├── .gitignore
├── src
    └── main
    │   └── java
    │       └── in
    │           └── raulmart
    │               └── cs_dns_parser
    │                   ├── RecvConversation.java
    │                   ├── Packer.java
    │                   └── DNSParser.java
├── pom.xml
├── README.md
└── queries.txt


/.gitignore:
--------------------------------------------------------------------------------
1 | .idea
2 | target
3 | 


--------------------------------------------------------------------------------
/src/main/java/in/raulmart/cs_dns_parser/RecvConversation.java:
--------------------------------------------------------------------------------
 1 | package in.raulmart.cs_dns_parser;
 2 | 
 3 | import java.math.BigInteger;
 4 | 
 5 | // From Cobalt Strike 4.1
 6 | public class RecvConversation {
 7 |     protected String id;
 8 |     protected String dtype;
 9 |     protected long size = -1L;
10 |     protected Packer buffer = new Packer();
11 | 
12 |     public RecvConversation(String id, String type) {
13 |         this.id = id;
14 |         this.dtype = type;
15 |     }
16 | 
17 |     public long next(String var1) {
18 |         if (this.size == -1L) {
19 |             try {
20 |                 BigInteger var2 = new BigInteger(var1, 16);
21 |                 this.size = var2.longValue();
22 |             } catch (Exception var3) {
23 |                 this.size = 0L;
24 |                 return 0L;
25 |             }
26 |         } else {
27 |             this.buffer.addHex(var1);
28 |         }
29 | 
30 |         return 0L;
31 |     }
32 | 
33 |     public boolean isComplete() {
34 |         return this.buffer.size() >= this.size;
35 |     }
36 | 
37 |     public byte[] result() {
38 |         byte[] var1 = this.buffer.getBytes();
39 |         return var1;
40 |     }
41 | 
42 |     public String toString() {
43 |         return "[id: " + this.id + ", type: " + this.dtype + ", recv'd: " + this.buffer.size() + ", total: " + this.size + "]";
44 |     }
45 | }


--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project xmlns="http://maven.apache.org/POM/4.0.0"
 3 |          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4 |          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 5 |     <modelVersion>4.0.0</modelVersion>
 6 | 
 7 |     <groupId>org.example</groupId>
 8 |     <artifactId>cs-dns-parser</artifactId>
 9 |     <version>1.0-SNAPSHOT</version>
10 |     <packaging>jar</packaging>
11 | 
12 |     <properties>
13 |         <maven.compiler.source>17</maven.compiler.source>
14 |         <maven.compiler.target>17</maven.compiler.target>
15 |         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
16 |     </properties>
17 | 
18 |     <build>
19 |         <plugins>
20 |             <plugin>
21 |                 <groupId>org.apache.maven.plugins</groupId>
22 |                 <artifactId>maven-jar-plugin</artifactId>
23 |                 <version>3.1.0</version>
24 |                 <configuration>
25 |                     <archive>
26 |                         <manifest>
27 |                             <addClasspath>true</addClasspath>
28 |                             <classpathPrefix>lib/</classpathPrefix>
29 |                             <mainClass>in.raulmart.cs_dns_parser.DNSParser</mainClass>
30 |                         </manifest>
31 |                     </archive>
32 |                 </configuration>
33 |             </plugin>
34 |         </plugins>
35 |     </build>
36 | 
37 | 
38 | </project>


--------------------------------------------------------------------------------
/src/main/java/in/raulmart/cs_dns_parser/Packer.java:
--------------------------------------------------------------------------------
  1 | package in.raulmart.cs_dns_parser;
  2 | 
  3 | import java.io.ByteArrayOutputStream;
  4 | import java.io.DataOutputStream;
  5 | import java.io.IOException;
  6 | import java.nio.ByteBuffer;
  7 | import java.nio.ByteOrder;
  8 | 
  9 | // From Cobalt Strike 4.1
 10 | public class Packer {
 11 |     protected ByteArrayOutputStream out = new ByteArrayOutputStream(1024);
 12 |     protected DataOutputStream data;
 13 |     protected byte[] bdata = new byte[8];
 14 |     protected ByteBuffer buffer = null;
 15 | 
 16 |     public Packer() {
 17 |         this.data = new DataOutputStream(this.out);
 18 |         this.buffer = ByteBuffer.wrap(this.bdata);
 19 |     }
 20 | 
 21 |     public void little() {
 22 |         this.buffer.order(ByteOrder.LITTLE_ENDIAN);
 23 |     }
 24 | 
 25 |     public void big() {
 26 |         this.buffer.order(ByteOrder.BIG_ENDIAN);
 27 |     }
 28 | 
 29 |     public void addInteger(int var1) {
 30 |         this.addInt(var1);
 31 |     }
 32 | 
 33 |     public void addInt(int var1) {
 34 |         this.buffer.putInt(0, var1);
 35 |         this.write(this.bdata, 0, 4);
 36 |     }
 37 | 
 38 |     public void append(byte[] var1) {
 39 |         this.write(var1, 0, var1.length);
 40 |     }
 41 | 
 42 |     public void addIntWithMask(int var1, int var2) {
 43 |         this.buffer.putInt(0, var1);
 44 |         ByteOrder var3 = this.buffer.order();
 45 |         this.big();
 46 |         int var4 = this.buffer.getInt(0);
 47 |         this.buffer.putInt(0, var4 ^ var2);
 48 |         this.write(this.bdata, 0, 4);
 49 |         this.buffer.order(var3);
 50 |     }
 51 | 
 52 |     public void addUnicodeString(String var1, int var2) {
 53 |         try {
 54 |             this.addShort(var1.length());
 55 |             this.addShort(var2);
 56 | 
 57 |             for(int var3 = 0; var3 < var1.length(); ++var3) {
 58 |                 this.data.writeChar(var1.charAt(var3));
 59 |             }
 60 |         } catch (IOException var4) {
 61 |             var4.printStackTrace();
 62 |         }
 63 | 
 64 |     }
 65 | 
 66 |     public void addByte(int var1) {
 67 |         try {
 68 |             this.data.write((byte)var1);
 69 |         } catch (IOException var3) {
 70 |             var3.printStackTrace();
 71 |         }
 72 | 
 73 |     }
 74 | 
 75 |     public void addHex(String var1) {
 76 |         try {
 77 |             char[] var2 = var1.toCharArray();
 78 |             StringBuffer var3 = new StringBuffer("FF");
 79 | 
 80 |             for(int var4 = 0; var4 < var2.length; var4 += 2) {
 81 |                 var3.setCharAt(0, var2[var4]);
 82 |                 var3.setCharAt(1, var2[var4 + 1]);
 83 |                 this.data.writeByte(Integer.parseInt(var3.toString(), 16));
 84 |             }
 85 |         } catch (IOException var5) {
 86 |             var5.printStackTrace();
 87 |         }
 88 | 
 89 |     }
 90 | 
 91 |     protected void write(byte[] var1, int var2, int var3) {
 92 |         try {
 93 |             this.data.write(var1, var2, var3);
 94 |         } catch (IOException var5) {
 95 |             var5.printStackTrace();
 96 |         }
 97 | 
 98 |     }
 99 | 
100 |     public void addShort(int var1) {
101 |         this.buffer.putShort(0, (short)var1);
102 |         this.write(this.bdata, 0, 2);
103 |     }
104 | 
105 |     public void addString(String var1) {
106 |         this.addString(var1, var1.length());
107 |     }
108 | 
109 |     public void addString(String var1, int var2) {
110 |         this.addString(toBytes(var1), var2);
111 |     }
112 | 
113 |     public void pad(char var1, int var2) {
114 |         byte[] var3 = new byte[var2];
115 | 
116 |         for(int var4 = 0; var4 < var3.length; ++var4) {
117 |             var3[var4] = (byte)var1;
118 |         }
119 | 
120 |         this.write(var3, 0, var3.length);
121 |     }
122 | 
123 |     public void addString(byte[] var1, int var2) {
124 |         this.write(var1, 0, var1.length);
125 |         if (var1.length < var2) {
126 |             byte[] var3 = new byte[var2 - var1.length];
127 | 
128 |             for(int var4 = 0; var4 < var3.length; ++var4) {
129 |                 var3[var4] = 0;
130 |             }
131 | 
132 |             this.write(var3, 0, var3.length);
133 |         }
134 | 
135 |     }
136 | 
137 |     public void addStringUTF8(String var1, int var2) {
138 |         try {
139 |             this.addString(var1.getBytes("UTF-8"), var2);
140 |         } catch (Exception var4) {
141 |             var4.printStackTrace();
142 |         }
143 | 
144 |     }
145 | 
146 |     public void addWideString(String var1) {
147 |         try {
148 |             this.append(var1.getBytes("UTF-16LE"));
149 |         } catch (Exception var3) {
150 |             var3.printStackTrace();
151 |         }
152 | 
153 |     }
154 | 
155 |     public void addWideString(String var1, int var2) {
156 |         try {
157 |             this.addString(var1.getBytes("UTF-16LE"), var2);
158 |         } catch (Exception var4) {
159 |             var4.printStackTrace();
160 |         }
161 | 
162 |     }
163 | 
164 |     public byte[] getBytes() {
165 |         byte[] var1 = this.out.toByteArray();
166 | 
167 |         try {
168 |             this.data.close();
169 |         } catch (IOException var3) {
170 |             var3.printStackTrace();
171 |         }
172 | 
173 |         return var1;
174 |     }
175 | 
176 |     public long size() {
177 |         return (long)this.out.size();
178 |     }
179 | 
180 |     public void addLengthAndString(String var1) {
181 |         this.addLengthAndString(toBytes(var1));
182 |     }
183 | 
184 |     public void addLengthAndString(byte[] var1) {
185 |         if (var1.length == 0) {
186 |             this.addInt(0);
187 |         } else {
188 |             this.addInt(var1.length);
189 |             this.append(var1);
190 |         }
191 | 
192 |     }
193 | 
194 |     public static byte[] toBytes(String var0) {
195 |         int var1 = var0.length();
196 |         byte[] var2 = new byte[var1];
197 | 
198 |         for(int var3 = 0; var3 < var1; ++var3) {
199 |             var2[var3] = (byte)var0.charAt(var3);
200 |         }
201 | 
202 |         return var2;
203 |     }
204 | }


--------------------------------------------------------------------------------
/src/main/java/in/raulmart/cs_dns_parser/DNSParser.java:
--------------------------------------------------------------------------------
  1 | package in.raulmart.cs_dns_parser;
  2 | 
  3 | import javax.crypto.Cipher;
  4 | import javax.crypto.Mac;
  5 | import javax.crypto.spec.IvParameterSpec;
  6 | import javax.crypto.spec.SecretKeySpec;
  7 | import java.io.ByteArrayInputStream;
  8 | import java.io.DataInputStream;
  9 | import java.io.IOException;
 10 | import java.nio.file.Files;
 11 | import java.nio.file.Path;
 12 | import java.util.*;
 13 | 
 14 | public class DNSParser {
 15 |     /**
 16 |      * Filename containing all DNS queries sent by the beacon. One query per line.
 17 |      */
 18 |     public static final String DNS_QUERIES_FILENAME = "queries.txt";
 19 | 
 20 |     /**
 21 |      * Cobalt strike default IV for AES
 22 |      */
 23 |     public static final String CS_IV = "abcdefghijklmnop"; //
 24 | 
 25 |     public static void main(String[] args) throws Exception {
 26 |         if(args.length != 2){
 27 |             System.out.println("Usage: java -jar file.jar [AESKey] [HMACKey]");
 28 |             System.exit(-1);
 29 |         }
 30 | 
 31 |         String AESKey = args[0];
 32 |         String HMACKey = args[1];
 33 | 
 34 |         Map<String, List<ConversationFragment>> conversations = new LinkedHashMap<>();
 35 |         Set<String> notImplemented = new HashSet<>();
 36 | 
 37 |         // Build conversations map
 38 |         try (var br = Files.newBufferedReader(Path.of(DNS_QUERIES_FILENAME))){
 39 |             String line;
 40 |             while((line = br.readLine()) != null){
 41 |                 var parts = line.split("\\.");
 42 |                 switch (parts[0]) {
 43 |                     case "post" -> {
 44 |                         ConversationFragment data = getData(parts);
 45 |                         conversations.putIfAbsent(data.conversationId, new ArrayList<>());
 46 |                         conversations.get(data.conversationId).add(data);
 47 |                     }
 48 |                     default -> notImplemented.add(parts[0]);
 49 |                 }
 50 |             }
 51 |         }
 52 | 
 53 |         if(!notImplemented.isEmpty()){
 54 |             System.out.format("[WARNING] Unknown query types found: %s%n%n", notImplemented);
 55 |         }
 56 | 
 57 |         for(var e: conversations.entrySet()){
 58 |             // Rebuild conversation
 59 |             var fragments = e.getValue();
 60 |             var firstFragment = fragments.get(0);
 61 |             var recv = new RecvConversation(firstFragment.conversationId, firstFragment.type);
 62 |             for (var fragment : fragments) {
 63 |                 recv.next(fragment.payload);
 64 |             }
 65 | 
 66 |             // If conversation is valid, decrypt and parse
 67 |             if(recv.isComplete()) {
 68 |                 var encrypted = recv.result();
 69 |                 var decrypted = decrypt(encrypted, AESKey, HMACKey);
 70 |                 System.out.format(">>>>>>> Id: %s >>>>>> %n", firstFragment.conversationId);
 71 |                 if(decrypted.length > 0){
 72 |                     processCallbackData(decrypted);
 73 |                 } else {
 74 |                     System.out.println("Skipped processing");
 75 |                 }
 76 |                 System.out.format("<<<<<<<<<<<<<<<<<<<%n%n");
 77 |             } else {
 78 |                 System.out.println("[WARNING] Invalid conversation: TIME TO DEBUG! (probably missing data)");
 79 |             }
 80 |         }
 81 | 
 82 |     }
 83 | 
 84 |     private static void processCallbackData(byte[] decryptedbytes) throws IOException {
 85 |         var in = new DataInputStream(new ByteArrayInputStream(decryptedbytes));
 86 |         var callbackType = CallbackType.mapping.get(in.readInt());
 87 |         System.out.format("Type: %s%n", callbackType.toString());
 88 |         switch (callbackType){
 89 |             // TODO Implement behaviour for each packet type
 90 |             default -> System.out.println("Raw data: " + new String(in.readAllBytes()));
 91 |         }
 92 |     }
 93 | 
 94 |     private static byte[] decrypt(byte[] payload, String AESKey, String HMACKey) throws Exception {
 95 |         var ivspec = new IvParameterSpec(CS_IV.getBytes());
 96 |         var keyspec = new SecretKeySpec(fromHex(AESKey), "AES");
 97 |         var cypher = Cipher.getInstance("AES/CBC/NoPadding");
 98 |         cypher.init(Cipher.DECRYPT_MODE, keyspec, ivspec);
 99 | 
100 |         byte[] encrypteddata = Arrays.copyOfRange(payload, 0, payload.length - 16);
101 |         byte[] hmac = Arrays.copyOfRange(payload, payload.length - 16, payload.length);
102 |         var mac = Mac.getInstance("HmacSHA256");
103 |         mac.init(new SecretKeySpec(fromHex(HMACKey), "HmacSHA256"));
104 |         byte[] calculatedhmac = mac.doFinal(encrypteddata);
105 | 
106 |         boolean matchesHMAC = isValidHMAC(hmac, calculatedhmac);
107 |         if(!matchesHMAC){
108 |             System.out.println("WARNING: Invalid HMAC, skipping packet");
109 |             return new byte[0];
110 |         }
111 | 
112 |         byte[] decrypted =  cypher.doFinal(encrypteddata);
113 | 
114 |         var in = new DataInputStream(new ByteArrayInputStream(decrypted));
115 |         int counter = in.readInt();
116 |         int size = in.readInt();
117 |         if (size >= 0 && size <= decrypted.length) {
118 |             byte[] realdata = new byte[size];
119 |             in.readFully(realdata, 0, size);
120 |             return realdata;
121 |         } else {
122 |             throw new IllegalStateException("Invalid size");
123 |         }
124 |     }
125 | 
126 |     private static boolean isValidHMAC(byte[] b1, byte[] b2){
127 |         if(b1.length < 16 || b2.length < 16){
128 |             throw new IllegalArgumentException("HMAC data must be at least 16 bytes");
129 |         }
130 |         for (int i = 0; i < 16; i++) { // Only check first 16 bytes
131 |             if(b1[i] != b2[i]){
132 |                 return false;
133 |             }
134 |         }
135 |         return true;
136 |     }
137 | 
138 |     private static byte[] fromHex(String hexString){
139 |         byte[] result = new byte[hexString.length() / 2];
140 |         for (int i = 0; i < result.length; i++) {
141 |             int index = i * 2;
142 |             int j = Integer.parseInt(hexString.substring(index, index + 2), 16);
143 |             result[i] = (byte) j;
144 |         }
145 |         return result;
146 |     }
147 | 
148 | 
149 |     public record ConversationFragment(String payload, int packetNumber, String conversationId, String sessionId, String type) {}
150 | 
151 |     private static ConversationFragment getData(String[] lineParts){
152 |         StringBuilder data = new StringBuilder(lineParts[1].substring(1));
153 |         int nSegments = lineParts[1].charAt(0) - '0';
154 |         for (int i = 1; i < nSegments; i++) {
155 |             data.append(lineParts[1 + i]);
156 |         }
157 |         String conversationPacket = lineParts[1 + nSegments];
158 |         // TODO potential bug --> conversationId may be 7 or 8 hex chars. Manually fixed in queries.txt to 8.
159 |         String conversationId = conversationPacket.substring(conversationPacket.length()-8);
160 |         int nDigits = conversationPacket.length() - conversationId.length();
161 |         int packetNumber = Integer.parseInt(conversationPacket.substring(0, nDigits), 16);
162 |         return new ConversationFragment(data.toString(), packetNumber, conversationId, lineParts[1 + nSegments + 1], lineParts[0]);
163 |     }
164 | 
165 | 
166 |     public enum CallbackType {
167 |         // Extracted from https://github.com/DidierStevens/Beta/blob/master/cs-parse-http-traffic.py
168 |         OUTPUT_KEYSTROKES(1),
169 |         DOWNLOAD_START(2),
170 |         OUTPUT_SCREENSHOT(3),
171 |         SOCKS_DIE(4),
172 |         SOCKS_WRITE(5),
173 |         SOCKS_RESUME(6),
174 |         SOCKS_PORTFWD(7),
175 |         DOWNLOAD_WRITE(8),
176 |         DOWNLOAD_COMPLETE(9),
177 |         BEACON_LINK(10),
178 |         DEAD_PIPE(11),
179 |         BEACON_CHECKIN(12),
180 |         BEACON_ERROR(13),
181 |         PIPES_REGISTER(14),
182 |         BEACON_IMPERSONATED(15),
183 |         BEACON_GETUID(16),
184 |         BEACON_OUTPUT_PS(17),
185 |         ERROR_CLOCK_SKEW(18),
186 |         BEACON_GETCWD(19),
187 |         BEACON_OUTPUT_JOBS(20),
188 |         BEACON_OUTPUT_HASHES(21),
189 |         TODO(22),
190 |         SOCKS_ACCEPT(23),
191 |         BEACON_OUTPUT_NET(24),
192 |         BEACON_OUTPUT_PORTSCAN(25),
193 |         BEACON_EXIT(26),
194 |         OUTPUT(30),
195 |         ;
196 | 
197 |         private final static Map<Integer, CallbackType> mapping;
198 |         private int packetType;
199 |         CallbackType(int packetType) {
200 |             this.packetType = packetType;
201 |         }
202 | 
203 |         public int getId() {
204 |             return packetType;
205 |         }
206 | 
207 |         static {
208 |             mapping = new HashMap<>();
209 |             for(var v: CallbackType.values()){
210 |                 mapping.put(v.packetType, v);
211 |             }
212 |         }
213 |     }
214 | }
215 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # PoC: Cobalt Strike DNS Beacon Parser
  2 | 
  3 | ## Get queries
  4 | 
  5 | Create a file called  `queries.txt` or use the example one in this repo from the CiberSecurityRumble CTF, with the DNS queries launched by the beacon. Example:
  6 | 
  7 | ```Text
  8 | api.03dd750ef.19997cf2.wallet.thedarkestside.org
  9 | api.13dd750ef.19997cf2.wallet.thedarkestside.org
 10 | post.1270.0479c52e5.19997cf2.wallet.thedarkestside.org
 11 | post.3657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa.4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1.7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258.1479c52e5.19997cf2.wallet.thedarkestside.org
 12 | post.39acfcd9773cbb3083f55654737ab525e8fde1a8c3928fa6a147d3971.751e83955b70226bbe97f4a96c467e90b9ac0f0e344970c9ce02662d.dd9b02991a44408b84dadbfa7b8ff592e7ef9befe704211b86f24bba.2479c52e5.19997cf2.wallet.thedarkestside.org
 13 | ```
 14 | 
 15 | To create this queries file from a PCAP source you could use the following command:
 16 | 
 17 | ```
 18 | tshark -nr <your_capture.pcap> -Y "dns.flags.response == 0 && ip.dst == <C2 Cobalt Strike IP>" -T fields -e dns.qry.name > queries.txt
 19 | ```
 20 | ## Get keys
 21 | 
 22 | Use DidierStevens cs-extract-key.py tool to get the keys used by the beacon using its memory dump. If possible specify an example query using the `t` parameter. 
 23 | 
 24 | Example: if you have the following queries:
 25 | ```
 26 | post.140.009842910.19997cf2.wallet.thedarkestside.org
 27 | post.2942880f933a45cf2d048b0c14917493df0cd10a0de26ea103d0eb1b3.4adf28c63a97deb5cbe4e20b26902d1ef427957323967835f7d18a42.109842910.19997cf2.wallet.thedarkestside.org
 28 | post.1debfa06ab4786477.209842910.19997cf2.wallet.thedarkestside.org
 29 | ```
 30 | 
 31 | Execute the tool as:  
 32 | ```
 33 | python3 cs-extract-key.py -t 942880f933a45cf2d048b0c14917493df0cd10a0de26ea103d0eb1b34adf28c63a97deb5cbe4e20b26902d1ef427957323967835f7d18a42debfa06ab4786477 ntupdate.exe_211110_145816.dmp
 34 | ``` 
 35 | 
 36 | First query is ignored as it only tells us the length (40), remove first number from the first segment of each subsecuent query.
 37 | 
 38 | Example output:
 39 | ```
 40 | AES key position: 0x00183225
 41 | AES Key:  550ae29838b3dc28580d6c0ff196deb2
 42 | HMAC key position: 0x00183235
 43 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 44 | SHA256 raw key: 0e33af5bf19fe0161e0ba978006670e8:550ae29838b3dc28580d6c0ff196deb2
 45 | HMAC key position: 0x002400e5
 46 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 47 | HMAC key position: 0x00240775
 48 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 49 | Searching for raw key
 50 | Searching after sha256\x00 string (0x17c9e9)
 51 | AES key position: 0x00183225
 52 | AES Key:  550ae29838b3dc28580d6c0ff196deb2
 53 | HMAC key position: 0x00183235
 54 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 55 | HMAC key position: 0x002400e5
 56 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 57 | HMAC key position: 0x00240775
 58 | HMAC Key: 0e33af5bf19fe0161e0ba978006670e8
 59 | ```
 60 | 
 61 | ## Compile and run this tool
 62 | 
 63 | Requisites: any Java 17 (example: openjdk-17-jdk) and Maven
 64 | 
 65 | Compiling: 
 66 | ```bash
 67 | mvn clean package
 68 | ```
 69 | 
 70 | Running tool:
 71 | ```bash
 72 | java -jar target/cs-dns-parser-1.0-SNAPSHOT.jar [aeskey] [hmackey]
 73 | ```
 74 | 
 75 | Example: 
 76 | ```bash
 77 | java -jar target/cs-dns-parser-1.0-SNAPSHOT.jar 550ae29838b3dc28580d6c0ff196deb2 0e33af5bf19fe0161e0ba978006670e8
 78 | ```
 79 | 
 80 | Example output:
 81 | ```
 82 | [WARNING] Unknown query types found: [www, api, cdn, 19997cf2]
 83 | 
 84 | >>>>>>> Id: 09842910 >>>>>> 
 85 | Type: OUTPUT
 86 | Raw data: brightsoul\bvitalik
 87 | 
 88 | <<<<<<<<<<<<<<<<<<<
 89 | 
 90 | >>>>>>> Id: 736378dc >>>>>> 
 91 | Type: TODO
 92 | Raw data: ����C:\users\*
 93 | D	0	11/10/2021 11:27:45	.
 94 | D	0	11/10/2021 11:27:45	..
 95 | D	0	11/10/2021 14:40:51	Administrator
 96 | D	0	12/07/2019 09:30:39	All Users
 97 | D	0	11/10/2021 14:24:32	bvitalik
 98 | D	0	11/10/2021 12:01:17	Default
 99 | D	0	12/07/2019 09:30:39	Default User
100 | D	0	11/10/2021 11:01:21	defaultuser0
101 | F	174	12/07/2019 09:12:42	desktop.ini
102 | D	0	11/10/2021 11:12:46	Kevin
103 | D	0	11/10/2021 11:11:19	Public
104 | 
105 | <<<<<<<<<<<<<<<<<<<
106 | 
107 | >>>>>>> Id: 1b902135 >>>>>> 
108 | Type: BEACON_GETCWD
109 | Raw data: C:\users
110 | <<<<<<<<<<<<<<<<<<<
111 | 
112 | >>>>>>> Id: 479c52e5 >>>>>> 
113 | Type: OUTPUT
114 | Raw data: 
115 | PRIVILEGES INFORMATION
116 | ----------------------
117 | 
118 | Privilege Name                Description                          State   
119 | ============================= ==================================== ========
120 | SeShutdownPrivilege           Shut down the system                 Disabled
121 | SeChangeNotifyPrivilege       Bypass traverse checking             Enabled 
122 | SeUndockPrivilege             Remove computer from docking station Disabled
123 | SeIncreaseWorkingSetPrivilege Increase a process working set       Disabled
124 | SeTimeZonePrivilege           Change the time zone                 Disabled
125 | 
126 | <<<<<<<<<<<<<<<<<<<
127 | 
128 | WARNING: Invalid HMAC, skipping packet
129 | >>>>>>> Id: 1b6b6338 >>>>>> 
130 | Skipped processing
131 | <<<<<<<<<<<<<<<<<<<
132 | 
133 | >>>>>>> Id: 2ef72274 >>>>>> 
134 | Type: BEACON_GETCWD
135 | Raw data: C:\users\bvitalik
136 | <<<<<<<<<<<<<<<<<<<
137 | 
138 | >>>>>>> Id: 50f011be >>>>>> 
139 | Type: OUTPUT
140 | Raw data: pragma solidity ^0.8.3;
141 | 
142 | contract FixHighTransferFees {
143 |     string public greet = "Vitalik's Solidity test";
144 |     string public privateKey = "CSR{Schro3dinger%%3quation_}";
145 | 
146 |     //TODO: everything
147 | }
148 | <<<<<<<<<<<<<<<<<<<
149 | 
150 | >>>>>>> Id: 337c3537 >>>>>> 
151 | Type: OUTPUT
152 | Raw data: WKSTN1
153 | 
154 | <<<<<<<<<<<<<<<<<<<
155 | 
156 | 
157 | Process finished with exit code 0
158 | 
159 | ```
160 | 
161 | ## Query format explanation
162 | 
163 | The query uses the following format:
164 | ```
165 | $configurableprefix.$N$part1.$part2.$partN.$conversationCounter$conversationID.$beaconID.domain
166 | ```
167 | 
168 | ### Configurable prefix
169 | In the previous example the configurable prefix is `post`, can be changed in the malleable profile.
170 | 
171 | ```
172 | set beacon               "doc.bc.";
173 | set get_A                "doc.1a.";
174 | set get_AAAA             "doc.4a.";
175 | set get_TXT              "doc.tx.";
176 | set put_metadata         "doc.md.";
177 | set put_output           "doc.po.";
178 |  ```
179 | ### N and Parts
180 | Number of subdomains to be parsed as data. In the query `post.1270.0479c52e5.19997cf2.wallet.thedarkestside.org`, it is `1`, and the data would be `270`. Becouse this is the first query of the conversation, the `270` represents the total size of the encrypted data in bytes.
181 | 
182 | In the next queries:
183 | ```
184 | post.3657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa.4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1.7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258.1479c52e5.19997cf2.wallet.thedarkestside.org
185 | post.39acfcd9773cbb3083f55654737ab525e8fde1a8c3928fa6a147d3971.751e83955b70226bbe97f4a96c467e90b9ac0f0e344970c9ce02662d.dd9b02991a44408b84dadbfa7b8ff592e7ef9befe704211b86f24bba.2479c52e5.19997cf2.wallet.thedarkestside.org
186 | ```
187 | 
188 | the 3 means there are three data segments (`[657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa, 4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1, 7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258]` in the first query).
189 | 
190 | After joining all data for conversation `479c52e5` we get a length of `270`, matching the stated previously.
191 | 
192 | 
193 | ### Conversation Counter and ConversationID
194 | Identify the conversation and the packet order of the queries.
195 | Using the same example as before:
196 | ```
197 | post.1270.0479c52e5.19997cf2.wallet.thedarkestside.org
198 | post.3657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa.4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1.7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258.1479c52e5.19997cf2.wallet.thedarkestside.org
199 | post.39acfcd9773cbb3083f55654737ab525e8fde1a8c3928fa6a147d3971.751e83955b70226bbe97f4a96c467e90b9ac0f0e344970c9ce02662d.dd9b02991a44408b84dadbfa7b8ff592e7ef9befe704211b86f24bba.2479c52e5.19997cf2.wallet.thedarkestside.org
200 | ```
201 | ConvesationId is `479c52e5`, and the packets are already ordered (0,1,2).
202 | 
203 | ### BeaconID
204 | 
205 | Identifies which AES and HMAC keys to use in the team server to decrypt and validate the messages. A rawkey is transmitted when the beacon sends the metadata petition, encrypted using the teamserver public key. The AES and HMAC keys are derived from this rawkey.
206 | 
207 | Using the same example as before:
208 | ```
209 | post.1270.0479c52e5.19997cf2.wallet.thedarkestside.org
210 | post.3657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa.4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1.7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258.1479c52e5.19997cf2.wallet.thedarkestside.org
211 | post.39acfcd9773cbb3083f55654737ab525e8fde1a8c3928fa6a147d3971.751e83955b70226bbe97f4a96c467e90b9ac0f0e344970c9ce02662d.dd9b02991a44408b84dadbfa7b8ff592e7ef9befe704211b86f24bba.2479c52e5.19997cf2.wallet.thedarkestside.org
212 | ```
213 | The beaconId would be: `19997cf2`.
214 | 
215 | ### Domain 
216 | Domain registered by attackers to recieve the DNS queries and answer them. In our example: `.wallet.thedarkestside.org`
217 | 
218 | ## Acknowledgements
219 | 
220 | @SergioP3rez for the help solving the challenge and @DidierStevens for its Cobalt Strike tools and helpful blog posts.
221 | 


--------------------------------------------------------------------------------
/queries.txt:
--------------------------------------------------------------------------------
  1 | www.18fe5b3f8.35fc0511b.19997cf2.wallet.thedarkestside.org
  2 | api.030230df5.19997cf2.wallet.thedarkestside.org
  3 | api.130230df5.19997cf2.wallet.thedarkestside.org
  4 | 19997cf2.wallet.thedarkestside.org
  5 | 19997cf2.wallet.thedarkestside.org
  6 | 19997cf2.wallet.thedarkestside.org
  7 | 19997cf2.wallet.thedarkestside.org
  8 | 19997cf2.wallet.thedarkestside.org
  9 | 19997cf2.wallet.thedarkestside.org
 10 | api.07311917.19997cf2.wallet.thedarkestside.org
 11 | api.17311917.19997cf2.wallet.thedarkestside.org
 12 | post.140.009842910.19997cf2.wallet.thedarkestside.org
 13 | post.2942880f933a45cf2d048b0c14917493df0cd10a0de26ea103d0eb1b3.4adf28c63a97deb5cbe4e20b26902d1ef427957323967835f7d18a42.109842910.19997cf2.wallet.thedarkestside.org
 14 | post.1debfa06ab4786477.209842910.19997cf2.wallet.thedarkestside.org
 15 | 19997cf2.wallet.thedarkestside.org
 16 | 19997cf2.wallet.thedarkestside.org
 17 | 19997cf2.wallet.thedarkestside.org
 18 | 19997cf2.wallet.thedarkestside.org
 19 | 19997cf2.wallet.thedarkestside.org
 20 | 19997cf2.wallet.thedarkestside.org
 21 | api.0e640f32.19997cf2.wallet.thedarkestside.org
 22 | api.1e640f32.19997cf2.wallet.thedarkestside.org
 23 | 19997cf2.wallet.thedarkestside.org
 24 | 19997cf2.wallet.thedarkestside.org
 25 | 19997cf2.wallet.thedarkestside.org
 26 | 19997cf2.wallet.thedarkestside.org
 27 | 19997cf2.wallet.thedarkestside.org
 28 | 19997cf2.wallet.thedarkestside.org
 29 | 19997cf2.wallet.thedarkestside.org
 30 | 19997cf2.wallet.thedarkestside.org
 31 | 19997cf2.wallet.thedarkestside.org
 32 | 19997cf2.wallet.thedarkestside.org
 33 | 19997cf2.wallet.thedarkestside.org
 34 | 19997cf2.wallet.thedarkestside.org
 35 | 19997cf2.wallet.thedarkestside.org
 36 | 19997cf2.wallet.thedarkestside.org
 37 | 19997cf2.wallet.thedarkestside.org
 38 | 19997cf2.wallet.thedarkestside.org
 39 | 19997cf2.wallet.thedarkestside.org
 40 | api.0445a605a.19997cf2.wallet.thedarkestside.org
 41 | api.1445a605a.19997cf2.wallet.thedarkestside.org
 42 | post.11a0.0736378dc.19997cf2.wallet.thedarkestside.org
 43 | post.3692b2dc810eaed14da9e6eb724e1d71ebf1f0fe6bec1b0a17b577dc2.a033f421a94a97c3626101db9c1e56d3075dfbf777c70b40b4900c62.58b89b345511902bbc48655fa96894e7a0235eae53a02bd51273783e.1736378dc.19997cf2.wallet.thedarkestside.org
 44 | post.3cc0bf6c716cc8d6c4f356b03daa29891fd33f0831dba787abddd5e1b.bb3bce664fa6cca86690570c30d7953f64be34fd8c4800bf4e6634c4.ac03ecf9069a9eacb5b355379f2742c2c607f49673b5957febc0cc01.2736378dc.19997cf2.wallet.thedarkestside.org
 45 | post.3445cb7135adf41fbd2872bd250c1080634736eb2a6ed273bfc0e0349.ca9313883ba69fe375af25dab2297f15337807911831e3eb896a662f.214625fcec8c3d72e70cc78fa7993f42e404dee436b1f24f725ed6c7.3736378dc.19997cf2.wallet.thedarkestside.org
 46 | post.33fd2b0c01bb78732c6afaa03fdb896e03315e35464764972658913be.a7c300b7e553308c1869ede402da99c6e1ba0d3523e0c9ea38615ac1.098045813ca835e252bcb7dcc9d30c7015838823af680999087ca877.4736378dc.19997cf2.wallet.thedarkestside.org
 47 | post.22cd9d9930ff69184d78ae596dcc7daa1aea80e85526291ef326d4546.c9024440fe4879cb3c66698bbf31497aa7b4c88f67fc32e66da1bd14.5736378dc.19997cf2.wallet.thedarkestside.org
 48 | post.1a507eaa8b2ae5a4dc3df2df8c1d11c1fa6a8e366f3d36af4.6736378dc.19997cf2.wallet.thedarkestside.org
 49 | 19997cf2.wallet.thedarkestside.org
 50 | 19997cf2.wallet.thedarkestside.org
 51 | api.011a45ce3.19997cf2.wallet.thedarkestside.org
 52 | api.111a45ce3.19997cf2.wallet.thedarkestside.org
 53 | 19997cf2.wallet.thedarkestside.org
 54 | 19997cf2.wallet.thedarkestside.org
 55 | 19997cf2.wallet.thedarkestside.org
 56 | 19997cf2.wallet.thedarkestside.org
 57 | 19997cf2.wallet.thedarkestside.org
 58 | 19997cf2.wallet.thedarkestside.org
 59 | 19997cf2.wallet.thedarkestside.org
 60 | 19997cf2.wallet.thedarkestside.org
 61 | 19997cf2.wallet.thedarkestside.org
 62 | 19997cf2.wallet.thedarkestside.org
 63 | 19997cf2.wallet.thedarkestside.org
 64 | 19997cf2.wallet.thedarkestside.org
 65 | 19997cf2.wallet.thedarkestside.org
 66 | 19997cf2.wallet.thedarkestside.org
 67 | 19997cf2.wallet.thedarkestside.org
 68 | 19997cf2.wallet.thedarkestside.org
 69 | 19997cf2.wallet.thedarkestside.org
 70 | api.046cd40cb.19997cf2.wallet.thedarkestside.org
 71 | api.146cd40cb.19997cf2.wallet.thedarkestside.org
 72 | post.130.01b902135.19997cf2.wallet.thedarkestside.org
 73 | post.2d195d35695d92484de7c5ec120e69b4d488d5c7c3de95c4a.ef3c54f0cfd699db3850445febf2528cf7986b4710738a32.11b902135.19997cf2.wallet.thedarkestside.org
 74 | 19997cf2.wallet.thedarkestside.org
 75 | 19997cf2.wallet.thedarkestside.org
 76 | api.03dd750ef.19997cf2.wallet.thedarkestside.org
 77 | api.13dd750ef.19997cf2.wallet.thedarkestside.org
 78 | post.1270.0479c52e5.19997cf2.wallet.thedarkestside.org
 79 | post.3657d50d5ae8ba94f41aa8e08b0b338fc7433937e55450fa1743b2baa.4bb997434d5f7eb8af5764d51d5d49a3abdaa2adc52fb9471a0e61e1.7714853c0b76b77c5f9ae4e2c00d5dd33dcaa26eeb429b3d98aa0258.1479c52e5.19997cf2.wallet.thedarkestside.org
 80 | post.39acfcd9773cbb3083f55654737ab525e8fde1a8c3928fa6a147d3971.751e83955b70226bbe97f4a96c467e90b9ac0f0e344970c9ce02662d.dd9b02991a44408b84dadbfa7b8ff592e7ef9befe704211b86f24bba.2479c52e5.19997cf2.wallet.thedarkestside.org
 81 | post.3efaf049a12e7497f2e4ca65b0b31db2a4b741db8126763b1c594260e.63367de1916bd52a3a6e1a0735d9817825b88d9539a3a132ce702de4.2237bc19b2ff6e0776d3595ac25643e76ac1020257c1731b8824d432.3479c52e5.19997cf2.wallet.thedarkestside.org
 82 | post.399d47dac73f3018f65798cc16805c44004f1c24fa8957601b5d4abf2.af0df5d782def5ae7abefee144d425cd18287fcaac7f51342fbc9f1c.6552da3b78cf764f83b20bee8c7e46bb14831e5167024378bed4d30c.4479c52e5.19997cf2.wallet.thedarkestside.org
 83 | post.3de5c228c86f50a380fb3ef9c846bd73dfc735b40241d95e11bea4916.332a363a5ed760ea6f4cad5113eab0a7e8067b692173c0e8c2df364a.a1234ef00d0493ec5c84df5186b45031919fc7ad9dc6463643bffc89.5479c52e5.19997cf2.wallet.thedarkestside.org
 84 | post.3a23ac5238f941933b32d089c0f58ed10d1e7d05f4c862de9cacd6496.df73877d4891230883f90cbc0d6f5687d2b6235ea1f32e645730eadc.0417b0e5100e1d109902eb997b1f5262e1d4b08d456865f637b47709.6479c52e5.19997cf2.wallet.thedarkestside.org
 85 | post.3e0bb8c42822876c2e016082feb170dbb8a8fb87a1bacfd561f27a7ef.536249e1ba057a2e30622c21d3d4f466b8a4141b4a7282e12acec5be.3e5dbd0d7dcdd4c8f7d3af7a7d3a7d3199df12bc84102d35429d7df8.7479c52e5.19997cf2.wallet.thedarkestside.org
 86 | post.123c06a374f3f837f1b49b244ea260e6316043b9211d53e464eb0c5ff.8479c52e5.19997cf2.wallet.thedarkestside.org
 87 | post.10682301d8e063fed.9479c52e5.19997cf2.wallet.thedarkestside.org
 88 | 19997cf2.wallet.thedarkestside.org
 89 | 19997cf2.wallet.thedarkestside.org
 90 | 19997cf2.wallet.thedarkestside.org
 91 | 19997cf2.wallet.thedarkestside.org
 92 | 19997cf2.wallet.thedarkestside.org
 93 | 19997cf2.wallet.thedarkestside.org
 94 | cdn.0259148a9.19997cf2.wallet.thedarkestside.org
 95 | cdn.1259148a9.19997cf2.wallet.thedarkestside.org
 96 | cdn.2259148a9.19997cf2.wallet.thedarkestside.org
 97 | cdn.3259148a9.19997cf2.wallet.thedarkestside.org
 98 | cdn.4259148a9.19997cf2.wallet.thedarkestside.org
 99 | cdn.5259148a9.19997cf2.wallet.thedarkestside.org
100 | cdn.6259148a9.19997cf2.wallet.thedarkestside.org
101 | cdn.7259148a9.19997cf2.wallet.thedarkestside.org
102 | cdn.8259148a9.19997cf2.wallet.thedarkestside.org
103 | cdn.9259148a9.19997cf2.wallet.thedarkestside.org
104 | cdn.a259148a9.19997cf2.wallet.thedarkestside.org
105 | cdn.b259148a9.19997cf2.wallet.thedarkestside.org
106 | cdn.c259148a9.19997cf2.wallet.thedarkestside.org
107 | 19997cf2.wallet.thedarkestside.org
108 | 19997cf2.wallet.thedarkestside.org
109 | 19997cf2.wallet.thedarkestside.org
110 | cdn.063fb4267.19997cf2.wallet.thedarkestside.org
111 | cdn.163fb4267.19997cf2.wallet.thedarkestside.org
112 | cdn.263fb4267.19997cf2.wallet.thedarkestside.org
113 | cdn.363fb4267.19997cf2.wallet.thedarkestside.org
114 | cdn.463fb4267.19997cf2.wallet.thedarkestside.org
115 | cdn.563fb4267.19997cf2.wallet.thedarkestside.org
116 | cdn.663fb4267.19997cf2.wallet.thedarkestside.org
117 | cdn.763fb4267.19997cf2.wallet.thedarkestside.org
118 | cdn.863fb4267.19997cf2.wallet.thedarkestside.org
119 | cdn.963fb4267.19997cf2.wallet.thedarkestside.org
120 | cdn.a63fb4267.19997cf2.wallet.thedarkestside.org
121 | cdn.b63fb4267.19997cf2.wallet.thedarkestside.org
122 | cdn.c63fb4267.19997cf2.wallet.thedarkestside.org
123 | post.16f0.01b6b6338.19997cf2.wallet.thedarkestside.org
124 | post.111e1ef4f.11b6b6338.19997cf2.wallet.thedarkestside.org
125 | post.1e429d10e.21b6b6338.19997cf2.wallet.thedarkestside.org
126 | post.1ff69f44e.31b6b6338.19997cf2.wallet.thedarkestside.org
127 | post.1da881fde.41b6b6338.19997cf2.wallet.thedarkestside.org
128 | post.13eaf8501.51b6b6338.19997cf2.wallet.thedarkestside.org
129 | post.1de54aec2.61b6b6338.19997cf2.wallet.thedarkestside.org
130 | post.1aff8506f.71b6b6338.19997cf2.wallet.thedarkestside.org
131 | post.165a5b0fe.81b6b6338.19997cf2.wallet.thedarkestside.org
132 | post.138591922.91b6b6338.19997cf2.wallet.thedarkestside.org
133 | post.1f79dc60b.a1b6b6338.19997cf2.wallet.thedarkestside.org
134 | post.12a46447b.b1b6b6338.19997cf2.wallet.thedarkestside.org
135 | post.1ae2aa0f3.c1b6b6338.19997cf2.wallet.thedarkestside.org
136 | post.1245e2d8d.d1b6b6338.19997cf2.wallet.thedarkestside.org
137 | post.1d0a7df5c.e1b6b6338.19997cf2.wallet.thedarkestside.org
138 | post.116a2cd07.f1b6b6338.19997cf2.wallet.thedarkestside.org
139 | post.19cb104a1.101b6b6338.19997cf2.wallet.thedarkestside.org
140 | post.1003934fc.111b6b6338.19997cf2.wallet.thedarkestside.org
141 | post.1237dd018.121b6b6338.19997cf2.wallet.thedarkestside.org
142 | post.1b5fb82ea.131b6b6338.19997cf2.wallet.thedarkestside.org
143 | post.1acd54659.141b6b6338.19997cf2.wallet.thedarkestside.org
144 | post.1ecd06664.151b6b6338.19997cf2.wallet.thedarkestside.org
145 | post.1cfe3117a.161b6b6338.19997cf2.wallet.thedarkestside.org
146 | post.1984c9749.171b6b6338.19997cf2.wallet.thedarkestside.org
147 | post.17314c2a5.181b6b6338.19997cf2.wallet.thedarkestside.org
148 | post.14471c4d8.191b6b6338.19997cf2.wallet.thedarkestside.org
149 | post.1e42c02bf.1a1b6b6338.19997cf2.wallet.thedarkestside.org
150 | post.1115b5e8b.1b1b6b6338.19997cf2.wallet.thedarkestside.org
151 | post.1f017fb9f.1c1b6b6338.19997cf2.wallet.thedarkestside.org
152 | post.14bccc8f7.1d1b6b6338.19997cf2.wallet.thedarkestside.org
153 | post.1cfe142a4.1e1b6b6338.19997cf2.wallet.thedarkestside.org
154 | post.1533d365d.1f1b6b6338.19997cf2.wallet.thedarkestside.org
155 | post.1864a3b86.201b6b6338.19997cf2.wallet.thedarkestside.org
156 | post.1f0dea8ea.211b6b6338.19997cf2.wallet.thedarkestside.org
157 | post.115f38416.221b6b6338.19997cf2.wallet.thedarkestside.org
158 | post.1f56801ba.231b6b6338.19997cf2.wallet.thedarkestside.org
159 | post.126e4aaed.241b6b6338.19997cf2.wallet.thedarkestside.org
160 | post.1d7a9edd9.251b6b6338.19997cf2.wallet.thedarkestside.org
161 | post.19bfd54ad.261b6b6338.19997cf2.wallet.thedarkestside.org
162 | post.1088c80e7.271b6b6338.19997cf2.wallet.thedarkestside.org
163 | post.17e6f1f15.281b6b6338.19997cf2.wallet.thedarkestside.org
164 | post.165d99d02.291b6b6338.19997cf2.wallet.thedarkestside.org
165 | post.1949233f3.2a1b6b6338.19997cf2.wallet.thedarkestside.org
166 | post.1a0d0b848.2b1b6b6338.19997cf2.wallet.thedarkestside.org
167 | post.1b8987267.2c1b6b6338.19997cf2.wallet.thedarkestside.org
168 | post.184f79e69.2d1b6b6338.19997cf2.wallet.thedarkestside.org
169 | post.1fe743f15.2e1b6b6338.19997cf2.wallet.thedarkestside.org
170 | post.18c98fc05.2f1b6b6338.19997cf2.wallet.thedarkestside.org
171 | post.121016f7e.301b6b6338.19997cf2.wallet.thedarkestside.org
172 | post.1a996fa08.311b6b6338.19997cf2.wallet.thedarkestside.org
173 | post.1900a3c61.321b6b6338.19997cf2.wallet.thedarkestside.org
174 | post.16319d6b7.331b6b6338.19997cf2.wallet.thedarkestside.org
175 | post.1e0772a78.341b6b6338.19997cf2.wallet.thedarkestside.org
176 | post.1abfdc5e0.351b6b6338.19997cf2.wallet.thedarkestside.org
177 | post.12b7c1928.361b6b6338.19997cf2.wallet.thedarkestside.org
178 | post.1e944d05e.371b6b6338.19997cf2.wallet.thedarkestside.org
179 | post.1df1707a8.381b6b6338.19997cf2.wallet.thedarkestside.org
180 | post.192954710.391b6b6338.19997cf2.wallet.thedarkestside.org
181 | post.15d6e7d85.3a1b6b6338.19997cf2.wallet.thedarkestside.org
182 | post.1c2639d18.3b1b6b6338.19997cf2.wallet.thedarkestside.org
183 | post.15077c713.3c1b6b6338.19997cf2.wallet.thedarkestside.org
184 | post.1860681fd.3d1b6b6338.19997cf2.wallet.thedarkestside.org
185 | post.11f69c715.3e1b6b6338.19997cf2.wallet.thedarkestside.org
186 | post.104fda1bb.3f1b6b6338.19997cf2.wallet.thedarkestside.org
187 | post.14e468e06.401b6b6338.19997cf2.wallet.thedarkestside.org
188 | post.14e15a72d.411b6b6338.19997cf2.wallet.thedarkestside.org
189 | post.157ceb127.421b6b6338.19997cf2.wallet.thedarkestside.org
190 | post.19e30d9f1.431b6b6338.19997cf2.wallet.thedarkestside.org
191 | post.10f95b354.441b6b6338.19997cf2.wallet.thedarkestside.org
192 | post.158f0c833.451b6b6338.19997cf2.wallet.thedarkestside.org
193 | post.133ac072b.461b6b6338.19997cf2.wallet.thedarkestside.org
194 | post.156ee3d27.471b6b6338.19997cf2.wallet.thedarkestside.org
195 | post.1f2ae2f07.481b6b6338.19997cf2.wallet.thedarkestside.org
196 | post.1f6390cfa.491b6b6338.19997cf2.wallet.thedarkestside.org
197 | post.1695fa6b5.4a1b6b6338.19997cf2.wallet.thedarkestside.org
198 | post.11cecafdf.4b1b6b6338.19997cf2.wallet.thedarkestside.org
199 | post.1cd63d16b.4c1b6b6338.19997cf2.wallet.thedarkestside.org
200 | post.118abe1ef.4d1b6b6338.19997cf2.wallet.thedarkestside.org
201 | post.1f30692aa.4e1b6b6338.19997cf2.wallet.thedarkestside.org
202 | post.18e60e78c.4f1b6b6338.19997cf2.wallet.thedarkestside.org
203 | post.1f46c5aac.501b6b6338.19997cf2.wallet.thedarkestside.org
204 | post.19e6b9673.511b6b6338.19997cf2.wallet.thedarkestside.org
205 | post.11b5d9117.521b6b6338.19997cf2.wallet.thedarkestside.org
206 | post.1c39289fe.531b6b6338.19997cf2.wallet.thedarkestside.org
207 | post.117bc6269.541b6b6338.19997cf2.wallet.thedarkestside.org
208 | post.11c9c3ca2.551b6b6338.19997cf2.wallet.thedarkestside.org
209 | post.188e1df87.561b6b6338.19997cf2.wallet.thedarkestside.org
210 | post.1f0acfab0.571b6b6338.19997cf2.wallet.thedarkestside.org
211 | post.1d954558f.581b6b6338.19997cf2.wallet.thedarkestside.org
212 | post.18a89f19d.591b6b6338.19997cf2.wallet.thedarkestside.org
213 | post.1c6e64d7a.5a1b6b6338.19997cf2.wallet.thedarkestside.org
214 | post.1c1de4646.5b1b6b6338.19997cf2.wallet.thedarkestside.org
215 | post.12c7776da.5c1b6b6338.19997cf2.wallet.thedarkestside.org
216 | post.1001340b9.5d1b6b6338.19997cf2.wallet.thedarkestside.org
217 | post.1d0f61688.5e1b6b6338.19997cf2.wallet.thedarkestside.org
218 | post.1eb5b6f25.5f1b6b6338.19997cf2.wallet.thedarkestside.org
219 | post.1c61171b5.601b6b6338.19997cf2.wallet.thedarkestside.org
220 | post.1f765cb90.611b6b6338.19997cf2.wallet.thedarkestside.org
221 | post.1f085805e.621b6b6338.19997cf2.wallet.thedarkestside.org
222 | post.1e18eb9fa.631b6b6338.19997cf2.wallet.thedarkestside.org
223 | post.120c17bc2.641b6b6338.19997cf2.wallet.thedarkestside.org
224 | post.1e2a2ae99.651b6b6338.19997cf2.wallet.thedarkestside.org
225 | post.1dc947bab.661b6b6338.19997cf2.wallet.thedarkestside.org
226 | post.1a342b144.671b6b6338.19997cf2.wallet.thedarkestside.org
227 | post.18e5da8ac.681b6b6338.19997cf2.wallet.thedarkestside.org
228 | post.1973a93ca.691b6b6338.19997cf2.wallet.thedarkestside.org
229 | post.1b10e1feb.6a1b6b6338.19997cf2.wallet.thedarkestside.org
230 | post.124824caa.6b1b6b6338.19997cf2.wallet.thedarkestside.org
231 | post.1a89f9dbb.6c1b6b6338.19997cf2.wallet.thedarkestside.org
232 | post.112414b09.6d1b6b6338.19997cf2.wallet.thedarkestside.org
233 | post.159021fdd.6e1b6b6338.19997cf2.wallet.thedarkestside.org
234 | post.16c061c60.6f1b6b6338.19997cf2.wallet.thedarkestside.org
235 | post.144cfc48a.701b6b6338.19997cf2.wallet.thedarkestside.org
236 | post.181c8ff98.711b6b6338.19997cf2.wallet.thedarkestside.org
237 | post.18d573919.721b6b6338.19997cf2.wallet.thedarkestside.org
238 | post.13a56525b.731b6b6338.19997cf2.wallet.thedarkestside.org
239 | post.19e11c34a.741b6b6338.19997cf2.wallet.thedarkestside.org
240 | post.13998b4a3.751b6b6338.19997cf2.wallet.thedarkestside.org
241 | post.1e834d64e.761b6b6338.19997cf2.wallet.thedarkestside.org
242 | post.1d5102686.771b6b6338.19997cf2.wallet.thedarkestside.org
243 | post.1cc1e4394.781b6b6338.19997cf2.wallet.thedarkestside.org
244 | post.18d8c00bd.791b6b6338.19997cf2.wallet.thedarkestside.org
245 | post.138b3690c.7a1b6b6338.19997cf2.wallet.thedarkestside.org
246 | post.1d63f8703.7b1b6b6338.19997cf2.wallet.thedarkestside.org
247 | post.152510b10.7c1b6b6338.19997cf2.wallet.thedarkestside.org
248 | post.1b4b95303.7d1b6b6338.19997cf2.wallet.thedarkestside.org
249 | post.1af9dffba.7e1b6b6338.19997cf2.wallet.thedarkestside.org
250 | post.1dff51f62.7f1b6b6338.19997cf2.wallet.thedarkestside.org
251 | post.1f04d3733.801b6b6338.19997cf2.wallet.thedarkestside.org
252 | post.15aaad9ab.811b6b6338.19997cf2.wallet.thedarkestside.org
253 | post.1ab50c4bc.821b6b6338.19997cf2.wallet.thedarkestside.org
254 | post.18bfe379a.831b6b6338.19997cf2.wallet.thedarkestside.org
255 | post.12da6332d.841b6b6338.19997cf2.wallet.thedarkestside.org
256 | post.1af2658dd.851b6b6338.19997cf2.wallet.thedarkestside.org
257 | post.170d82059.861b6b6338.19997cf2.wallet.thedarkestside.org
258 | post.1e08c211c.871b6b6338.19997cf2.wallet.thedarkestside.org
259 | post.13c427983.881b6b6338.19997cf2.wallet.thedarkestside.org
260 | post.1f6ddb275.891b6b6338.19997cf2.wallet.thedarkestside.org
261 | post.1df8e4d71.8a1b6b6338.19997cf2.wallet.thedarkestside.org
262 | post.183ceba59.8b1b6b6338.19997cf2.wallet.thedarkestside.org
263 | post.146e9e3ab.8c1b6b6338.19997cf2.wallet.thedarkestside.org
264 | post.18d7cfad6.8d1b6b6338.19997cf2.wallet.thedarkestside.org
265 | post.178a586a3.8e1b6b6338.19997cf2.wallet.thedarkestside.org
266 | post.19e3e237e.8f1b6b6338.19997cf2.wallet.thedarkestside.org
267 | post.1fb8e9e99.901b6b6338.19997cf2.wallet.thedarkestside.org
268 | post.18639da72.911b6b6338.19997cf2.wallet.thedarkestside.org
269 | post.128536c2f.921b6b6338.19997cf2.wallet.thedarkestside.org
270 | post.15652fd7c.931b6b6338.19997cf2.wallet.thedarkestside.org
271 | post.1b52a6e99.941b6b6338.19997cf2.wallet.thedarkestside.org
272 | post.17913a692.951b6b6338.19997cf2.wallet.thedarkestside.org
273 | post.1a55e386d.961b6b6338.19997cf2.wallet.thedarkestside.org
274 | post.12d8e0f06.971b6b6338.19997cf2.wallet.thedarkestside.org
275 | post.19d1a3686.981b6b6338.19997cf2.wallet.thedarkestside.org
276 | post.1d4fd4229.991b6b6338.19997cf2.wallet.thedarkestside.org
277 | post.149bdbfc5.9a1b6b6338.19997cf2.wallet.thedarkestside.org
278 | post.1e9b443ca.9b1b6b6338.19997cf2.wallet.thedarkestside.org
279 | post.1cf95adc6.9c1b6b6338.19997cf2.wallet.thedarkestside.org
280 | post.1f6b873a1.9d1b6b6338.19997cf2.wallet.thedarkestside.org
281 | post.1f0decac6.9e1b6b6338.19997cf2.wallet.thedarkestside.org
282 | post.14fc80164.9f1b6b6338.19997cf2.wallet.thedarkestside.org
283 | post.1f03fc5ab.a01b6b6338.19997cf2.wallet.thedarkestside.org
284 | post.1f1dc80df.a11b6b6338.19997cf2.wallet.thedarkestside.org
285 | post.118c7f761.a21b6b6338.19997cf2.wallet.thedarkestside.org
286 | post.143a96147.a31b6b6338.19997cf2.wallet.thedarkestside.org
287 | post.1fd723420.a41b6b6338.19997cf2.wallet.thedarkestside.org
288 | post.11bd91ff4.a51b6b6338.19997cf2.wallet.thedarkestside.org
289 | post.174838e79.a61b6b6338.19997cf2.wallet.thedarkestside.org
290 | post.1401b6a1c.a71b6b6338.19997cf2.wallet.thedarkestside.org
291 | post.1e3d7626c.a81b6b6338.19997cf2.wallet.thedarkestside.org
292 | post.11a46c19d.a91b6b6338.19997cf2.wallet.thedarkestside.org
293 | post.103160d43.aa1b6b6338.19997cf2.wallet.thedarkestside.org
294 | post.1db367372.ab1b6b6338.19997cf2.wallet.thedarkestside.org
295 | post.1e0c0bace.ac1b6b6338.19997cf2.wallet.thedarkestside.org
296 | post.19b383e99.ad1b6b6338.19997cf2.wallet.thedarkestside.org
297 | post.1cccc2a1c.ae1b6b6338.19997cf2.wallet.thedarkestside.org
298 | post.1d422749c.af1b6b6338.19997cf2.wallet.thedarkestside.org
299 | post.1d2ca9f7f.b01b6b6338.19997cf2.wallet.thedarkestside.org
300 | post.120df48e1.b11b6b6338.19997cf2.wallet.thedarkestside.org
301 | post.12c50a218.b21b6b6338.19997cf2.wallet.thedarkestside.org
302 | post.1eaf22e67.b31b6b6338.19997cf2.wallet.thedarkestside.org
303 | post.177e97313.b41b6b6338.19997cf2.wallet.thedarkestside.org
304 | post.19abf587a.b51b6b6338.19997cf2.wallet.thedarkestside.org
305 | post.1ad4460a6.b61b6b6338.19997cf2.wallet.thedarkestside.org
306 | post.1616c709e.b71b6b6338.19997cf2.wallet.thedarkestside.org
307 | post.15e40764c.b81b6b6338.19997cf2.wallet.thedarkestside.org
308 | post.1330231f1.b91b6b6338.19997cf2.wallet.thedarkestside.org
309 | post.1b384efa5.ba1b6b6338.19997cf2.wallet.thedarkestside.org
310 | post.17383d9e1.bb1b6b6338.19997cf2.wallet.thedarkestside.org
311 | post.1cb9ccf67.bc1b6b6338.19997cf2.wallet.thedarkestside.org
312 | post.1b25f44fa.bd1b6b6338.19997cf2.wallet.thedarkestside.org
313 | post.1b822dc92.be1b6b6338.19997cf2.wallet.thedarkestside.org
314 | post.19d34cdcb.bf1b6b6338.19997cf2.wallet.thedarkestside.org
315 | post.14e63d9aa.c01b6b6338.19997cf2.wallet.thedarkestside.org
316 | post.130850b47.c11b6b6338.19997cf2.wallet.thedarkestside.org
317 | post.1aef4f6ad.c21b6b6338.19997cf2.wallet.thedarkestside.org
318 | post.12340d1c4.c31b6b6338.19997cf2.wallet.thedarkestside.org
319 | post.1091d6644.c41b6b6338.19997cf2.wallet.thedarkestside.org
320 | post.15211992f.c51b6b6338.19997cf2.wallet.thedarkestside.org
321 | post.19593f42e.c61b6b6338.19997cf2.wallet.thedarkestside.org
322 | post.1060a2b37.c71b6b6338.19997cf2.wallet.thedarkestside.org
323 | post.1bef7d248.c81b6b6338.19997cf2.wallet.thedarkestside.org
324 | post.138679f48.c91b6b6338.19997cf2.wallet.thedarkestside.org
325 | post.122a7eab2.ca1b6b6338.19997cf2.wallet.thedarkestside.org
326 | post.1768867ad.cb1b6b6338.19997cf2.wallet.thedarkestside.org
327 | post.1ef1f508e.cc1b6b6338.19997cf2.wallet.thedarkestside.org
328 | post.17c60c658.cd1b6b6338.19997cf2.wallet.thedarkestside.org
329 | post.18a93b5a6.ce1b6b6338.19997cf2.wallet.thedarkestside.org
330 | post.11def7471.cf1b6b6338.19997cf2.wallet.thedarkestside.org
331 | post.1f9278fd8.d01b6b6338.19997cf2.wallet.thedarkestside.org
332 | post.172c86d86.d11b6b6338.19997cf2.wallet.thedarkestside.org
333 | post.1314bb0d9.d21b6b6338.19997cf2.wallet.thedarkestside.org
334 | post.16dbc6f8d.d31b6b6338.19997cf2.wallet.thedarkestside.org
335 | post.136537abb.d41b6b6338.19997cf2.wallet.thedarkestside.org
336 | post.127bde824.d51b6b6338.19997cf2.wallet.thedarkestside.org
337 | post.1cb429410.d61b6b6338.19997cf2.wallet.thedarkestside.org
338 | post.19376556e.d71b6b6338.19997cf2.wallet.thedarkestside.org
339 | post.1d84d2d2b.d81b6b6338.19997cf2.wallet.thedarkestside.org
340 | post.17678fcb7.d91b6b6338.19997cf2.wallet.thedarkestside.org
341 | post.14fa40777.da1b6b6338.19997cf2.wallet.thedarkestside.org
342 | post.1d8031dc2.db1b6b6338.19997cf2.wallet.thedarkestside.org
343 | post.1c189fcc1.dc1b6b6338.19997cf2.wallet.thedarkestside.org
344 | post.176b3eaf9.dd1b6b6338.19997cf2.wallet.thedarkestside.org
345 | post.138cb1c14.de1b6b6338.19997cf2.wallet.thedarkestside.org
346 | post.129bc26fa.df1b6b6338.19997cf2.wallet.thedarkestside.org
347 | post.18a2ee0d0.e01b6b6338.19997cf2.wallet.thedarkestside.org
348 | post.19a53064b.e11b6b6338.19997cf2.wallet.thedarkestside.org
349 | post.19e921d54.e21b6b6338.19997cf2.wallet.thedarkestside.org
350 | post.1cbf0c809.e31b6b6338.19997cf2.wallet.thedarkestside.org
351 | post.14e77c191.e41b6b6338.19997cf2.wallet.thedarkestside.org
352 | post.1a3c68c18.e51b6b6338.19997cf2.wallet.thedarkestside.org
353 | post.166af8b5d.e61b6b6338.19997cf2.wallet.thedarkestside.org
354 | post.1f526e661.e71b6b6338.19997cf2.wallet.thedarkestside.org
355 | post.1ffcda4a8.e81b6b6338.19997cf2.wallet.thedarkestside.org
356 | post.14f4ec4aa.e91b6b6338.19997cf2.wallet.thedarkestside.org
357 | post.17044eed2.ea1b6b6338.19997cf2.wallet.thedarkestside.org
358 | post.1390a3548.eb1b6b6338.19997cf2.wallet.thedarkestside.org
359 | post.1e6a73894.ec1b6b6338.19997cf2.wallet.thedarkestside.org
360 | post.13d6a85a7.ed1b6b6338.19997cf2.wallet.thedarkestside.org
361 | post.1062124b2.ee1b6b6338.19997cf2.wallet.thedarkestside.org
362 | post.1c6c316b4.ef1b6b6338.19997cf2.wallet.thedarkestside.org
363 | post.1a2e9e282.f01b6b6338.19997cf2.wallet.thedarkestside.org
364 | post.15de7cb97.f11b6b6338.19997cf2.wallet.thedarkestside.org
365 | post.19c53aba3.f21b6b6338.19997cf2.wallet.thedarkestside.org
366 | post.1ef5e205a.f31b6b6338.19997cf2.wallet.thedarkestside.org
367 | post.1f0778b54.f41b6b6338.19997cf2.wallet.thedarkestside.org
368 | post.17f149b71.f51b6b6338.19997cf2.wallet.thedarkestside.org
369 | post.1a959cdc6.f61b6b6338.19997cf2.wallet.thedarkestside.org
370 | post.1e97ac8ba.f71b6b6338.19997cf2.wallet.thedarkestside.org
371 | post.1ca190b2c.f81b6b6338.19997cf2.wallet.thedarkestside.org
372 | post.13c1cf26f.f91b6b6338.19997cf2.wallet.thedarkestside.org
373 | post.1d2fa4651.fa1b6b6338.19997cf2.wallet.thedarkestside.org
374 | post.12239c86c.fb1b6b6338.19997cf2.wallet.thedarkestside.org
375 | post.15a68d2e2.fc1b6b6338.19997cf2.wallet.thedarkestside.org
376 | post.1253c518f.fd1b6b6338.19997cf2.wallet.thedarkestside.org
377 | post.106253a53.fe1b6b6338.19997cf2.wallet.thedarkestside.org
378 | post.19702958e.ff1b6b6338.19997cf2.wallet.thedarkestside.org
379 | post.1172cff07.1001b6b6338.19997cf2.wallet.thedarkestside.org
380 | post.1af10f1fd.1011b6b6338.19997cf2.wallet.thedarkestside.org
381 | post.1bcdd08df.1021b6b6338.19997cf2.wallet.thedarkestside.org
382 | post.107f53144.1031b6b6338.19997cf2.wallet.thedarkestside.org
383 | post.110c724e7.1041b6b6338.19997cf2.wallet.thedarkestside.org
384 | post.1647ae9aa.1051b6b6338.19997cf2.wallet.thedarkestside.org
385 | post.1cf61aec3.1061b6b6338.19997cf2.wallet.thedarkestside.org
386 | post.1d7c714cd.1071b6b6338.19997cf2.wallet.thedarkestside.org
387 | post.184d57f1d.1081b6b6338.19997cf2.wallet.thedarkestside.org
388 | post.1072b3ad5.1091b6b6338.19997cf2.wallet.thedarkestside.org
389 | post.19e231707.10a1b6b6338.19997cf2.wallet.thedarkestside.org
390 | post.1833feb66.10b1b6b6338.19997cf2.wallet.thedarkestside.org
391 | post.131a79cd7.10c1b6b6338.19997cf2.wallet.thedarkestside.org
392 | post.15a426c89.10d1b6b6338.19997cf2.wallet.thedarkestside.org
393 | post.14298ed13.10e1b6b6338.19997cf2.wallet.thedarkestside.org
394 | post.1ac64982c.10f1b6b6338.19997cf2.wallet.thedarkestside.org
395 | post.1e8576c32.1101b6b6338.19997cf2.wallet.thedarkestside.org
396 | post.1900543a7.1111b6b6338.19997cf2.wallet.thedarkestside.org
397 | post.1469fff61.1121b6b6338.19997cf2.wallet.thedarkestside.org
398 | post.12873cd67.1131b6b6338.19997cf2.wallet.thedarkestside.org
399 | post.1be5bca01.1141b6b6338.19997cf2.wallet.thedarkestside.org
400 | post.129d8b2a5.1151b6b6338.19997cf2.wallet.thedarkestside.org
401 | post.188a71f8a.1161b6b6338.19997cf2.wallet.thedarkestside.org
402 | post.17cfe5992.1171b6b6338.19997cf2.wallet.thedarkestside.org
403 | post.129a68cf6.1181b6b6338.19997cf2.wallet.thedarkestside.org
404 | post.1d62a52d2.1191b6b6338.19997cf2.wallet.thedarkestside.org
405 | post.156142133.11a1b6b6338.19997cf2.wallet.thedarkestside.org
406 | post.1cf42c14e.11b1b6b6338.19997cf2.wallet.thedarkestside.org
407 | post.123561df4.11c1b6b6338.19997cf2.wallet.thedarkestside.org
408 | post.1bfb5b322.11d1b6b6338.19997cf2.wallet.thedarkestside.org
409 | post.15c974a0f.11e1b6b6338.19997cf2.wallet.thedarkestside.org
410 | post.15fd404de.11f1b6b6338.19997cf2.wallet.thedarkestside.org
411 | post.14a2d8167.1201b6b6338.19997cf2.wallet.thedarkestside.org
412 | post.19d477269.1211b6b6338.19997cf2.wallet.thedarkestside.org
413 | post.1e750847e.1221b6b6338.19997cf2.wallet.thedarkestside.org
414 | post.1067da6ae.1231b6b6338.19997cf2.wallet.thedarkestside.org
415 | post.159c32122.1241b6b6338.19997cf2.wallet.thedarkestside.org
416 | post.1445e8c44.1251b6b6338.19997cf2.wallet.thedarkestside.org
417 | post.166c10fc0.1261b6b6338.19997cf2.wallet.thedarkestside.org
418 | post.17a63a0e0.1271b6b6338.19997cf2.wallet.thedarkestside.org
419 | post.1a608d50f.1281b6b6338.19997cf2.wallet.thedarkestside.org
420 | post.109a6ea46.1291b6b6338.19997cf2.wallet.thedarkestside.org
421 | post.1a042f18b.12a1b6b6338.19997cf2.wallet.thedarkestside.org
422 | post.1b614e4f5.12b1b6b6338.19997cf2.wallet.thedarkestside.org
423 | post.1b5309d08.12c1b6b6338.19997cf2.wallet.thedarkestside.org
424 | post.100a6663a.12d1b6b6338.19997cf2.wallet.thedarkestside.org
425 | post.158b34586.12e1b6b6338.19997cf2.wallet.thedarkestside.org
426 | post.1409d3327.12f1b6b6338.19997cf2.wallet.thedarkestside.org
427 | post.1570865f9.1301b6b6338.19997cf2.wallet.thedarkestside.org
428 | post.187c43bda.1311b6b6338.19997cf2.wallet.thedarkestside.org
429 | post.1c082db58.1321b6b6338.19997cf2.wallet.thedarkestside.org
430 | post.1b167e79f.1331b6b6338.19997cf2.wallet.thedarkestside.org
431 | post.1c389726d.1341b6b6338.19997cf2.wallet.thedarkestside.org
432 | post.1d68359d1.1351b6b6338.19997cf2.wallet.thedarkestside.org
433 | post.16767a689.1361b6b6338.19997cf2.wallet.thedarkestside.org
434 | post.1ecede489.1371b6b6338.19997cf2.wallet.thedarkestside.org
435 | post.16d7fbacf.1381b6b6338.19997cf2.wallet.thedarkestside.org
436 | post.1fa5284ec.1391b6b6338.19997cf2.wallet.thedarkestside.org
437 | post.116c8a17c.13a1b6b6338.19997cf2.wallet.thedarkestside.org
438 | post.18bc45699.13b1b6b6338.19997cf2.wallet.thedarkestside.org
439 | post.172194fdd.13c1b6b6338.19997cf2.wallet.thedarkestside.org
440 | post.1e0d9d36f.13d1b6b6338.19997cf2.wallet.thedarkestside.org
441 | post.1e472e410.13e1b6b6338.19997cf2.wallet.thedarkestside.org
442 | post.1c7d04ad3.13f1b6b6338.19997cf2.wallet.thedarkestside.org
443 | post.1e1a59f0b.1401b6b6338.19997cf2.wallet.thedarkestside.org
444 | post.169d38f88.1411b6b6338.19997cf2.wallet.thedarkestside.org
445 | post.1947f9178.1421b6b6338.19997cf2.wallet.thedarkestside.org
446 | post.10d2ca1e0.1431b6b6338.19997cf2.wallet.thedarkestside.org
447 | post.14ab290f6.1441b6b6338.19997cf2.wallet.thedarkestside.org
448 | post.11d585437.1451b6b6338.19997cf2.wallet.thedarkestside.org
449 | post.19a2d19d9.1461b6b6338.19997cf2.wallet.thedarkestside.org
450 | post.1cae51973.1471b6b6338.19997cf2.wallet.thedarkestside.org
451 | post.13accea99.1481b6b6338.19997cf2.wallet.thedarkestside.org
452 | post.12fe1aac7.1491b6b6338.19997cf2.wallet.thedarkestside.org
453 | post.11206cead.14a1b6b6338.19997cf2.wallet.thedarkestside.org
454 | post.18874f160.14b1b6b6338.19997cf2.wallet.thedarkestside.org
455 | post.193a8214d.14c1b6b6338.19997cf2.wallet.thedarkestside.org
456 | post.1eba44c12.14d1b6b6338.19997cf2.wallet.thedarkestside.org
457 | post.15a0accc2.14e1b6b6338.19997cf2.wallet.thedarkestside.org
458 | post.1044a54d0.14f1b6b6338.19997cf2.wallet.thedarkestside.org
459 | post.110c27da4.1501b6b6338.19997cf2.wallet.thedarkestside.org
460 | post.1a06fb1b3.1511b6b6338.19997cf2.wallet.thedarkestside.org
461 | post.1c60f01ab.1521b6b6338.19997cf2.wallet.thedarkestside.org
462 | post.1f93b57fa.1531b6b6338.19997cf2.wallet.thedarkestside.org
463 | post.186e022d1.1541b6b6338.19997cf2.wallet.thedarkestside.org
464 | post.12d5d4380.1551b6b6338.19997cf2.wallet.thedarkestside.org
465 | post.1b4cbb15d.1561b6b6338.19997cf2.wallet.thedarkestside.org
466 | post.1fc04f09d.1571b6b6338.19997cf2.wallet.thedarkestside.org
467 | post.1d909569f.1581b6b6338.19997cf2.wallet.thedarkestside.org
468 | post.1fe51a252.1591b6b6338.19997cf2.wallet.thedarkestside.org
469 | post.1129fa9be.15a1b6b6338.19997cf2.wallet.thedarkestside.org
470 | post.12381b162.15b1b6b6338.19997cf2.wallet.thedarkestside.org
471 | post.1fa7aacfc.15c1b6b6338.19997cf2.wallet.thedarkestside.org
472 | post.1b0709f01.15d1b6b6338.19997cf2.wallet.thedarkestside.org
473 | post.18478b829.15e1b6b6338.19997cf2.wallet.thedarkestside.org
474 | post.18b5c9427.15f1b6b6338.19997cf2.wallet.thedarkestside.org
475 | post.179b84136.1601b6b6338.19997cf2.wallet.thedarkestside.org
476 | post.19c8637d6.1611b6b6338.19997cf2.wallet.thedarkestside.org
477 | post.18e071610.1621b6b6338.19997cf2.wallet.thedarkestside.org
478 | post.14cf566ae.1631b6b6338.19997cf2.wallet.thedarkestside.org
479 | post.16200c471.1641b6b6338.19997cf2.wallet.thedarkestside.org
480 | post.1a009901b.1651b6b6338.19997cf2.wallet.thedarkestside.org
481 | post.1d274931f.1661b6b6338.19997cf2.wallet.thedarkestside.org
482 | post.1fd700859.1671b6b6338.19997cf2.wallet.thedarkestside.org
483 | post.1ed950a56.1681b6b6338.19997cf2.wallet.thedarkestside.org
484 | post.1e5c5ff9f.1691b6b6338.19997cf2.wallet.thedarkestside.org
485 | post.102487234.16a1b6b6338.19997cf2.wallet.thedarkestside.org
486 | post.180d98ca3.16b1b6b6338.19997cf2.wallet.thedarkestside.org
487 | post.1a2b40f89.16c1b6b6338.19997cf2.wallet.thedarkestside.org
488 | post.16925409d.16d1b6b6338.19997cf2.wallet.thedarkestside.org
489 | post.142ac77fe.16e1b6b6338.19997cf2.wallet.thedarkestside.org
490 | post.13bb76cea.16f1b6b6338.19997cf2.wallet.thedarkestside.org
491 | post.17e7c5f74.1701b6b6338.19997cf2.wallet.thedarkestside.org
492 | post.18dc38bc1.1711b6b6338.19997cf2.wallet.thedarkestside.org
493 | post.11db0a8eb.1721b6b6338.19997cf2.wallet.thedarkestside.org
494 | post.1985b4ed2.1731b6b6338.19997cf2.wallet.thedarkestside.org
495 | post.1ce8ce2cf.1741b6b6338.19997cf2.wallet.thedarkestside.org
496 | post.1be9c49b5.1751b6b6338.19997cf2.wallet.thedarkestside.org
497 | post.1941ef523.1761b6b6338.19997cf2.wallet.thedarkestside.org
498 | post.1a19a3ec4.1771b6b6338.19997cf2.wallet.thedarkestside.org
499 | post.1b89eb73b.1781b6b6338.19997cf2.wallet.thedarkestside.org
500 | post.1a8431868.1791b6b6338.19997cf2.wallet.thedarkestside.org
501 | post.14f856fca.17a1b6b6338.19997cf2.wallet.thedarkestside.org
502 | post.10fdcc23b.17b1b6b6338.19997cf2.wallet.thedarkestside.org
503 | post.1b5fe9bb1.17c1b6b6338.19997cf2.wallet.thedarkestside.org
504 | post.1023231f3.17d1b6b6338.19997cf2.wallet.thedarkestside.org
505 | post.1916ae2d9.17e1b6b6338.19997cf2.wallet.thedarkestside.org
506 | post.12d22d3e6.17f1b6b6338.19997cf2.wallet.thedarkestside.org
507 | post.196afa27a.1801b6b6338.19997cf2.wallet.thedarkestside.org
508 | post.189c9bae4.1811b6b6338.19997cf2.wallet.thedarkestside.org
509 | post.1b3c2c4aa.1821b6b6338.19997cf2.wallet.thedarkestside.org
510 | post.1887f05c1.1831b6b6338.19997cf2.wallet.thedarkestside.org
511 | post.1598db4bd.1841b6b6338.19997cf2.wallet.thedarkestside.org
512 | post.140d9ec20.1851b6b6338.19997cf2.wallet.thedarkestside.org
513 | post.1ba6e763e.1861b6b6338.19997cf2.wallet.thedarkestside.org
514 | post.13d1164dc.1871b6b6338.19997cf2.wallet.thedarkestside.org
515 | post.19ec4dfa6.1881b6b6338.19997cf2.wallet.thedarkestside.org
516 | post.19001ee32.1891b6b6338.19997cf2.wallet.thedarkestside.org
517 | post.12c09b649.18a1b6b6338.19997cf2.wallet.thedarkestside.org
518 | post.1ea37e800.18b1b6b6338.19997cf2.wallet.thedarkestside.org
519 | post.1e4ad82bd.18c1b6b6338.19997cf2.wallet.thedarkestside.org
520 | post.1e4ad82bd.18c1b6b6338.19997cf2.wallet.thedarkestside.org
521 | post.1afbc77d1.18d1b6b6338.19997cf2.wallet.thedarkestside.org
522 | post.1def2d748.18e1b6b6338.19997cf2.wallet.thedarkestside.org
523 | post.1daa638cd.18f1b6b6338.19997cf2.wallet.thedarkestside.org
524 | post.171d3359a.1901b6b6338.19997cf2.wallet.thedarkestside.org
525 | post.1fa126e47.1911b6b6338.19997cf2.wallet.thedarkestside.org
526 | post.1fdab47a7.1921b6b6338.19997cf2.wallet.thedarkestside.org
527 | post.1cb7da238.1931b6b6338.19997cf2.wallet.thedarkestside.org
528 | post.1e0206c92.1941b6b6338.19997cf2.wallet.thedarkestside.org
529 | post.15a37f5a4.1951b6b6338.19997cf2.wallet.thedarkestside.org
530 | post.15e4967c1.1961b6b6338.19997cf2.wallet.thedarkestside.org
531 | post.1ceb36061.1971b6b6338.19997cf2.wallet.thedarkestside.org
532 | post.1b4908bbb.1981b6b6338.19997cf2.wallet.thedarkestside.org
533 | post.1fc23111d.1991b6b6338.19997cf2.wallet.thedarkestside.org
534 | post.17e18a5f0.19a1b6b6338.19997cf2.wallet.thedarkestside.org
535 | post.16ae30631.19b1b6b6338.19997cf2.wallet.thedarkestside.org
536 | post.1a9f6f40c.19c1b6b6338.19997cf2.wallet.thedarkestside.org
537 | post.1def66693.19d1b6b6338.19997cf2.wallet.thedarkestside.org
538 | post.16c57c8bd.19e1b6b6338.19997cf2.wallet.thedarkestside.org
539 | post.15ffb28a5.19f1b6b6338.19997cf2.wallet.thedarkestside.org
540 | post.1ea849162.1a01b6b6338.19997cf2.wallet.thedarkestside.org
541 | post.148cc2be5.1a11b6b6338.19997cf2.wallet.thedarkestside.org
542 | post.1b1ff2891.1a21b6b6338.19997cf2.wallet.thedarkestside.org
543 | post.19161f829.1a31b6b6338.19997cf2.wallet.thedarkestside.org
544 | post.1b889bbe2.1a41b6b6338.19997cf2.wallet.thedarkestside.org
545 | post.1eb987ed4.1a51b6b6338.19997cf2.wallet.thedarkestside.org
546 | post.191377c55.1a61b6b6338.19997cf2.wallet.thedarkestside.org
547 | post.1e7495060.1a71b6b6338.19997cf2.wallet.thedarkestside.org
548 | post.1ffe499d6.1a81b6b6338.19997cf2.wallet.thedarkestside.org
549 | post.1d24dcae0.1a91b6b6338.19997cf2.wallet.thedarkestside.org
550 | post.1db092ab3.1aa1b6b6338.19997cf2.wallet.thedarkestside.org
551 | post.1b593559b.1ab1b6b6338.19997cf2.wallet.thedarkestside.org
552 | post.114d1e98b.1ac1b6b6338.19997cf2.wallet.thedarkestside.org
553 | post.14ccbf2e5.1ad1b6b6338.19997cf2.wallet.thedarkestside.org
554 | post.120d014eb.1ae1b6b6338.19997cf2.wallet.thedarkestside.org
555 | post.1bd33903e.1af1b6b6338.19997cf2.wallet.thedarkestside.org
556 | post.159439411.1b01b6b6338.19997cf2.wallet.thedarkestside.org
557 | post.1f4f50595.1b11b6b6338.19997cf2.wallet.thedarkestside.org
558 | post.1eebcdffa.1b21b6b6338.19997cf2.wallet.thedarkestside.org
559 | post.1a6f0ca24.1b31b6b6338.19997cf2.wallet.thedarkestside.org
560 | post.176e51489.1b41b6b6338.19997cf2.wallet.thedarkestside.org
561 | post.1a3163e99.1b51b6b6338.19997cf2.wallet.thedarkestside.org
562 | post.1128293f6.1b61b6b6338.19997cf2.wallet.thedarkestside.org
563 | post.12a752d5d.1b71b6b6338.19997cf2.wallet.thedarkestside.org
564 | post.1f125ed70.1b81b6b6338.19997cf2.wallet.thedarkestside.org
565 | post.1745ed96c.1b91b6b6338.19997cf2.wallet.thedarkestside.org
566 | post.1b3704673.1ba1b6b6338.19997cf2.wallet.thedarkestside.org
567 | post.1d7096cbf.1bb1b6b6338.19997cf2.wallet.thedarkestside.org
568 | post.1e1790d2c.1bc1b6b6338.19997cf2.wallet.thedarkestside.org
569 | 19997cf2.wallet.thedarkestside.org
570 | cdn.0443a2526.19997cf2.wallet.thedarkestside.org
571 | cdn.1443a2526.19997cf2.wallet.thedarkestside.org
572 | cdn.2443a2526.19997cf2.wallet.thedarkestside.org
573 | cdn.3443a2526.19997cf2.wallet.thedarkestside.org
574 | cdn.4443a2526.19997cf2.wallet.thedarkestside.org
575 | cdn.5443a2526.19997cf2.wallet.thedarkestside.org
576 | cdn.6443a2526.19997cf2.wallet.thedarkestside.org
577 | cdn.7443a2526.19997cf2.wallet.thedarkestside.org
578 | cdn.8443a2526.19997cf2.wallet.thedarkestside.org
579 | cdn.9443a2526.19997cf2.wallet.thedarkestside.org
580 | cdn.a443a2526.19997cf2.wallet.thedarkestside.org
581 | cdn.b443a2526.19997cf2.wallet.thedarkestside.org
582 | cdn.c443a2526.19997cf2.wallet.thedarkestside.org
583 | post.140.02ef72274.19997cf2.wallet.thedarkestside.org
584 | post.10730b46c.12ef72274.19997cf2.wallet.thedarkestside.org
585 | post.1015eb9da.22ef72274.19997cf2.wallet.thedarkestside.org
586 | post.12c1c46e3.32ef72274.19997cf2.wallet.thedarkestside.org
587 | post.1e4ddfbf9.42ef72274.19997cf2.wallet.thedarkestside.org
588 | post.11b340130.52ef72274.19997cf2.wallet.thedarkestside.org
589 | post.157daec99.62ef72274.19997cf2.wallet.thedarkestside.org
590 | post.1cdeedd3e.72ef72274.19997cf2.wallet.thedarkestside.org
591 | post.1f503083a.82ef72274.19997cf2.wallet.thedarkestside.org
592 | post.183ec7ba7.92ef72274.19997cf2.wallet.thedarkestside.org
593 | post.1b068b4ff.a2ef72274.19997cf2.wallet.thedarkestside.org
594 | post.1983e6a7c.b2ef72274.19997cf2.wallet.thedarkestside.org
595 | post.178120fda.c2ef72274.19997cf2.wallet.thedarkestside.org
596 | post.1d13b2009.d2ef72274.19997cf2.wallet.thedarkestside.org
597 | post.11ba7e0b5.e2ef72274.19997cf2.wallet.thedarkestside.org
598 | post.1ec0cf33c.f2ef72274.19997cf2.wallet.thedarkestside.org
599 | post.10fcb2f84.102ef72274.19997cf2.wallet.thedarkestside.org
600 | 19997cf2.wallet.thedarkestside.org
601 | cdn.0112335d4.19997cf2.wallet.thedarkestside.org
602 | cdn.1112335d4.19997cf2.wallet.thedarkestside.org
603 | cdn.2112335d4.19997cf2.wallet.thedarkestside.org
604 | cdn.3112335d4.19997cf2.wallet.thedarkestside.org
605 | cdn.4112335d4.19997cf2.wallet.thedarkestside.org
606 | cdn.5112335d4.19997cf2.wallet.thedarkestside.org
607 | cdn.6112335d4.19997cf2.wallet.thedarkestside.org
608 | cdn.7112335d4.19997cf2.wallet.thedarkestside.org
609 | cdn.8112335d4.19997cf2.wallet.thedarkestside.org
610 | cdn.9112335d4.19997cf2.wallet.thedarkestside.org
611 | cdn.a112335d4.19997cf2.wallet.thedarkestside.org
612 | cdn.b112335d4.19997cf2.wallet.thedarkestside.org
613 | cdn.c112335d4.19997cf2.wallet.thedarkestside.org
614 | cdn.d112335d4.19997cf2.wallet.thedarkestside.org
615 | cdn.e112335d4.19997cf2.wallet.thedarkestside.org
616 | cdn.f112335d4.19997cf2.wallet.thedarkestside.org
617 | cdn.10112335d4.19997cf2.wallet.thedarkestside.org
618 | cdn.11112335d4.19997cf2.wallet.thedarkestside.org
619 | cdn.12112335d4.19997cf2.wallet.thedarkestside.org
620 | cdn.13112335d4.19997cf2.wallet.thedarkestside.org
621 | cdn.14112335d4.19997cf2.wallet.thedarkestside.org
622 | cdn.15112335d4.19997cf2.wallet.thedarkestside.org
623 | cdn.16112335d4.19997cf2.wallet.thedarkestside.org
624 | cdn.17112335d4.19997cf2.wallet.thedarkestside.org
625 | cdn.18112335d4.19997cf2.wallet.thedarkestside.org
626 | cdn.19112335d4.19997cf2.wallet.thedarkestside.org
627 | cdn.1a112335d4.19997cf2.wallet.thedarkestside.org
628 | cdn.1b112335d4.19997cf2.wallet.thedarkestside.org
629 | cdn.1c112335d4.19997cf2.wallet.thedarkestside.org
630 | cdn.1d112335d4.19997cf2.wallet.thedarkestside.org
631 | cdn.1e112335d4.19997cf2.wallet.thedarkestside.org
632 | cdn.1f112335d4.19997cf2.wallet.thedarkestside.org
633 | cdn.20112335d4.19997cf2.wallet.thedarkestside.org
634 | post.1f0.050f011be.19997cf2.wallet.thedarkestside.org
635 | post.19cff5418.150f011be.19997cf2.wallet.thedarkestside.org
636 | post.1c7e66639.250f011be.19997cf2.wallet.thedarkestside.org
637 | post.16e3abbdb.350f011be.19997cf2.wallet.thedarkestside.org
638 | post.1771e1ed2.450f011be.19997cf2.wallet.thedarkestside.org
639 | post.17ed9ffb1.550f011be.19997cf2.wallet.thedarkestside.org
640 | post.19bd42cfb.650f011be.19997cf2.wallet.thedarkestside.org
641 | post.17302d0ad.750f011be.19997cf2.wallet.thedarkestside.org
642 | post.1502fca93.850f011be.19997cf2.wallet.thedarkestside.org
643 | post.1afa1458f.950f011be.19997cf2.wallet.thedarkestside.org
644 | post.1433e5458.a50f011be.19997cf2.wallet.thedarkestside.org
645 | post.1b633048d.b50f011be.19997cf2.wallet.thedarkestside.org
646 | post.1f084e281.c50f011be.19997cf2.wallet.thedarkestside.org
647 | post.1cc309095.d50f011be.19997cf2.wallet.thedarkestside.org
648 | post.1d97cc960.e50f011be.19997cf2.wallet.thedarkestside.org
649 | post.1ba074133.f50f011be.19997cf2.wallet.thedarkestside.org
650 | post.1666a41a9.1050f011be.19997cf2.wallet.thedarkestside.org
651 | post.19c44ffb0.1150f011be.19997cf2.wallet.thedarkestside.org
652 | post.1802d8278.1250f011be.19997cf2.wallet.thedarkestside.org
653 | post.139c285b0.1350f011be.19997cf2.wallet.thedarkestside.org
654 | post.19205802e.1450f011be.19997cf2.wallet.thedarkestside.org
655 | post.16c4fb49b.1550f011be.19997cf2.wallet.thedarkestside.org
656 | post.1654f8ad3.1650f011be.19997cf2.wallet.thedarkestside.org
657 | post.1b9865750.1750f011be.19997cf2.wallet.thedarkestside.org
658 | post.163c43129.1850f011be.19997cf2.wallet.thedarkestside.org
659 | post.14ff4744b.1950f011be.19997cf2.wallet.thedarkestside.org
660 | post.10e69745e.1a50f011be.19997cf2.wallet.thedarkestside.org
661 | post.13e603f3d.1b50f011be.19997cf2.wallet.thedarkestside.org
662 | post.1bc023ecb.1c50f011be.19997cf2.wallet.thedarkestside.org
663 | post.1ad730f80.1d50f011be.19997cf2.wallet.thedarkestside.org
664 | post.1516c21d4.1e50f011be.19997cf2.wallet.thedarkestside.org
665 | post.15435479a.1f50f011be.19997cf2.wallet.thedarkestside.org
666 | post.15814f50b.2050f011be.19997cf2.wallet.thedarkestside.org
667 | post.15dc6ca82.2150f011be.19997cf2.wallet.thedarkestside.org
668 | post.156174d11.2250f011be.19997cf2.wallet.thedarkestside.org
669 | post.1747b944a.2350f011be.19997cf2.wallet.thedarkestside.org
670 | post.1693613e6.2450f011be.19997cf2.wallet.thedarkestside.org
671 | post.13b7d3e41.2550f011be.19997cf2.wallet.thedarkestside.org
672 | post.16d859698.2650f011be.19997cf2.wallet.thedarkestside.org
673 | post.1153872b9.2750f011be.19997cf2.wallet.thedarkestside.org
674 | post.1af0906fd.2850f011be.19997cf2.wallet.thedarkestside.org
675 | post.107014e1c.2950f011be.19997cf2.wallet.thedarkestside.org
676 | post.105d1ab06.2a50f011be.19997cf2.wallet.thedarkestside.org
677 | post.18f68472c.2b50f011be.19997cf2.wallet.thedarkestside.org
678 | post.10e1b8f46.2c50f011be.19997cf2.wallet.thedarkestside.org
679 | post.15b0a8c14.2d50f011be.19997cf2.wallet.thedarkestside.org
680 | post.15b85f4f0.2e50f011be.19997cf2.wallet.thedarkestside.org
681 | post.19ac45b16.2f50f011be.19997cf2.wallet.thedarkestside.org
682 | post.16c066f60.3050f011be.19997cf2.wallet.thedarkestside.org
683 | post.1afe36f39.3150f011be.19997cf2.wallet.thedarkestside.org
684 | post.140757924.3250f011be.19997cf2.wallet.thedarkestside.org
685 | post.1de8b0288.3350f011be.19997cf2.wallet.thedarkestside.org
686 | post.1d4ff51c9.3450f011be.19997cf2.wallet.thedarkestside.org
687 | post.120ce584e.3550f011be.19997cf2.wallet.thedarkestside.org
688 | post.1d3257514.3650f011be.19997cf2.wallet.thedarkestside.org
689 | post.128033e93.3750f011be.19997cf2.wallet.thedarkestside.org
690 | post.1b889b173.3850f011be.19997cf2.wallet.thedarkestside.org
691 | post.15db418a6.3950f011be.19997cf2.wallet.thedarkestside.org
692 | post.1f27fae86.3a50f011be.19997cf2.wallet.thedarkestside.org
693 | post.160ce541e.3b50f011be.19997cf2.wallet.thedarkestside.org
694 | post.170048357.3c50f011be.19997cf2.wallet.thedarkestside.org
695 | 19997cf2.wallet.thedarkestside.org
696 | 19997cf2.wallet.thedarkestside.org
697 | 19997cf2.wallet.thedarkestside.org
698 | 19997cf2.wallet.thedarkestside.org
699 | 19997cf2.wallet.thedarkestside.org
700 | 19997cf2.wallet.thedarkestside.org
701 | 19997cf2.wallet.thedarkestside.org
702 | 19997cf2.wallet.thedarkestside.org
703 | 19997cf2.wallet.thedarkestside.org
704 | 19997cf2.wallet.thedarkestside.org
705 | 19997cf2.wallet.thedarkestside.org
706 | 19997cf2.wallet.thedarkestside.org
707 | 19997cf2.wallet.thedarkestside.org
708 | 19997cf2.wallet.thedarkestside.org
709 | 19997cf2.wallet.thedarkestside.org
710 | 19997cf2.wallet.thedarkestside.org
711 | 19997cf2.wallet.thedarkestside.org
712 | 19997cf2.wallet.thedarkestside.org
713 | 19997cf2.wallet.thedarkestside.org
714 | 19997cf2.wallet.thedarkestside.org
715 | 19997cf2.wallet.thedarkestside.org
716 | cdn.04fe22eff.19997cf2.wallet.thedarkestside.org
717 | cdn.14fe22eff.19997cf2.wallet.thedarkestside.org
718 | cdn.24fe22eff.19997cf2.wallet.thedarkestside.org
719 | cdn.34fe22eff.19997cf2.wallet.thedarkestside.org
720 | cdn.44fe22eff.19997cf2.wallet.thedarkestside.org
721 | cdn.54fe22eff.19997cf2.wallet.thedarkestside.org
722 | cdn.64fe22eff.19997cf2.wallet.thedarkestside.org
723 | cdn.74fe22eff.19997cf2.wallet.thedarkestside.org
724 | cdn.84fe22eff.19997cf2.wallet.thedarkestside.org
725 | cdn.94fe22eff.19997cf2.wallet.thedarkestside.org
726 | cdn.a4fe22eff.19997cf2.wallet.thedarkestside.org
727 | cdn.b4fe22eff.19997cf2.wallet.thedarkestside.org
728 | cdn.c4fe22eff.19997cf2.wallet.thedarkestside.org
729 | cdn.d4fe22eff.19997cf2.wallet.thedarkestside.org
730 | cdn.e4fe22eff.19997cf2.wallet.thedarkestside.org
731 | cdn.f4fe22eff.19997cf2.wallet.thedarkestside.org
732 | cdn.104fe22eff.19997cf2.wallet.thedarkestside.org
733 | cdn.114fe22eff.19997cf2.wallet.thedarkestside.org
734 | cdn.124fe22eff.19997cf2.wallet.thedarkestside.org
735 | cdn.134fe22eff.19997cf2.wallet.thedarkestside.org
736 | cdn.144fe22eff.19997cf2.wallet.thedarkestside.org
737 | cdn.154fe22eff.19997cf2.wallet.thedarkestside.org
738 | cdn.164fe22eff.19997cf2.wallet.thedarkestside.org
739 | cdn.174fe22eff.19997cf2.wallet.thedarkestside.org
740 | cdn.184fe22eff.19997cf2.wallet.thedarkestside.org
741 | cdn.194fe22eff.19997cf2.wallet.thedarkestside.org
742 | cdn.1a4fe22eff.19997cf2.wallet.thedarkestside.org
743 | cdn.1b4fe22eff.19997cf2.wallet.thedarkestside.org
744 | cdn.1c4fe22eff.19997cf2.wallet.thedarkestside.org
745 | post.130.0337c3537.19997cf2.wallet.thedarkestside.org
746 | post.1a4e8282a.1337c3537.19997cf2.wallet.thedarkestside.org
747 | post.167c7ec1e.2337c3537.19997cf2.wallet.thedarkestside.org
748 | post.1608c43a0.3337c3537.19997cf2.wallet.thedarkestside.org
749 | post.140de4934.4337c3537.19997cf2.wallet.thedarkestside.org
750 | post.19c26cf57.5337c3537.19997cf2.wallet.thedarkestside.org
751 | post.170907bdc.6337c3537.19997cf2.wallet.thedarkestside.org
752 | post.1de06d79a.7337c3537.19997cf2.wallet.thedarkestside.org
753 | post.132fa7dd1.8337c3537.19997cf2.wallet.thedarkestside.org
754 | post.151a4343a.9337c3537.19997cf2.wallet.thedarkestside.org
755 | post.1d495215f.a337c3537.19997cf2.wallet.thedarkestside.org
756 | post.1265a7e39.b337c3537.19997cf2.wallet.thedarkestside.org
757 | post.16db1cc28.c337c3537.19997cf2.wallet.thedarkestside.org
758 | 19997cf2.wallet.thedarkestside.org
759 | 


--------------------------------------------------------------------------------