee65e3d98219ed53
303cfe74d0f9cc3ed96426c695df08d4f19cb4c8
304f9a9e4274ae7f77a71ab6fd58064675152a8d
30516c5e96c01d3ed0a153415ff1de1c51dd126d
307a930f46ac2a23f9622787659c05412ff19fcc
30bb22bb20c579010b874817ec34e18390479b45
30bb416dfa79a067ad3321dd25c67435fb9ca6fd
30e5cf032ef630ea57ff4cde199733bd5cf5970b
312da8ce99d103c4c3821d937b204bcab6642daa
314d7f975875e3c1df2967c7e072339816710d13
320692a6edf0f337aa38f111af7f2220ffe7cd2f
325f40105e60e02ed0374df33ac1f43dfcdd280e
327235d15e4e514d92d3fb31e6b34c2d897f15fc
3297705bff58dcd9fdaa557c011407a07a9e743f
32d18b02377f91ea6367510e7a33fd6772fbef54
330ddbfb9e6a63ddf8ab4de3e0767f55b1481431
3347c3c0d7ba50f0276f1283e5a3835969dbbba7
3365e1ad36b1a0db060143ad33473d57163b6f17
339ed191528a114cbbaba58c49df8d0c3e193291
33b136ba3edfd4447e04b4964f7bcb96e0f4f908
3476779202475257773159ca538501e5d13461ea
347c2113a05afdc0b95472b3eade3dc7f4e3102d
35273637bccc4dc8aedea036f0d18ace7c6728c7
354412fff49efb77af547b3a2cd17553a1cebea0
35b20e1edf074ea4b10dc31098a7409d3dd4c5ad
35ed5c0fa89e871ac694507164e5e93bbe0ecee5
35f4f1c955903685bdef00939d84851d7517d561
366a22acf3fd12d498651384db5792177f812c76
3689f2f127e8990367f59439f8106e8ce9f0db2c
36c60f7470c27d3e075fd5939eb0f73de40dec6d
36d5b5555e75f4b8e0ac0ad5db5b919bce318cc0
372867a64f7fbd05fcb9c8edf440408943089282
37720b4222033dd7473a1951e04f420a4f9f4969
37d357997db44695ede8d343d09b785c44bd9b0b
38172942b910ae8a3061d0f8b0774ffe7056ea87
3877d28142fe914450a2ad4f2ab5db16c15933bb
38887ba5e19bdc069ba04b205211ed99b034f086
389785fa137c552ee30c1169b5193468acc8ace3
38b8f09e0e3eb2d0b8addc98d9e372efe991147b
3917c372d71bf7fbfb4f6858e865c2ad6c362c40
392a0dd2813d27361232b984c0e9897719bf7c20
392ea4d3fb2b0f7ac9e8594a2f228a81ef60036b
3962a5e463e03c5f3f9028cde102065dabe55f45
39b0a39304fbbfd231f7786d30c5dfa2b54e2c36
39fbc06463eb4a3c5f4ec484da4a87ce668023ee
3a063394f63e5c5b14e4417c62c183492c9439ec
3a136c48e4ef3a8eea6e105f165bd7e95f00944e
3ae287e0db456f265787901d6da596dc5704d30b
3b4049318216dab3d90635f72a0fba9572d10a72
3b852fa66303aa853f5d878092f08d3b3d90f59e
3bc0845b7cb3d49bacbb29df374e3eb065a466e3
3bf50a6f1f4d77b6e040e428227df6cf9e00c8fd
3cb6e7b7c111b28928177504b0dafbda047e4a92
3cce6620f05556fbd8446313e4bc93dedf84ba9e
3cf95eee623fcecde1713df3e8b01ee1dcbe8c7e
3db593f24b655838c05d9348cd373491d3dc9e7b
3df80815e9b2b5c9fd962e5d903c267ba98abde5
3e016be793dda83d333d696c5e805b6441284065
3e9f8e7a18d6549a233f3c9256cc8dca8b38cf42
3f1b56c4de86ec7d4dbb8513106d60772521f150
3f2266766a9a8a2f776ea4bca1e2f6ebc2a24002
3f644f9b0aedd04b74e746ecbd5ea0977a91b903
3f79aa9ef6c2aedfb6b5f30361c1ce6a095e8f0f
4094edff7ba88ba7c3e864aaf5ca17611940718a
40c5c9c4b23a9f123d5d1d012bad0e46a388b311
40d31ac88a3f9872ba7e7c189889b5a8496d29da
41ab0ab7115e97297ba89de4bdbab027b9484321
41ab207e490723583e71eae0bcce7987ff33d035
430d260baa2e10d2df3f9a7871a5a015bfd105c5
43be3f49b4e443634572458b2361611e50e523e8
443cf16d4a92efe87ff05f96ba1b3ea59cbdade8
44731fa142d3974a8101f1d1852db41c30b80f53
44876008a4f89e1c9bf733b503e9423ca010c845
449ba7977ad387369428324e15c5410a8d0f9483
449de7bb4751e88ff9057db8e928eb783039c34f
45387843684bffa3028560e125ea17d024daf4d6
4545316a7552fd56dd14f2af94e55aefbe63b782
45a14e4482ed5753cf273f035c02c5d0b64fc6fd
45db763508361781e3d7ca0e926bb1475d2c6a95
45eccc571bafae1c8df07879b67d15c426e9ad85
460245f15a3e1841bd5b56f160fe317054aeaa48
46a07772a484e32c4c1db2b541db001db74ae40d
46a1163b213b33d75cd6396c6365d39d416eb181
46eeeb42cc03ff24f78a323b527cd42c1b19683d
47362e4908f720a1a3f9ab4544470c97f3a61559
487e764c5a623dc8dda643d7691a81d8924d8e2d
48a4804b435dd0bd3befe2bfadb7d2587a35b3ec
48aab5308227764f154d23d0d63d0f8dce6990fe
48ac8ccc5d3070e310c2e564be3ef9c607e7e88b
491a02075add7a18507046c6231b25261ac96418
497b1cf97bdc9bb9b9aa005e79bec91422be8c13
4a1820511c71fed649d61344ae2bd1d387736384
4a2f61cdb78bedffcf3e476fbad9384e485af7fe
4a428a1c86e8988171c536200b40318d8f7f316e
4a96e05717709c4b47ca7fee2415e14a1bf8978b
4adbab651f88c00b98bc0310fc65fd6d4c950aec
4b7faad1860921c4be7881098a00b89fdf7a1c53
4b842dd449934ef03831567fc2467b0eac977968
4c307d3fb15335df1b209a4830a13e2ed80b0b4f
4c42f86f387a69c5d0ffcbbf3f6ff3b28d7e1a33
4cd2480e2fb19207aefc5cfcd34bad813b969bad
4ce9e116d2b25b4a591d1cafa777d73e9e953b6b
4d022022f2c1b6577621396fc5c46d1d657edc2a
4d6f9f1d1df5ae8bc2487340a36e830bf09823e3
4dc18c807dbdc85011e388d000b88a90560b7657
4dd00924f338235639efa39cfc730e2e2357029e
4de75edf749a4c5da1c9b4e231a7b9581114c146
4e63d9d5fc78a118dd37c4f972ef580bcee05e67
4e6ef90dd93891c04750bf5ffcb6ec114ed5db36
4e88d0deb2cce9e7ab8a73fe5a01d497d216dfd3
4e8df1601df7ba0d4c77a0324b074fb8c2d3e553
4f00173b72538cbe7637062927247e32a71712ad
4f189967bf959c74db181c1f12c162efbb0bad1e
4f64501864be73f8ea1a8b5208e5b3c35a474e45
4fb211deede543002f8138aa3ba61d1b7b28bd76
4fbcfac117a9416217b77eb7a235dfd543539ad8
4fc55bb4d52196c43dda1445a0930612230acea8
507cad67f61722595c25f663e056346879dbd3ca
50babec9fd4b861efe9a91a2338b2ea6703e770c
50e9423f66d7de0b0a5c22c60b4e165cdd6d84c6
517e62cfe6eac31cccaed1bda2099365290b8f60
519ecff33bbd813bef9e3391c2c25aedb3bc61ed
51cc1b33696f6cf7f78499eb56c914718e08aa13
524fd90181412a9ce4d167e473da72e4bbf0ead0
530fe21d53deeb529136bef8b97a7b5c00626478
537014318e3232c06acd89f3ab2032c9c7077b10
542eb771b2fab289fe2bfffe465da3e05b1c7535
54347df84bc3a99febcf33176ee76406214bf0ab
54473fa6152c29293d2e6479535b61d9e92e9db5
548a7f1b97c6a877f7994444fcc656256304dcc9
54bb8b546b26266f9073f107755e87819883babc
54c58f392dad409183c82a5ce6d9bf2b24f3e4af
54e13cf13775d7ec5568c099660328ffe537f17d
54f95b17b77af00c8185faa75712be30c59cff4e
557ca0a315d94d1abe929c284df33f7e48410860
55c34fa51cb35a5c401d15dedfa8ac62080968c9
5653806dce05e783b29f4abb8a27d51dbe719b06
56d26654cb262b52b36f283112753d6a1676f54b
572da950fa673ee87a697ded9c62f85fd2863787
5783246d157b9c381e0ea501c22e628956eb99ee
578b8f1ed893f28418536d336084cf9290c6e4bc
584984ea925eeba813aaa671940abcff84803393
58562b0cccbe9f813724c2ffce498a47ca15d15b
5a300d4caa3d8b49f68a0581e38674a5047c3caf
5a9975b20f8512727a4ce800fdc88d4ed41fdb7a
5abb3010d433fc34d8d428750916dc5e417155bd
5ae0eb3975bedb67f4f273f30bc824c5efa7d4ad
5b2b5e5ff65ac819171c46c4bae18edff1ade6c3
5b85a0f6d3182feb7647a3b00dfe480d63926377
5bb7e46a34eb71133229a48da9ca8d071c90a0da
5c7a18108b843f782ceb4afa8c7870bdf77857cd
5d377c1d1ebc7333bf6064d50ce0ceabd20b05ca
5d5bc602aef39c4154acb16adb92236247a5f514
5d7cd8f24b618243d424996060821ec2f4578ed0
5d872aa3b77124ae5c45410c852125f3c44baf84
5e32ff2588d8fe7f43254e1ac28673a38d683a08
5ea6d4e373ce737e3d6eb51087e857093a97def5
5eb3d3f8df52d620b8fe246294f8125c669a2159
5ec53cff55efe769fed94c439f64644a62d0becd
5f071c56a37303ef47a6ab44fbcbacef68c62902
5f16f6e5c8fa39ffc4d83e6d4535526eea10ab1b
5f303bdc60140248e44f5d92a07a04b313621403
5f3798c87baf660708f6851eb8d264d6fb511736
5fbb3ec2c02c04c1140fa59c364e2c4520339261
601ec667ba1ae30c718ec27394a81c38f33307f3
603764773b75847760553d70cf2cec0bd8879210
606684f2ca5394866e9d4ed256c11ce09e60ce72
60ea6943eed357741b8c91d3a54e460069bf00c6
6169f0b2d3738a8b76ea7631b6cd0fb3f4d332fb
6186180a103bfafbe9a8874e998f9ee2ef359dc5
6187417a42ac53fe541d7417c49eee70b30f062a
61c50def9ed923f1e610d62b54735aef7fcb9ed1
6225b76bdc977db5cdfcf04d67f8cf376bf282c6
638a66cdc1f6d97b9559819bc488eb476ddb7121
63ec631d878868348df5779f88b381c9b2a94300
6449ca12cfcd79ec8dbe869de83cd728c5896476
647784cf8fcd84adc24dce75931110c162907fe5
64bb9fcd949b8c10384081e8f8568106999a090e
64ea19d214947cf91eb95c0520181054a9ab583a
66caa1b8be8088e57fdda2e64db1c40f26df6f5f
6726ec90341b6426fc40bc62e891cf3245683cfd
672744fa6ac576209ffd6177b439127b4d98328d
676742b6866913ef08d32f467256b5696026808a
67c06dc0f1e94f788e81cf402c1e8546ced3e006
67c5dbbeca483a6bd2fba9ee5a31cb59688e7941
67e8ec5f8dbcf8efb18e1d61b7427690ba506001
682545fa292257c0c6cecc2fcb6c0bb0168beba8
684c82c5254c3798fa3c7b4f8153f35dc7c65542
685eecd305ff6ff1b728a2fb7598303e6231e5e8
687ae05730025c4751b5f6f32300e87867f07a77
68e0506110ffef04f4ff258a7a4aaf4a8ba8fdcb
690ea64685bda4000047a8913d25fa9dda2502a3
6910aa3076fa0d32e7992ab91d745c4873327ed2
692cdec72592953a47d243c63e393ac710c4e749
69339116b3c830969f9b7dd5c307d7099a6fe20a
697b65d90229e88ea72b70ef4237761e8bb3b091
6a27836cf5bc348bc6f9a6ae839c3ffc36c1665b
6acee0d0c84269f50d20fcd5bec6cc8a1be60c2d
6b89f3dba6c636b486ebdceebd90a88761644ca0
6c02398845c7c9a4b3e2f5a4be936012df38f1f3
6c4f6341a4db66711ed417c97fc6b0900785d929
6cc530d75658b65f69a4ff222bae5cb6225dc4e8
6cfc076c413a2762068b9200992495c521dbfe26
6d4f62fce694078803de87b53b116f58552b3d80
6dc5a2f1db6258d6e51549f002729838e03c9f08
6e1ecc128c6959b088581561126054fd5b74c545
6e68de5aa1b66e14315f89e0407ec8a80933c7dd
6e873854c23a07ae833bd625f4ea4469ee542ed5
6ee7e895508e296728cdf95ad49a58ede9854f58
6fb1c2b0c635a66a83037bc6808d916515b0e0d2
708283a361bb0df5dbd7fa390eae4ffc00715ee6
70a350a3afe8c5447ac4b18fb736409dd1e41fa2
70bfb745e1b074c1193886f36200cc8cc6267039
710a48bb639f1dc5033ef6aed8b701ca3399885e
71324c495f1ea77cfdf213b57f91a34b0350b9a3
7137eafb64c27028fb9fc2bd1645c3ebed810fbc
717ae2d213ac45ed9bfe5bb0fce06775e7a91294
718412736ce0ac5fe3692a74627933af31a5e395
719ef52b0ae14dba6e23f496e58165ada855ab60
71d4bdd04da8e055c507abb0f4baacf9c7f38cb1
725c4d69f422c72fdfc509a5fa865a2e433bb1f3
72c4d8e6947f1f1eb1f1b9dc5c1200756b79880c
72c59f1eda98676da3f3c4f05e99296ecf6aacd7
72d2b3faf58d7df420307f90e23cabb834b29edc
7364d1835436a994f3b9ae181a78a7057c044a25
738e50fbcba50b4666054faa432b33aebc3f6804
73bf21225e1a8afc1bf4137a549c6a8c7f979226
73ecfcda900df2cda9f5d6053b9f16eecfb5a151
746be528c3cef29c5ba6a4e4e9e03f697aed8e18
747dd250cd34f00e21a4483d5329c5a0e89ce05d
74877ca8aa30b07745034bcd7b8e1f22d87970a0
757a16d1ccf3873cc207b2afc11d8cc6264dfb2b
7581bc88a7dbaa02660a2bcb4a3c6dab4e8b7231
76b20ad2a610dca164a01a195d9a6c99406d9b90
76e643115d1a10886086846a4760b08f63efece0
7735f216f5efe0bc76975e78869261f78546d49a
77c561afcd776b8fc2e5caeece0cf031c8b35a86
7a9ace0bc7f0a045aef0c322a2b1dcfba22d9b79
7a9b9b402cf4071e3a360fab0481139690013932
7aca0f5afb63fad3c0eb0d3e416b15b81ac4c4ef
7af22a2d8aaec1b2cabed253f8c80eaae6a1bdd5
7b3f9232ccde19be0f997940164d5c1221da0f95
7b5faab72070d892f3d3b6c0e17b9a91065d0da8
7be66913aded1b96dd8efdf787cccf387b474e90
7c1407d26e23bcec205b04f3344c5585fedae7d6
7c57e6a0b2ae1adb10a06a7365d4cbad6152828b
7c90e9c6fa5ae9f12316bd4bd37d20b6fdf79a36
7cc54c937380bffd91272e7948217a10a7a877eb
7d2d4366dbf46f7c4e9d979b502391fe0ace6b67
7d4d5ae223fa9738febccbcecf2be6bc90858697
7dc0ba0ae15e645c3d7dbfac42a04994d461bb02
7dc56726c626e20da5b2741f8c62470b30e01a67
7dd367a65b6efd98204cfede69e6b9f9c8f2f3f9
7e0eb037050364c490924a85825c8e7efa750a6f
7e1754ae1bd615c786460afda33a30edd6120c60
7e4d68d28450d141a2218fbd84cc32bc44dd14e6
7e65c5cdb6669411922fc4edae3fecf3318ea280
7e8c1f30069cb114e4bc0d0e901bccbdca9d74a5
7f12f5b39187bebc1c6620d4d9a8d47874bc0f80
7f20d8e60e974fa304a8e969a2292241cfe10739
7f383aa0b396764694b97be685a4db649b67287b
7f65c2d6d2eb8fe79580ab5f0bab05a197e108c8
7f8b634f0c8d9d656a0fe174cb6e295c39172e91
800a3af927626b21d85277f5efb9a8017f45f762
80250fdab3fc87d93500dd805b29772a83b65dee
8050a7ca1140eb801d7d10f17e5c825e6da4c887
80c5a2f6a7e9f38092605ccd16417df605582743
8113a8ffee740528bda4a04b8040964c4c0a88d6
81202819b44f59e4fec4336b58b57d7fe0401250
81334c13d0eda1537b6375d6fde9212837bc2616
816f3ed5ef99786af69baab95600b52a36dd7243
8180db25cb33c16fe4e06d92bdce007a4c52242f
818605ec3ae4eee86f7d6db48f19c7cf4fed59c7
822823eaf4f1f9b0de12affa71b6ccd5e23c907a
8265e3e4b5ddb8baf0e057e0bcf34dc6efb8ddba
8312199527ed4464d679207774d3afce222c72b9
83802009eff9f022a0924426369d573da12a9b8c
83af78e09725c51bec64a76a92017ed12fb51774
84048fa7e3d1cac08a05aba854c697244de8ff67
848e0ed129c2dca28b447cc9d0a58573d3de1131
84ade474dd6471865ca5232bff127ff0de4908b0
84f657f3e7818ef30a106f07e193be28b6c4eb3e
850e1f2c88b08c6eb468adff9df490b42dfe61a5
85905bc81a77bb626654c93bac139f516ff0c775
870a8f614ffd1d24b156f49849896c09ceface48
875c74cef6560343b9232961e45f4ea683615884
892aff3dbb82e60c41082ae654f46c2355e9af77
89c781c38607c03c89b118cf0498b342369933e7
89d671f79fb893a026f29c174cca64f613db9a73
8a540bf25a4b287ee896393f65d9615061cc8481
8a6ec85b7a7cf9401d7e1d3dedbef578a2f1bb3b
8ab8b9c7212b6824a481b99ab16bf0555d94c4ed
8ae34039471ad84ca70c06de4b946eb443d6f315
8b2eee2b982f8e967fce8fde1c8d7351778be537
8b4f30270d70f43b841c0e9f631140fabcb4158b
8b63b2b4811d81e22c43d25ba34b806b174fd85c
8b669dc1896724a3ac0f0a3d923b45ed71726ee8
8b77f85eabd756a4ac87c5dc4dd841624edbeb3a
8ba5d26aac681216ce004b939c426955aa758142
8bc60c909831d7c1fc649ed51829ec4acd4360c6
8c29ec79afef5bab067eb491116e1744d1b5a0f2
8c32c2343c1a7bad0ccc7b4881145673fecd7a47
8c49f54fb5ad0f866c96e5486811ad3788706b67
8ca7e89dcb5444277007c5e553c74eace4a40eb6
8cf0a7ff137d891231899dd6174abea135b7bc1e
8cfa50bf34ea9e36d2fa1524c9166cafa7d6987c
8d0166c8c6a8d10ca28520aa2522f51b078958ec
8d31b6b87d07de948e03edde3a8046247ff8401c
8e4783bea6a47d740d7a61c2c07459f134f6644a
8edd16bc0720fde0402a6f32d3210ab5b86da073
8ee43baa50380a33e02b24de1f66f09eb4fcb6f4
8f0e10ea9f2bfab5074ce6f5a7842ea43c0e66e1
9004ee5fdd0c6e5c31028cf288d500b4f0f5365c
906bb9c55f94c68bdc04dd924246aaa4328f36f2
9110629707470f4d5610eb0c1ae621006f232d6e
911acfd5ff0e7ecee476e140613568a2de1160ce
916b0abd1622faeb88e331b3f2ae61b9a8591718
921177b1b7bdf08e5586288e40d6341fc253ad87
92fdd0b29265148c4123cf02f54b941e39175783
936d8e54a1d50178285a6ac41f9bc8d0ee4c16c0
966f2c3a20fe65298134f57d78f2fd6545de9b3d
96791b1643aa517aca409b4ddea28191d27c4ecb
969896b6ce80018b9b1e1005390ceec535b588f1
971b2b7606c7044db3ac1d7ab31febf389a08b4f
97ad402c75c8559e22930ed7ec85f79163ac1631
97e4c9eb22ee938288fb601d86b523696319bcc4
9851f64dee803384a69f721866ad18848becfcdc
9999be4ead1d194909e7a69cfc2c76f581338119
9a160460d8f3aea27b9bb661a42f9d1449640945
9b0aca6dc489c811f74a49cbc3bf03e533b4550d
9bbb57225c49aae382ae4d926f30113a2e81bbfd
9c20b01bc7c4e4c9f7a20af89fa3b4f7e2ff2c59
9c374ccac52adc9d8872336ea2be7e1a282371f1
9caaea2b78b76580613e362d393ba873a0112e72
9cffdf346eecc979392dc5d1a2dd24d3b75ea4a1
9d28dc57d092539a4dfc0b43fcece966f5cae5f9
9daf1d8a3c68f42277687bb635f449bc82c06236
9dcba9af7eccbb697bb3ccd91399590dbe50e316
9f67a28a22393965ed77fb4883dbca5fac77b4b6
9f813a9bcde6f737a7b0db8677a50cb68445f9ac
9fd2c4c900f8af0d883abf7da9338d1509791d2e
a017ba6261095449a46dca0550fd5956d0360b94
a035e256dee00ca7016925b0c4ee902031f95f9f
a037399de59f845ac40705b3aff25658b684d0aa
a06cfdcec069adeb1e8b149f6e4c9afeb49ad11b
a0edb8a07e33f1b580ada51567c02305a6ecee5e
a1469646b8fddc970e11f720e1d1e0c7edcd8b46
a1c2eff0a450e055d26cf4aab82d4660abd478b9
a1f17e2fca170c3b0490e88eb2dcabfc93935456
a22704ca9771f5eaf6fba1c29d5bc8c1de5e6c1e
a253db2351c8d1d275b5b10b878c34b067d5c130
a29ab60c955ccb9320aa1356b379e9bc24cafc97
a3270b302c8dc2f870016631253e2d3a446df762
a349767b199040a2ca9b3118259cef6925038969
a38e3434d18408a3970ecceb83db6eeea7f9e319
a3fd5c64f5ed0a2158ad11ea6b2eeda1a2a19da8
a420dd06721d3ddb4f461d0ddf47ca4c05067fe4
a447b5ef9198b3c5370e2f9e98e58fc5cb07a8ec
a4d7b6b3f944fbb2a729fa2adbac1a74d492c078
a527f5ebe27702e9c2f41ed1a2769034652b0a6f
a58304c70050ccb0356ea1cf5ce87924db1c0c5d
a5da5e6d9578750107a54411d4067857c517e561
a5ddd9b3afad085d96b7e061235e301751c338e9
a6104a0cfeedaf2fe6895c3335503f0fc15b48e1
a648d8753de2a05e3ed52b5bcad32a23648ae684
a68345dc31a7bd6d5c6a58cd040bceeeaadccfec
a76104eb5890242022472d916634e4b38bc9c6a2
a7928cd71a4012862e8c832b465f42506969b51a
a8b5c4352362a79ec667c44710b97236a6ef91f2
a8c20f6ab11dafd58cfc38481f627915345df54b
a91366a929de139a1a3842bd199d9a115c0a41d1
a91d196c56fb9701bacb7701382373c780bce753
a92a49ffd9d3f037d7d914e39c78c63168b45ab5
a9bd1e781444f409d7e52d57cd1db96617601036
a9ddbfd2a20217516b3e5a40fbb44419685afe23
aaba36812506af66163236964aa4daa83ff6bd6b
aaf270c4fa70d80ac7f237823ca987673fec8732
ab711d07141a9509b017cbf4c8893d09b7048378
ac047d54cbe84d20e81dd65c813d4a80032a59e4
ac6b8f55a0b6cc2bea6abb2fa499b7719743dd08
ac8dc627db174a0972ebd799aca7ab4d377408c2
ac93027b9722ee8993238cafd520559e77c3cf12
ae0d0fe7704f4294fb586242c2271028b4eb2c52
ae0f050bc5b29d27d774b2784e7eec88a7805515
ae4852fad35f3c5e4443808e7768fabf6b84c8ed
ae4f38b8e0a736e110f57729870ed5ba2e9f9de6
aee7e7803c35d3f8c869bc32b374e2df9f536ef0
af16d599022d3c72e23e2ed0adb85d27e36c1ef1
af7b156a656f4f502be01b3034f6fd013df2556f
af852145b53e90cdb0d7be1b7c32be98f8dad3e6
afb225467be02e1a134defe3ebb23720551c7c6b
afe09bbcb9c3b69e764e3381be286e7ec3c11e9e
b0c276c7c5ab0ef4d949a13271b81c701bb65cf0
b12d77d323b78f0de72110dd8c149a9d3e5d792d
b1a60fbc604ba029c2007192697bea946c69dc99
b1f2d6c86ae0f905e4ef9fc4c737ab07473bc84a
b200b26a47f554073063004892c505ccbfc9c258
b26e63ec301e3ab48bb91489fa5fe43dbcdd6a6a
b2d6283795de6838f606153867cdc0cfe9f58c9d
b30169d697c56a47638240e7eb393913c96d907b
b496b29788eeed237461e9c51b4bd68920d17e19
b5252ca4718c360c7e9e9eae16eb03d20a4739fb
b65203f9f202dc4fa9c94285c17538a0270f3f9b
b6a43bf54f053427559eed2450e67a3bfdd01a50
b6b9175604078f9367057f87669dce08243880dc
b6c3743ce3a0bdaecc6c39860334c1985f903792
b6ca6dc8ea964bb1881a5a21f0e551b4ed7a9e91
b720d3d02f4babfd71d80fabcbdcf9e81b6c7dce
b729057dc12da40349cc87649e539543edf7443b
b74a6d886d6bf28e3d4bb35503967664049efc1a
b76969ce9fad54957924103731e36e66bac0dd53
b79c9c908bb84c7a245b6ea7b3cc512cc669dd4a
b80cbf574cd37c6a14dd6f0841a0766c78a89f0e
b881c02bf00532d6753c2fa295e167b0003fcf87
b8c719e8667b2e3909de2c343715ecc4330faad3
b8fa2942bf7f25095dcb3604c964a79bbfe3b849
b97bdd134d08bf2c6cc94aeaa7f762cd0cb24362
b9baec80ee9214ab13cb85092a937ba20a9533e6
b9daa5b3775279d82704fba6759bee37c935efb6
ba0927e702ee70ece3c2941d0d4a20f182c96413
ba50e159c84b48974cbc5ce3fc7e5825a1733f96
ba60ccab4902b2639c1d621f033e035c2b4809d0
ba70cc6814f2ba9f628073c6d7dc4dd0daa0160f
ba89c1be7cdb1b9a11c74dcc12ea881111fcb181
ba96fcde6ec4204f94711270cbd76e4232d84727
bab6ce4e3e5ee8c22a8ac9ea794f8720a2124d98
baed6a9076dbc139d86b3a18bf476f1a8f6ee262
bb81feb1da366a0ffbaeedf71ab7fcc9f86c4c8a
bba4bf0e5202ea921903b04407dbd36d91890763
bbf7b1c3709e808b1a7b67fca5a3d5ebe838ce95
bbfedbb2ab31e9cc7d0bd48883382f56bb7a2c35
bc18496eef79a6556f484e99002f169f1b0f9733
bc8615a72dea835dc941803a44f0b051ea5e24a6
bcb1f1bf5ed3b8ef589e847ab417ac28911a469c
bdd7bbf6d0ec18fd17648146cf6f2e82a569a249
bddce025b22178d355f77619987957d9a1c7e370
be3a6968fe8e9358a2a17e99623c35ad3da487aa
be5abd6a2980856c0ed714f54e21eed584cb10ae
be68de35aacc58164b80c8fb975a3c8aa2284802
bed196a796597fa4ffb71ae58835ee1df2e474c2
beeb8a978f30aa6d2a1c47e0f377ffd6cf36f5b4
bf027b32b209b5cac1a1d0686e9bf11102aa6e2f
bf3850b4b718c290ca2ee3695587b65f332e674a
bf3df9f3260fa20fa5597f000b27260bfb1da5e7
bf517f35dc0c5a6f1168e9bbef59720199539ac4
bf82394b38f93c0540c6bfe065c20a225f4d1a9b
c03534fcfd80eb28da53780c06823decd19b3b1d
c04b52359d963580cbc1022934c13c3172535af5
c06bfbd27ee98cb70c1cf2425d606b674c7083d9
c0fd630cb7190dd62b77107ff63994dda1ecdf1c
c143dbc635c5ea24f935ddcdab025f0ff577501e
c1ddf7217fc5780a699993c860a52a7402f98a76
c2374ca1c22826e68c9fa172e4a04e222fb8eeba
c36674bb4cf82279bb32ac8b0d8fe4c1dde4e2cd
c36a5fd1b0bee0331ac2bd92299d1498a101838a
c373f5b9177b2e465d8091ad06ccd605fadba1fb
c39395744f7b3715e6bbe0f9d65490b7e789e02b
c3a322cb8072e263bec36fdd66b014da80e6d64c
c3b6dd8a1f89d0e563171a75697ee096fe0ef5d6
c3e61df360d155d3b396838d3cb1eeb7324d14b0
c3f0541eb191e153a0ece6b0d79379bafd135a1d
c47d807457e2cba5d82e00764340e08b6c1d512b
c4e041e1dcca8877c1d8aa3f33ae68c6a35f31e7
c54d815c2007dc0f818526c530b2acdd456018db
c552ca293aeeae343efc2c4dd5ec5525fa16aac6
c57ae13785629ee55621115f4c91b7fcac7789d3
c587c9440628e19f8f762b72c0738506f6413453
c58a2e0e20fd1a08f6a8f52275b12dcd7b3c9440
c5c7c03403168d266f29583e7128e38ff4f97297
c61ae632bcb5caeec827bd08b2f6d922eb15a223
c64e6d63d77aa2e08ad68817a13c6d70cff3c145
c652edf8a5d3d770d38f3f1203d61c59b5beccf1
c68f59c4443e46ef4326599a0b9561a59b3b62fa
c6f207d8d19e7d8993be09590a998b77f9690c02
c794d11823956b5464ce1775937ec54a4d5551e1
c7fee9c9305d91e8cb186f9bcd3464d73943d78a
c8b12d67ae129147d4f320217469f714aba10c31
c92ab9b3123f78cd04d263bd58d36e0fa8efcd76
c9815bc9252b10486cc02e1a70fb2198dba48a6e
c9d51c6936a519aa960e2c2cd92c0dc0e13ff979
ca20fab16a8c101bf9cd8411c08f72d202f55a6f
ca354734a620449fd1916fa062698fac8c835fec
ca8f59cb675c3fa77f6f703647a26ffe3dff660c
cb5a86e0a4613bcd3d76c5fc36e23d9aa137db92
cb6e84b0ab895862d813a498107170ba7f1317db
ccb60ea6f91472ee4f0b558f18b626c3eedb07b0
ccb8534fc497b4634bc76f9203219ced7199a5c5
ccd57e97893eefaa3a04a277b946c66e0532f800
cd12a373b6660262ac2304c28465ccd195e23ec3
cd4f143798fa3d4e512bcf2d3809a43122f35ead
cd5e61d140dc59e9a6ae3dd837ac44139e153107
cda2ba75719ef995bfa7afe5e0b954f35f146bf3
cdcb904260d4b036a8e4edf315c634cf05e8dea3
cdea82e97381496016dd3a83153e2ebc02bbd834
ce2299ebdbe24ff5c5d8c8563bc48e797cf234c0
ce2ad25d88b857062c89bebb30b46d1c2a3f7cc2
ce6c3dccd0654772ef64fd95918ae9a7483fa31c
cf937697fdac8357c3acfb0d76bce553c3d426a5
cff5195954e426a46dea3264bdaff9ba3c92d637
cffad34c6eeff1e798856076b7181d5b2243066e
d0438c85cbe45ad425471731a024ab629d006181
d0c734a2fe51c3e358e8a2e6f735a39305528d51
d0f00a5717ffba66e1fae07c74613c6ff9141c22
d1273f1d63b07ad9e89876fde479a8c1ba3d8864
d1f6d62e292f352f70d4029b389675fa186b1dcd
d2670ed1ffe372db71311097ef1b6d9490aef2e5
d2819067d664654571af8dbeda2841bed27d54a1
d29929358eecaef7a1f681cf028054c68c42ceb4
d3a4f7ca1c1b64c8e75303a1b564ba4be5ce069f
d414cd62270c6c1b802cee1618aff1aaa8defb98
d429255040a81ce2085082cbc5af93ef9aee637b
d45e61f918adc99d25cbac81ea2a7b92f1b2715a
d4a59909e8daaa2aec8b94b6f5f71dbcbfed5d1a
d4e473ebb701ae533d8fb724200b997f83c9035a
d5571f40f8eb023922aab0dbd83ecc79dd7abba4
d57964cee5efd7153dc75bf818abbc930499b678
d5bd369a16c536b885cc795741463fb138f7b88c
d61c37a61204773a704810a0a9cea71344fbd5e6
d6c296fb40d2b800b857ead57cba12cca6a67264
d6f52cceefe81046b2b32c289bcb9593c0022ca2
d8125e26c70270a1a04474bbfa6312e5450d4b2c
d826e45a65f862e80700f7fb8f88058d0f93b1fd
d921215cc77c88f608569aadb3563a00c1d60272
d92c18c303e18344edfe443d45874c4a7b3ec326
d92f7dc79a3af16a23f9570aba4c120bc2b399f0
d94d2bcb7f9701558459564ba823f04714d7e386
dac2e47e2a7bd26bcfb0d361d9116d8657294f4f
db06110efeb5d391e65801232a203da52ed165b7
db74a6ed016542f98297c38191f6967be7893efb
db817507c77a18319ef6ded197dca8121e79f643
dbeb320b8aaec61dfd886c2133f5699c14a8094b
dbef7bb6010b66b35da69dfc15ceb2b21c1e9641
dc08f86c2cf21053f8a5d3c1fb90c78ff207557e
dc4345785cea4a71698523837c0867af515f484c
dc7ba9cda075d3d3364fcc1b3a090a63cb07e900
dc87fcbec6ec6beef3e2544e30c6aa1dcdd381ba
dc8d1a06a59d37d8e368faa2226203a4aa98518e
dc9e2cd28428f6d68a7380cf6273af03fc692338
dd993c79cd47fb2ff2ac2bb4d7337889aaf3b227
dd9c304404f86d62719c12ffa0ff4d6e4ccb1a74
ddb0bafc54a137865bea54c46b11739e0c066e02
dde4f57b4d47eca849073655ee48c5c1d41d40cf
de3f5f17c736a42dda14fb6314a05e0ec4242ff9
deb39848cfcb2873dca7a8297d9401e6437b559c
df0f77f0c2b66b239b5ae7e6decfee790b134df8
df4bf4147c037e80bc5e3a5368795ff5c4e0ab3f
dfbec8c3250af0965934549bed6c2d8941d431a8
e07c65a6a8219294c9a3cec7237f223cc2da22f2
e0988ac6ec29bd271b90f5505a71ca0a095be1a1
e0a6ce8564028156967ff8cb81adfd61b3e1372a
e0eb4df3369ae40cbea141ea2e3e31f400ec8564
e0fdc202926efdf87622562cde9d185def04b1a3
e15069a04f5cdc7e0bb61ab6b4df61a1d9f594be
e1578d7d31a77367f4011a7f1aef53d5a6c21b72
e185b135798646586e0b8692e93187fb1594e577
e1bda13c7f6637024d54a7c89b3d7a0d26712bed
e1e4e6ef4d7b4011f2faec6364740072ecf948cd
e256cea43471b0a6da0cbe856c674ed0afea1b6f
e2ba2fc3ef2b8b97a7ed500633cda58fdd652a93
e2edd86761f3fcc3cf909239952d6f69eac8428e
e388ed6be0f48304d4389ce88bd9d7a921566bd5
e3ae73a757b32bf5b106b3a60ea349d8ff801e33
e3f3b20aa05de95d4208545b8e8eb1c93b16de3e
e43333f0e669db91d881867bb14499076af85e27
e44762a22bfd4a4203e50f59c4119fcd7ea7ee06
e4f92b8ddc8a01937b8dd231f153b4a3d5f11ef3
e5cac42d705aa491eefacd15d0ff4a8c543f9ea3
e66f908262478649cadb98788910452395c90e91
e66fd0d7ba134f0b05c107069af48e465c3463a9
e68eeb4021d8971665c5fcfd390a0103ae19e7d3
e720ba5e7ce920b1b118ea3b5ba737cc0db1b687
e7315c4ceaece54f76d0187777eeea2e61b538f3
e75f93942d06cdb3d2d38b07b9ad747916c78257
e7c34d9de82005b6d32f7fc998be09b620bd1cf6
e8a13db2733f93b6a8c6fc9f34f626d10e8cda30
e8df0da253a3492b450ad294d5723fe8ebebe452
e8f5000edb2b274d88b0bfc34fc3fb5058600626
e9953cff51fd18894688c35894e7fa0c2ca26f90
ea27315d4273cec39084f484e582cc72cab9f72e
eb4010e129e85bcab93b7318f2ead07c21d4b9a0
ebd1e4222b6095d17645a9a6ddb3cb7e24ff7569
ebd77dbdfd18555fd608f9660536704234b02f0a
ebfcc54f0e609bdbe02b78856d2a3e4168395663
ed33577838bc9b8e5d20c3f1157ffb8de9f4f545
ed40244bc79c6522e8d308683e91c9b04e6de3d5
ed4aa47193c60577ce5a762b0d1b14ee9685dfbf
ed5a14fa6b0a59d6894248064d2a078993d0c9a5
ed7ac1dc48bb16adc23b97a555cc74f12c4312aa
edde525430caecd28864c854d63e9fb0225ba950
edf7af993fd7ae29c8c43d6f1ac8b273a4e0fc5c
edfe2866fe1cb93ba6ac165071509ed18a97188c
ee08e970578c5009b66972cbd2ee7d40d4a9cea0
ee2fc56daa3c6cdd20a770ec3585cbb916ea8fea
efb103adff985e81be1b1b13ffa2eb60761013af
eff2c3a33bc7205ddf14a1af6634957e6586f519
f0823de803111629648af01e37992864d74915e5
f0906b9aed343e07c820fa07241c9a5cde4ea863
f12e039e46a00595cfa6823612782c37e7db6e21
f14b1f0cc93e7b2dd28be07dbe4dac4926d134cf
f15246fa3cb649392b077c376e9f02305d160522
f1698e27f952a305f3dfa4c7649b5c2ac8519f2b
f18ac2184c5bec329e67f66486ad9af4db6ead57
f1c89dca4fed17460521300453f557bcad04506d
f23f953d6a1f3c4583302ab8a2088e4f2eb1cbfa
f24967c13c6db254be61e7c4f7169e210b6f91ad
f276864ada03d2bd85e573884cb0815076fbeb6d
f2c4981c709b2b502633b29569a5ec6024ead544
f2ccf716a54f2cae6bcdaf5eab7793a62e83bfb1
f3334c331a6f89336777592786d926047944d4b8
f362cf96c8f2008cb627b07473570ed98377cf8a
f43f8cbaaab165d8982409ce66ea901567e885f3
f43ffb3fc1a8a12c03d9021053d15a12dfc353b2
f44854bee8a337ad5303f774552524e7e91ebe18
f45eacd73eb2b1ef8031bd33ed84cdf4feb5b309
f462639bf584750a51a8f7312d09940cdf0dca35
f509686eca9c9197f354bb26a29780573d43c10b
f5178192e4b66122a5d8d771c031c6e6e7f008e7
f58da86b0c08a1ac6ca6262785afe65b765a2ae1
f5946682a6e3eda55d8e2aaccdf4200d0e616e22
f5c71014d93b562116ff50cf2893572470c352ee
f5de7c7efb21806f6fab73261c6ed24b91490c39
f5e02836eee381c5ded178aa7cdee1d8ad533ada
f645a1345ce3daff1e978da15764e9fd114e007a
f6f96570af36f47a26f63d2604c4a8709cdac18e
f7123b9ac5676455b340cb430399c0d51054aff4
f8174e059ed210faa2bc26c6d4e3d10065a80bd0
f85a70285d903dd8df1e60b9c79e0c6c5c6136ca
f86857759d079f431f9af7e55a26e49b14365d57
f8ee5f004430d75c0f571a045bd8697dc502a7fc
f987409a0e54114d60490fd92e84ecf1bc30f0f5
f994fd5c9c03359194b726438704895efcbfb948
fa514f111bc2a2148bf75ebc3b24829ce6880b1d
fa6ef8e3062cee720c10b6e4a22bdd3e5d7d299a
fa7d549862ee8e8106f585c9ce8c4115be4927f3
fafb1f7fe743337a43ea7c9e329b6395f4d806fb
fb20d0b9f52ac6529cca82c3d93108198dfc70ae
fb860dd55a4f7db12e01a0dd0f1a0a121bb82fbd
fbbd156552a9bf70f3251a860663356e04826c7f
fbdc3a2f42b486662913f8a20ed4503009282d44
fc89c93f9d22bb079c1ce301c2015dc6a7d42daa
fca6c9b9df96a381a35d475fb230bdb06b93b0f2
fcbf47a3f89a01930bfd51ba9e062f09e09f3bf1
fd253a1e7b47d02abad3d97422f37a32548b33af
fd45853fb03c7fe507ae361282bebb1eb2bcd621
fd6470633394b44ef9454e3a7d917a6c60d9c68b
fe002487a5c4ac0dddabcbb98d463dc47678ea31
fe013531ee68d73da933e056ffdadaaccb48998b
fe1fdb3b7a3ade3de005021286b2cfec4f340b0b
fe329487b432ccc6e302ab839817e322126a1116
fe794b3849904858a035c097b13a90fac21b3fd9
feb58876fa85db5317b1db11cc3d8a180ef0aadd
feb79045525fe5582011f72618a1874d8dbb0184
ff2d97ec18c0bac4cbc1fbd47e97dcfb38b2a7f2
ff363f6f596b0aeafe942453858062fccdbb330b
ff8ff034c711db75cd5def79e508cc22ba05acce

130 MB of various Sirefef's (800 files), will take some time to upload, later this post will be updated.

Attachments

si.part12.rar

(4.63 MiB) Downloaded 150 times

si.part11.rar

(9 MiB) Downloaded 97 times

si.part10.rar

(9 MiB) Downloaded 91 times

si.part09.rar

(9 MiB) Downloaded 197 times

si.part08.rar

(9 MiB) Downloaded 206 times

si.part07.rar

(9 MiB) Downloaded 250 times

si.part06.rar

(9 MiB) Downloaded 95 times

si.part05.rar

(9 MiB) Downloaded 241 times

si.part04.rar

(9 MiB) Downloaded 90 times

si.part03.rar

(9 MiB) Downloaded 187 times

si.part02.rar

(9 MiB) Downloaded 232 times

si.part01.rar

(9 MiB) Downloaded 194 times

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19291 by EP_X0FF
Thu May 16, 2013 3:28 am

Above post updated. Multipart 3.x RAR archive attached. Pass: infected

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19335 by EP_X0FF
Mon May 20, 2013 3:05 am

In addition to previously used anti MSE/WinDefender code new redesigned dropper brings some features from rootkit version.

1) Changes security permissions for all files in %ProgramFiles%\\Microsoft Security Client and %ProgramFiles%\\Windows Defender
2) Set reparse points to every file and every subdirectory in %ProgramFiles%\\Microsoft Security Client and %ProgramFiles%\\Windows Defender to point to the \systemroot\system32\config

So MSE/Windefend can't be reinstalled/loaded, user cannot access files/folders in directories.

Also like before it terminates all embedded windows security services and deletes their registry data.

Dropper itself now more multistaged:

1) Basic obfuscation, sort of preparation layer, running itself as debugged process (CreateProcess with DEBUG flag);
2) Unpacking aplib container with actual dropper and transfering control to it;
3) Performing removal of Microsoft Windows security software, disabling Windows "Action Center", unpacking payload stored in the cabinet file, dropping files at disk.

Payload stay untouched, only dropper redesigned.

As remediation steps you will have to remove all reparse points with fsutil command, do this manually or from batch script. Because payload p2p.XX.dll's not changed, Sirefef do not control presense of installed reparse points.

Dropper (payload of Blackhole Exploit Kit, http://urlquery.net/report.php?id=2552298)

Code: Select all

hxxp://stonehengeexposed.com/ngen/controlling/coupon_voucher.php?efolxgwf=30:31:30:1k:1k&zvbbupbs=1i:30:1f:1h:1j:32:1l:2v:1l:32&rbzhw=1i&gzqahxg=tqqkpam&ytpsw=dwg

HTTP/1.1 200 OK
Server: nginx/1.0.15
Date: Mon, 20 May 2013 00:13:00 GMT
Content-Type: application/x-msdownload
Connection: close
Content-Length: 181248
X-Powered-By: PHP/5.3.23
Pragma: public
Expires: Mon, 20 May 2013 01:43:36 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Cache-Control: private
Content-Disposition: attachment; filename="readme.exe"
Content-Transfer-Encoding: binary

1 stage (removed obfuscation) + 2 stage (dll.dll - install export launch malware) in attach, extract last stage cabinet file manually from 2 stage dll. AntiMSE/WinDefend code located in 2stage.dll starting from @30672A48.

VT

SHA256: 96ed143826794e53976cf45d188bbb2615042af5f1ff5708d85bb9739a25fd3b
SHA1: 37394f7d1e942250392ad72db8356072312e0289
MD5: c19a7cf55fe0fc41f15396ddcafb3b6d

https://www.virustotal.com/en/file/96ed ... /analysis/

Attachments

Malware.rar

pass: infected
(324 KiB) Downloaded 139 times

Last edited by EP_X0FF on Mon May 20, 2013 5:31 am, edited 1 time in total. Reason: edit: fixed

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: ZeroAccess (alias MaxPlus, Sirefef)

#19338 by TwinHeadedEagle
Mon May 20, 2013 7:34 am

@EX_XOFF

Thanks for sample :)

Interesting malware. Set the booby traps.

The malware create junctions on all files and folders in Microsoft Security Client folder. These folders are unaccessible...

They are following folders

C:\Program Files\Microsoft Security Client\Drivers
C:\Program Files\Microsoft Security Client\Backup
C:\Program Files\Microsoft Security Client\en-us

Junction links these folders to c:\windows\system32\config

So if you remove these folders, system gets unbootable.