GandCrab5.0.9样本详细分析

冷不防 2022-01-17 10:59 226阅读 0赞

**☣前言：**  
** WannaCry利用永恒之蓝漏洞爆发以后，病毒安全的前沿对抗最频繁种类则是勒索病毒了，17年初或者更早就有人捕获了GandCrab家族的勒索病毒，直到18年已经更新迭代到了5.0版本，18年进入尾声的时候，安全研究人员发现了GandCrab勒索病毒的V5.1最新版变种。**  
 **对于勒索个人看法：当第一次听说勒索病毒的时候，就感觉一定是无法抗拒的利益驱动，才会让某一群人去迭代、维护、研发勒索病毒。这道理就像开了一家公司一样，能把病毒走向全世界，已经是很成功了，看似简单，其实背后的关联复杂。除了加密算法的复杂程度之外，勒索的潜伏与隐蔽（字符串混淆加密）也是比较到位。  
 其实不管怎样，那些API还是那些API，即使自己实现相仿得函数，时间足够也能从函数功能与汇编，加以逻辑去推理过程，从而实现、还原。**  
**✃**  
**1、预热（收集系统信息、提权、注册表操作、兼容匹配、加密解密关键字符串等）  
2、枚举扫描（网络共享、资源枚举，遍历扫描文件）  
3、加密文件（过滤、匹配的文件以不同方式进行加密）  
4、收尾工作（发送勒索信息、删除病毒、销毁进程等）  
 基本所分析的病毒大多数都会这样干，因为他既要保证你系统的稳定性，也要保证自己的安全与功能的实现，这样才能勒索到钱......**  
                               **ps:文章最后附思维导图**  
**✃**  
**☛预热分析：**  
**1、线上分析：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9]  
                    图片一：线上分析  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 1]  
                    图片二：样本信息  
   
**2、工具分析：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 2]  
                    图片三：exeinfo pe  
   
**☛详细分析：**  
**①拉入IDA也许你会看到花指令混淆，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 3]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 4]  
                    图片四：花指令混淆  
 **②如上图所示，GandCrab.00426F7A函数会标志勒索病毒要开始了，当你发现桌面弹窗"我们很快就会回来"，恭喜已经中了GandCrab勒索病毒，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 5]  
                    图片五：MessageBox  
** ③GandCrab.00405FF7函数先是创建快照，遍历进程，怕加密文件的时候影响加密效果，如文件被占用等问题，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 6]  
                    图片六：初始化字符串  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 7]  
                    图片七：遍历对比进程  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 8]  
                    图片八：匹配进程结束  
 **④如图三中GandCrab.00405944是最为核心的函数，先来看看获取windows版本信息，获取SID也就是说当前的权限等级，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 9]  
                    图片九：Windows版本信息  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 10]  
                    图片十：当前权限级别  
** ⑤GandCrab.004054BA函数对注册表中键盘布局键值获取，获取当前用户和系统的默认安装语言，比对如果匹配到419（俄罗斯），422(乌克兰) ，423(比利时)等等，那么将执行删除文本且结束进程，这意味着不进行勒索......，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 11]  
                    图片十一：键值循环  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 12]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 13]  
                    图片十二：匹配成功  
** ⑥继续线性跟踪，GandCrab.00405016函数负责获取系统信息，检索了磁盘目录关联的文件系统和卷的信息，然后用磁盘的数据hash获取随机字符串，创建.lock互斥体：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 14]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 15]  
                    图片十三：创建互斥体  
**⑦GandCrab.0040586C函数，加密与异或字符串获取公钥1，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 16]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 17]  
                    图片十四：获取RSA1  
**⑧参数入栈，安全进程扫描，关键系统数据异或解密，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 18]  
                    图片十五：入栈参数  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 19]  
                    图片十六：示意图  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 20]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 21]  
                    图片十七：系统数据拼接  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 22]  
                    图片十八：安全服务遍历  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 23]  
                    图片十九：拼接后数据  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 24]  
                    图片二十：解密  
**⑨系统不显示critical-error-handler消息框，异常不显示，初始化临界区，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 25]  
                    图片二十一：SetErrorMode

** ⑩如上图所示，GandCrab.00404DC5函数是GandCrab勒索的核心函数，先是利用微软提供的CSP系列函数获取随机数，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 26]  
                    图片二十二：GetModuleHandleA  
**⑪解密字符串，解密后发现是文件名的后缀，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 27]  
                    图片二十三：文件后缀名  
**⑫随机生成密钥，且导出公钥，私钥，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 28]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 29]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 30]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 31]  
                    图片二十四：导出Key  
**⑬接着创建了注册表ex\_data\\data，并且设置了随机字符，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 32]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 33]  
                    图片二十五：设置注册表  
**⑭导入公钥，加密了数据：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 34]  
                    图片二十六：硬编码公钥导入

**⑮创建了key\_datas\\datas，设置了public=公钥，private=硬编码加密后私钥（还加了随机数等数据）**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 35]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 36]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 37]  
                    图片二十七：注册表设置  
**⑯有意思的赋值方式，push入栈，pop弹出给寄存器，赋值给内存变量，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 38]  
                    图片二十八：赋值方式  
**⑰使用了Base64加密了之前的密钥，然后拼接勒索警告字符串与获取的pc数据，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 39]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 40]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 41]  
                    图片二十九：勒索警告  
**⑱下面压入了文件后缀格式，应该准备枚举网络资源，遍历文件，加密文件了，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 42]  
                    图片三十：GandCrab.00403D8E  
**⑲内部创建了两个线程，线程分析一，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 43]  
                    图片三十一：回调函数  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 44]  
                    图片三十二：局域网枚举  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 45]  
                    图片三十四：遍历局域网下文件目录与磁盘  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 46]  
                    图片三十五：递归扫描  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 47]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 48]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 49]  
                    图片三十六：加密过滤  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 50]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 51]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 52]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 53]  
                    图片三十七：加密过程  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 54]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 55]  
                    图片三十八：硬编码公钥加密文件  
**⑳线程分析二，如下所示：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 56]  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 57]   
                    图片三十九：本地文件加密且退出进程  
**最后调用了函数GandCrab.00405252执行了 ShellExecute,执行了如下指令：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 58]  
   
** ✎样本中关于利用CVE漏洞提权代码没有分析，因为在测试环境下没有匹配0x1000，跳过了提权函数，上述有很多分析点不够精准，但是还原了样本的整体逻辑。  
 关于硬编码公钥加密研究，使用的是CSP又称"加密服务提供者(Cryptographic Service Provider)"，微软提供的一套API，后续有机会一起实现与深入研究一番。**  
**✃**  
**思维导图：**  
![GandCrab5.0.9样本详细分析][GandCrab5.0.9 59]

转载于:https://blog.51cto.com/13352079/2355303

[GandCrab5.0.9]: https://s1.51cto.com/images/blog/201902/26/699c70464a038790ab8161365d550aab.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 1]: https://s1.51cto.com/images/blog/201902/26/3d1fe3a7bc47756fb3c7ee041b27851c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 2]: https://s1.51cto.com/images/blog/201902/26/17a3ddab2b670e645ecb3ac993335715.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 3]: https://s1.51cto.com/images/blog/201902/26/6359ca6891927d234d7532469a5fbb79.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 4]: https://s1.51cto.com/images/blog/201902/26/fe4d6f81fd85a7fcfa5823f9e6447819.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 5]: https://s1.51cto.com/images/blog/201902/26/46b6028176731eaa2b78f79f062f1f6b.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 6]: https://s1.51cto.com/images/blog/201902/26/3628656db4feed19cf6055f1e9c6ced0.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 7]: https://s1.51cto.com/images/blog/201902/26/49c3948b5f744f0bc2e617eef79415d1.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 8]: https://s1.51cto.com/images/blog/201902/26/ea6a50a663a819209c604e8ad7462aed.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 9]: https://s1.51cto.com/images/blog/201902/26/c671c830867a7aa9af2744a475422e00.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 10]: https://s1.51cto.com/images/blog/201902/26/0151a4b4914b485e57af8eba3d740b53.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 11]: https://s1.51cto.com/images/blog/201902/26/a6bfe59a0e6d744b48ebaaac29cf4006.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 12]: https://s1.51cto.com/images/blog/201902/26/97059b3c3ed971590296c742a0bd6dd9.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 13]: https://s1.51cto.com/images/blog/201902/26/b3525c1cf587ee923b9c53cd58d4e1b1.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 14]: https://s1.51cto.com/images/blog/201902/26/f2b5d77ef7207c5314856ccddf616be0.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 15]: https://s1.51cto.com/images/blog/201902/26/ab56e14d7a86b5a8c7cdc0c2d06d8c25.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 16]: https://s1.51cto.com/images/blog/201902/26/7da2021c0cbb52f8e5f58a5545d76626.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 17]: https://s1.51cto.com/images/blog/201902/26/a611bc93310f2861de61148dbbf7e415.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 18]: https://s1.51cto.com/images/blog/201902/26/372894eb9607ba544e31f112a130a9f1.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 19]: https://s1.51cto.com/images/blog/201902/26/93a9c9364600ba237f90ce7d9f028bc6.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 20]: https://s1.51cto.com/images/blog/201902/26/b3d11172cb1f1e692baf0801a62e80db.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 21]: https://s1.51cto.com/images/blog/201902/26/ed5a5c573484a9994ca63cbf341e7bd8.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 22]: https://s1.51cto.com/images/blog/201902/26/ad5fa7023820f364e3e38f50d49cabea.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 23]: https://s1.51cto.com/images/blog/201902/26/46aa09dc174c0875c2d4dee9bb6af880.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 24]: https://s1.51cto.com/images/blog/201902/26/c4a68626e7e802a204a438741179e69a.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 25]: https://s1.51cto.com/images/blog/201902/26/2703cca31a02befba973e587fc6efc39.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 26]: https://s1.51cto.com/images/blog/201902/26/50a3ae1d6c1b9ba9370d3f92184ca126.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 27]: https://s1.51cto.com/images/blog/201902/26/e105b030dbc7dfdec04c4ab3fb2af467.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 28]: https://s1.51cto.com/images/blog/201902/26/8a5c938df3fd38d2f789bec11ca2071b.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 29]: https://s1.51cto.com/images/blog/201902/26/6a1549de319c1e511627c90e3d150b51.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 30]: https://s1.51cto.com/images/blog/201902/26/4ccded3d5a9e92363db38f7b72289bb5.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 31]: https://s1.51cto.com/images/blog/201902/26/9e7d5e3cb91dbe3771b1cc0d31d762eb.jpg?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 32]: https://s1.51cto.com/images/blog/201902/26/7ae3d705d93fa65edb175cc87be2045a.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 33]: https://s1.51cto.com/images/blog/201902/26/305d61fbd8bdf4616c30ce10fd32d97e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 34]: https://s1.51cto.com/images/blog/201902/26/711aa71c949a06d81a57eb4322e24de3.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 35]: https://s1.51cto.com/images/blog/201902/26/cbe6f03554f368a4bc67a7a39e708edf.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 36]: https://s1.51cto.com/images/blog/201902/26/ee7fe26f4341d9970dffb2cacc6ecc63.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 37]: https://s1.51cto.com/images/blog/201902/26/0f0eeccef3258e2fed2ea5d1b3d17eb9.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 38]: https://s1.51cto.com/images/blog/201902/26/e34330ad4828d5a63b0594367073335d.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 39]: https://s1.51cto.com/images/blog/201902/26/56bda0ef9f6800232f7892811a785a5e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 40]: https://s1.51cto.com/images/blog/201902/26/330480ae1c1f92f897984aebf83cc678.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 41]: https://s1.51cto.com/images/blog/201902/26/79d79462779d5f8f2dd57a2de7a80204.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 42]: https://s1.51cto.com/images/blog/201902/26/1bcd10fa311aa7aaa7924fa78be5c82a.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 43]: https://s1.51cto.com/images/blog/201902/26/0aa1812ef86e4ef6e30992043edb097c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 44]: https://s1.51cto.com/images/blog/201902/26/333cf2a26e0e7135249aa845f5241ed5.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 45]: https://s1.51cto.com/images/blog/201902/26/370df3ee9f928c41d37cc23583cd83a2.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 46]: https://s1.51cto.com/images/blog/201902/26/3b853c8cfe329f8705f1004d1276875f.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 47]: https://s1.51cto.com/images/blog/201902/26/88b347ef5b338859390bdd4eea2767df.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 48]: https://s1.51cto.com/images/blog/201902/26/39b4e1f3f540d2fa2d54012b5ebf0a3e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 49]: https://s1.51cto.com/images/blog/201902/26/fc217eebe986fe7afb69156ccf68e824.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 50]: https://s1.51cto.com/images/blog/201902/26/2cb2341f98bf0838f0741cc2eb430ddc.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 51]: https://s1.51cto.com/images/blog/201902/26/961b5f4c6b4c5c5e32e889e45d077445.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 52]: https://s1.51cto.com/images/blog/201902/26/9a3ce6758966b725d977384411a91b80.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 53]: https://s1.51cto.com/images/blog/201902/26/bdf1b207eacb340932b24515cba587df.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 54]: https://s1.51cto.com/images/blog/201902/26/4083982ecf139a25f607af4c7a116d3c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 55]: https://s1.51cto.com/images/blog/201902/26/d47a57fbec961bfa336cc2a877182150.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 56]: https://s1.51cto.com/images/blog/201902/26/7aa38f9c93f1e6683ab7892e97b5e747.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 57]: https://s1.51cto.com/images/blog/201902/26/e8e0262b8223e4519a2a9eabdb6e432e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 58]: https://s1.51cto.com/images/blog/201902/26/6de663840fadea538d3c72917a0e4068.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[GandCrab5.0.9 59]: https://s1.51cto.com/images/blog/201902/26/7f9ba7f4227ee38d27e71726febbba5b.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=