letters1

The DGA of Qakbot.T

Disclaimer

These are just unpolished notes. The content likely lacks clarity and structure; and the results might not be adequately verified and/or incomplete.

Aliases

The malware in this blog post is also known as Pinkslipbot, QakBot and Qbot

Table of Contents

Malpedia

For more information about the malware in this blog post see the Malpedia entry on Qakbot.

Qakbot, Akbot or Qbot is an older banking trojan from 2009 that underwent multiple modifications — Symantec calls the current version Generation 10, Microsoft arrived at letter “U” . Since at least September 2013, Qakbot relies on a domain generation algorithm (DGA) for C&C communication. On January 11, the blog malware-traffic-analysis.net showed such a DGA empowered Qakbot sample that was spread by the Rig Exploit Kit. Others have reversed the algorithm already, but I could not find any public documentation or implementation of the algorithm online, and therefore publish my notes here. I only reversed one sample and did not spend much time finding other versions of the DGA, so please interpret my results with caution.

The DGA in Qakbot is interesting for multiple reasons:

  • Qakbot uses the Mersenne Twister (MT) as pseudorandom number generator. This not surprising, as the bot is written in Microsoft Visual C++ 5.0 where the MT is the default pseudo random number generator. Still, to my knowledge, it is the only DGA that uses a MT; Usually, DGAs are based on linear congruential generators (LCG) or hash functions like MD5.
  • Qakbot tries to detect packet capture tools. If it finds one, it does not abort like many other malware would, but instead generates decoy domains to fool researchers. On the one hand, this is innocent-looking to a researcher compared to staying silent. On the other hand, the operators of Qbot could register decoy domains to track labs that leak DNS queries.
  • Qakbot uses low level Windows sockets for it’s network traffic. For example, instead of using gethostbyname or DNSQuery to resolve domains, it will craft the DNS packet manually and send it with ws2_32.send. This bypasses hooks on the common DNS APIs.

Reverse Engineering

I reversed this sample from December 23, 2015:

MD5
1e135d7e024f2fb57182ae3313acae6d
SHA-256
be9625921253dca2929c849d3ea04fa9d406113bda9459af2c79487e7afdac88
upload date
2015-12-23 20:51:54
malwr link
link

The sample unpacks to this executable. The executable decrypts and loads this Qakbot dll. Microsoft detects all three stages as Qakbot.T, which is the second latest version of Qakbot from around July 2014.

Seeding

The seed to initialize the Mersenne Twister is calculated in four steps:

  1. The current date is determined by making an HTTP request to one of three popular websites (offset 10009417 in the next graphic).
  2. The date string is reformatted into a different string, which also includes a hard-coded seed value (0 or 1).
  3. The CRC32 checksum of the resulting string is calculated (the two last steps are done in date_to_crc, called at 1000942A).
  4. Qakbot tries to detect packet capture software. If it does, it increments the CRC sum by one.

The CRC sum then initializes the Mersenne Twister (call at 10009444):

seeding_overview

Step 1: Current Date

The date is determined by making an HTTP GET request to one of the following websites:

  • google.com
  • microsoft.com
  • cnn.com

Qakbot starts with google.com and only tries the other two options if Google is down. Qbot uses low level sockets for networking, which means it manually has to forge the requests. For example, this is the data it sends to google.com:

google_get_request

The request data is built with sprintf, and then sent using sockets:

send_request

The response is read until the HTTP header “Date: “ is found. Qbot cuts the first 6 letters, which correspond to “Date: “, and returns the resulting date string. For example, “Thu, 21 Jan 2016 23:31:32 GMT”:

parse_response

Step 2: Formatting the Date and Hard-Coded Magic Value

The date string is split at the space character into an array of string pointers, for example: [“Thu,”, “21”, “Jan”, “2016”, “23:31:32”, “GMT”]. Only the day (“21”), month (“Jan”) and year (“2016”) are used. These values are first transformed as follows:

  • The day is converted to an integer, which is then mapped to 0, if the day was 1-10; mapped to 1 if the day was 11-20; and 2 otherwise. In the example above, the value would become 2.
  • The month is converted to lowercase, i.e., “Jan” becomes “jan”.
  • The year is taken as is.

The resulting three values, plus a fourth hard-coded integer value, are then formatted according to:

%u.%s.%s.%08x

reformat

There are only two known possible magic values: 0 and 1. For example, for the magic value 1 the seed string on January 1, 2016 is:

1.jan.2016.00000001

Step 3: CRC-32

The string is turned into a 32bit value by calculating the CRC checksum, so “1.jan.2016.00000001” becomes 0xC758FFB8.

Step 4: Packet Capture Detection

Qakbot has a hardcoded list of executable names that are indicative of lab environments:

blacklisted_tools

The tools are:

  • tcpdump.exe
  • windump.exe
  • ethereal.exe
  • wireshark.exe
  • ettercap.exe
  • rtsniff.exe
  • packetcapture.exe
  • capturenet.exe
  • wireshark.exe

If Qbot detects any of those executables running, or if it finds the WinPCap Library wpcap.dll installed, it will increase the CRC sum by one. The CRC is used to initialize the Mersenne Twister, and the small increment is enough to lead to completely different random numbers.

The way the day string is transformed leads to two periods of 10 days at the start of the month, and a period of 8 to 11 days at the end of the month. During those periods the domains won’t change.

Maximum Number of Domains

Qbot generates the domains in batches. The second arguments determines how many domains to generate at once:

call_generate_domains

After the batch of domains is used up without success, Qbot loops back to generate additional domains, up to a total of 5000 domains:

maximum_nr_of_domains

Batches of Domain

The routine to generate the algorithmically generated domains first decrypts and splits the list of top level domains:

read_tlds

com, net, org, info, biz, org

For my samples the domains are .com, .net, .org, .info, .biz and .org (a second time):

tlds

Qakbot then generate five domains by calling the dga routine (shown later).

dga_looper

The five domains are then shuffled:

shuffle

or in pseudo code:

n = domains.length
for i = 1 to n
    swap domains[i] with domains[Random(1,n)]

This randomizes the sequence, although not uniformly (see exercise 5.3-3 on page 129 of Introduction to Algorithms, 3rd Edition).

The DGA

The dga routine takes five arguments:

  1. OUT: pointer to the domain
  2. IN: (unused) an integer (256)
  3. IN: the Mersenne twister.
  4. IN: the array of top level domains
  5. IN: the length of the top level array

The next image shows the disassembly:

dga

The routine calls generate_random_string, which takes the minimum and maximum length as input, to determine the second level domain. The dga routine then appends a random top level domain. The routine generate_random_string disassembles to:

generate_random_string

The routine first picks a length by using the Mersenne-Twister. Then it calls the Mersenne-Twister for the determine length to pick letters between a and y. The letter z is not included due to the same modular arithmetic bug that many other DGAs share (for example: Necurs, Ramnit, Ranbyus, Tinba, Geodo/Emotet, Cryptolocker, or Corebot).

Further details of the DGA can be seen from the reimplementation of the DGA shown next.

Reimplementation

The following Python code generates the domains for any given date and seed value:

import binascii
from datetime import datetime
from ctypes import c_uint
import argparse

def date_to_seed(date, seed):
    dx = (date.day-1) // 10 
    data = "{}.{}.{}.{:08x}".format(
            dx if dx <= 2 else 2,
            date.strftime("%b").lower(), 
            date.year, 
            seed)
    crc = c_uint(binascii.crc32(data.encode('ascii')))
    return crc

def _int32(x):
    return int(0xFFFFFFFF & x)

class MT19937:

    def __init__(self, seed):
        # Initialize the index to 0
        self.index = 624
        self.mt = [0] * 624
        self.mt[0] = seed  # Initialize the initial state to the seed
        for i in range(1, 624):
            self.mt[i] = _int32(
                1812433253 * (self.mt[i - 1] ^ self.mt[i - 1] >> 30) + i)

    def extract_number(self):
        if self.index >= 624:
            self.twist()

        y = self.mt[self.index]
        y = y ^ y >> 11
        y = y ^ y << 7 & 2636928640
        y = y ^ y << 15 & 4022730752
        y = y ^ y >> 18

        self.index = self.index + 1
        return _int32(y)

    def twist(self):
        for i in range(0, 624):
            y = _int32((self.mt[i] & 0x80000000) +
                    (self.mt[(i + 1) % 624] & 0x7fffffff))
            self.mt[i] = self.mt[(i + 397) % 624] ^ y >> 1

            if y % 2 != 0:
                self.mt[i] = self.mt[i] ^ 0x9908b0df
        self.index = 0

    def rand_int(self, lower, upper):
        r = self.extract_number()
        r &= 0xFFFFFFF
        t = lower + float(r) / (2**28)*(upper - lower + 1) 
        t = int(t)
        return t


def dga(date, tlds, nr_domains=5, sandbox=False, seed=0):
    seed = date_to_seed(date, seed).value + sandbox
    mt = MT19937(seed)

    for i in range(nr_domains):
        tld_nr = mt.rand_int(0, len(tlds) - 1)
        length = mt.rand_int(8, 25)
        domain = ""
        for l in range(length):
            domain += chr(mt.rand_int(0, 25) + ord('a'))
        domain += "." + tlds[tld_nr]
        print(domain)

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-d", "--date", 
            help="date for which to generate domains")
    parser.add_argument("-s", "--sandbox",
            help="domains when sandbox is detected", action="store_true") 
    parser.add_argument("-n", "--nr",
            help="nr of domains", type=int, default=5000) 
    parser.add_argument("-m", "--seed",
            help="seed", type=int, choices={0,1}, default=0) 
    args = parser.parse_args()

    if args.date:
        d = datetime.strptime(args.date, "%Y-%m-%d")
    else:
        d = datetime.now()

    tlds = ["com", "net", "org", "info", "biz", "org"]
    dga(d, tlds, args.nr, args.sandbox, args.seed) 

You also find the code on GitHub.

Samples

There are two different hard-coded seeds, 0 and 1. The seed 1 is much rarer. In fact, I only found the one sample analyzed in this blog post. Seed 0, on the other hand, is very common with hundreds of sample.

Seed 1

SHA-256Date
be9625921253dca2929c849d3ea04fa9d406113bda9459af2c79487e7afdac882015-12-23 12:00:00

Seed 0

SHA-256Date
5d815068ed588b4b7c0ee34873548da49e4fc91aad0ceab9a2b9872670a8744d2014-05-15 16:42:45
652a50c609acf82f10274cb917b11ec528f75154ae149203296e648948412b382014-05-17 23:38:21
49301bf209dc73d1c10fd5884fba33f557c9062a9285d779eaa5e81e665ca05f2014-05-20 07:40:02
aaa45dd6f88472e50dbed9ca5fdbedffb12a81b0501613f40a1a580153d18ea82014-05-20 09:12:34
ae0b1c5b7967f8d649bd7e96de55253e1cbdb07baf4b65bd11e547301e1384f12014-05-21 13:19:44
fd38f8da23753a91f020398cff2dce264396c67e962c08b10025bc7db5d971a72014-05-22 07:17:25
10c744789ea2ca1f676ca5ecbff7574f9102525ba106e8598dddbe952dffe8032014-05-29 15:58:28
e4154575c1ff28256408be805c9f3b05ed777691476a9f1d01206769a164ce862014-05-31 04:04:38
dd9128c3da483db4b5f0766c3ed1c18dd2bbe5c42b5cd77cf68a8f2ac6e6b7fc2014-06-01 16:06:17
5843da19f61b5d438db50ae17792090c5887c04986351ca660c364f8287d744f2014-06-03 00:08:30
116a557e355f10185ea4a035d97bd94d8823ccbca9237273f71fbae3fcfe672a2014-06-04 07:27:36
2f84adbef9adeaa7f9a46928592ca558cc82e0fdc9ee19779dfb2668a2d120a72014-06-05 13:05:16
d53d7032bb727dfb6bd63c66715e71a7ce0c462d36682c7a3eeaebf58e490d202014-06-06 18:48:43
d1530f8d244893d78d2ca75ea3be8dfae2d4711b7d671bfa142fb8e334a86ca32014-06-09 13:24:55
2f31f1bce7502d226735c90db3bb9438a238c3c85db6e43cc2342578a0af04892014-06-09 20:16:28
2ce602dccee44ab5598a2352d244f59bb1819d4d565d575cf25c6529e702f6bb2014-06-10 15:53:57
cfc68a5d0e2999fddbcffc18d46eaec88f53361cfc5ced629099d61822941aea2014-06-10 20:40:56
2bf98f3b39644bafd1229cefd8869547271027ea9a5aa1deef118155718af8b92014-06-13 07:11:49
7220cf63489009c7e7a573d387bd1f9953d0a0743439c373175dba90227949a72014-06-20 14:54:25
8a081bfc6637e08da73eb956e40f1a591e7281b3beeabb49db3b6d95f641985e2014-06-21 00:54:59
9daa0a03dc1313afa810249de3072f471e095bcdc0eca03437b66bf56aae34ad2014-06-23 09:00:51
c79aa4266b4a4a1c6387347fab90aa493d700ec56f042e8c58aaf27725ac46f22014-06-23 20:16:18
3a8b94a282f81e6ca03b0e2d74c1b54658ba7921f296c8675ad53fe7407083ad2014-06-24 00:01:18
dbcd62d9c30039f73cb6ccbc84a5e356533266b6dfd92100ae563f03a40076ad2014-06-24 11:23:53
41b2f909d27007adb2ad3e0d2be9c222ed5ed1c3c550de89b7de9b609adeef3f2014-06-26 15:42:25
4f57d29f99cacaeb3224f4aa081cb34b5338e478f60d72afc7e2748ae135784b2014-07-01 13:08:01
4e9493bd58f47b741200d99c701126b3c3c2131032f3bcefeb97c52cd315bbd32014-07-02 19:22:42
ddef1b288b1f515b1843e264366aadd14697d0a9b05481c195afaae71914cbbc2014-07-04 18:56:52
4eb5742af2f214c9bec0500c08a8136f72762d027da948cf94b3837cc624f7ba2014-07-05 05:56:39
6fb0ae0acec0bbdf1a0fe32bf9df850927c8f1a7b08dff316759b86cf0c3490b2014-07-07 13:31:39
83c77d898da3356bceac9a4c2cc10b364fe7bed3cfe426a6ff69b7351ad5e8652014-07-08 18:27:08
bddd9fe6663f115d11606aa7451cefe89f10c7003488de7ccd2daee805eb4d762014-07-10 08:13:11
f85384bafd4065cda9dd703ec9e6753c770d8ef1eb31d729c959971ba87c5ef72014-07-15 15:19:34
cc3f4bb1731d0cde57adaac4054a6f8224b2e004794e5e9803f8a1d29fa8df102014-07-16 12:41:48
668cb5bc660f0c1a40a57e4c13eab50865ad82e7782edd5e387f7a8a9cfd554c2014-07-18 22:36:33
a0eab5a407ccc0db30965ed5af1a90d308d5db4e5ba53702b175dad260c1c8172014-07-19 21:06:40
39f0b727634d479be6f52a4ec38293c70f52f4a1b73c874c24fd195dd2b1cd582014-07-20 01:07:15
9d2f3a3b88c05b629cbd09f41f82099677e97a14689965914999287fd1d136f92014-07-28 13:12:39
cb2a63e917a7056f64f0d04d9173c53d88171cbd42c690131d510e3cbc1d43d32014-08-01 13:48:18
92eb2a1f2306665ae7ac238d2e2f24f267dd7b996dc8f7cd04b21adb531887f62014-08-01 14:54:13
49224f2a90a225bca8b0e6da4375d7876a64f2b2c3b2011a36c63cfd9d376c0b2014-08-14 11:48:07
9c2ffb4feeccb57a27f85558043f22a8618e3916eb6b5c3f60f34436108811482014-08-25 15:39:23
ad33569a69b8fa85bd86cd7e16ce29f71b43580973608e86b1e124e6d44f3b082014-08-28 05:27:53
4b2dfccc4c028dc36eed090cd7738f825e012c4e84fa5a09ee11ec4168b148f32014-08-29 15:51:32
155ee1e7fba4d57497759e0d8aa518393c555361057bf0428b3ef8d37bab3f9b2014-08-30 16:06:41
7c4560025ca3dcb8d5595fbb04a87880cf9a8fd56250a1fe2edb558637f1acdc2014-09-16 06:06:44
74ac2694226cab48a8295a4374aa0f3d5ef5060882210d8fd4202f4786943a8c2014-09-18 09:45:56
9bd85d308b09a561f278afe1bda968784bf7d96f31c1f64f3e6e91ac1551e1d12014-09-19 23:35:19
0d42f249cae2837ab38a5cb79c253345df745c89947cb54a3ebe5b302cf8368c2014-09-20 08:13:02
7ab508b49893b5f39149248756c4d30311f6edf3350661f65c86254e9cd7cd912014-09-25 13:44:54
dc65a1a9c2bb3752f84b29f5dd21b2a08c2b052b3af77ea22c203cb21818c1662014-09-25 16:17:27
9395b37ed08c485e046a526bc1afaa2f701eb3299bc7bc5c0ed111ab6e6d75702014-09-27 05:07:31
e5d35c04738a9e44ee9a3d8a308b1a7200184b6d937256558a2bf823cc1cefd32014-09-29 19:45:46
d4040c8e2c9fb1fdea721d433fba10348bb57798c080e425a32641f6a0508c3e2014-09-30 15:49:51
821ca00bf28b43e3872b3d7cf99ffbeb43836312e5ec714a9564f8de405d89382014-10-10 10:10:23
a4429871d35c18af61576ec45e997b9dc8997dd3a19e7e240cb8254e7d3055612014-10-19 18:12:23
331a81a7a74997eb9523a3cd9cd0a2594a3396dfb323c45a22ab7b45bc944d9d2014-11-07 15:52:35
41d93157341d5a94347b3fcc25c6f76ad063b171b88295da498f22f92b43520b2014-11-11 19:42:51
9715b518783b645959533b295cc83d8e5ba01f6cd9603a553a8690f7014ad88e2014-11-14 21:16:07
aca383ddc78cfcffd5e183aa897d1eccf0ffbf6b15dab7695705949b2632c9b02014-11-16 02:48:23
6a8938c1675207327a3f2295d08ea1ac9b9e6fd7f28db14edfd4f385024e94c62014-11-17 18:41:41
3faaa21a246a4dd1e9bd6460f773b6ee05b91cfc4f5bb726d77e0d08dba10e012014-12-11 02:47:50
60f09ae4ffbc8e8d6a2452ed4787390abc2b87a2ef703ac10bbd5d27a17dbfa82014-12-19 17:39:52
59cb803f2405228dec211fdc26de35090a66761e87396dcb741eb9eac618ff802014-12-26 23:05:47
9f59dbef5138cf62d0335f5ba42982422ea41dae1d1987f22a28d76da131cf8f2015-01-19 13:11:04
632d19231bf45d7d39510ccb9e17196dcbd5ffab49b081e4ec3a40929850dba32015-01-21 00:09:44
0e46284032f2ae0e71effa8c58ae56a97973825ec6ce9801a554f0592553b3762015-01-22 05:40:43
a5f1f4372d53856b73d6565203ec673d05901f28ae2973cbcfacf4765c01d5c32015-01-26 16:36:54
b8151f9f0c4c7995ead75125ada1737d6179f0c8e7bb6e4d13ba445c53acab3d2015-01-27 05:10:51
5e54c98f8e937577249fa964a65004642f40b72506b16006363ec03f1db9bcd52015-01-27 14:45:27
85c9457989390c9284138bd87f86337bb714fce8238ade5a75fe0abe3c5b699b2015-01-28 18:23:26
c07b58bf848d07884fdf9d5396209b2819a5df902548e77211c70b40390101732015-01-30 03:43:03
df326767cf56302c8ee48c781e1fc48126be9db512e65ada72574604fceb659a2015-01-30 14:50:54
bdd5679436949c66ce1032f19cd937c9f458de0590a6b496fbc552f2bd2d096c2015-01-31 12:45:12
a05e6ad11f6eabf79813553f3156afb5e13c507b9ffa0ef07d7861a6395bb45f2015-02-05 05:49:56
d580f02bfd0d2a254d6cd6772a7945aadc932cf4a7ba945709ebc0b8d9c1d1fd2015-02-07 03:34:08
c505dd8c9d803030c5bc9932d61b46c3477fa2d936dac4c18d1f6192b77ee3792015-02-09 23:46:13
9f3ee8719492483b762b455d8ac3883a287561054e8fe600c7913e5cebcc5d5a2015-02-17 16:21:44
831ec44d888e14bd10ea7bf51b1c3c92b16315c7c85a1e8a94b369cf6b6a3cbe2015-03-03 17:56:32
df0642ca49411a7c5eca4655e94dcc7cd97e944026cc1ca0594d86d94e0160842015-03-08 21:31:22
7a9a5bec3ccab3b3ffaf25e2fb3ba107a69c77a08c2d580ace557e87653f05882015-03-12 21:43:44
4951a7f557203f979ed14f7678eee426bb8598937b4b549330bc128159cf4b7f2015-03-16 14:39:42
c731dd9c4afd56a0e06adaa7dbfe0def2511454a73fdf3638d1c0bf9cad0343f2015-03-16 14:49:24
3896516ea2c5c6cf1656f5d30edaf51b563263378945a82759966d2e6772fd2f2015-03-17 18:01:08
e070f9cede2953e3f138c192806cb87f4db2498e99f15e2682759a211d2ab34d2015-03-19 02:08:14
a821910126e4f439ac07e51eb505c26e33792d39be8f751705d77a307cd989e42015-03-19 12:04:25
7c37af6e28bea255796f5055942893dd6564145ca461133a078bbff949a930922015-03-21 01:54:37
e2dfcfed198b4e35c35f89c328683f0872b8aa9b97f2fd449517a99ceee9ab0e2015-03-27 21:31:09
cbe183ea75fd1aab102fb7a7ac5628a7214f4088ab0c5c1c77b98c260d2239d52015-03-30 09:17:10
0ae1db191b38045e1187eb63e40ef45e4790e3c4a6a093f8dea39684b4e533572015-03-30 13:01:09
e87657c24a52d2ea359d1cdd830b1019b2ded9302728982761ab7258beaf147f2015-03-30 21:45:01
fb5fcf8a9b688fdbb8a982d1bf2adf2fb1d8cdd5b470bd0b22cbe8a7b09a132d2015-03-31 05:31:18
76e2c4f17a3c2a94848b4491b86cf64611b4f4c9c5fb540ebcd57d0c96622d9e2015-03-31 11:53:44
d36a59a1023c80305d9a33f3779b33e919808a717ed5e78259f70859cb744fa52015-04-01 18:29:25
caaa5c49677c7bb4422ac561ffcbdd74703f1fec6144526ef3e3787b221b7a502015-04-04 04:11:54
7a6e634e5e7ca043a1ec0f2e2ec274d20940fb5b5a694e262b03938958ee9a552015-04-05 11:34:06
d37cb4b1dc22acd5c1f9dd3ede3db8464b32b34990144a7c29d7512626109d2a2015-04-05 14:29:37
ca78d17109906a6865fdf206b234d9c0def3ff9fd33bf6791ad1974395eab0d72015-04-06 15:16:55
a24efc7f195b7fe80dbd350b67fd4a263ffbfd1abbd4e995bdc978694a57bae62015-04-06 22:13:39
aaa1edf9a899abc869b2ba5bea043e764bb63b7b44f3870466f8065601781ec42015-04-06 22:16:17
d159835a84410600bb379090153e79de8771bf8eb0534c88b43a6ab09ffbb1ba2015-04-07 17:31:14
1baa95959302256dc9d413ccf60b876e4deca42ec2688953e9d7741771c945d02015-04-08 02:04:32
a1f7134ef56af7ca4e897c87432d54ab3cd0ba959ade57ac1d73a579a0756d342015-04-09 13:53:02
2c7dfaa529285a7048200a3cb3dde1b422012f1beeadd731aab719db0e757fc32015-04-11 04:09:10
261e5c3ee802138bfaccb3673354a093d67981b210c3d5637127074888be19cb2015-04-12 05:00:11
c70eb3b74e6ad12f2ff033a575e2ad562b5a0b54b0f91c9fc960a6fd0fd6275b2015-04-13 03:18:08
440ed4eec97195f14bd33a3ed52423b1a115512471bf86e0e5b9380ba41b2ece2015-04-13 14:15:29
939333b7f6b86567b9951c67f1686cb6424ab46070fb560aa5ee0e9fefc57ff42015-04-13 14:38:08
e19c3bf3041f32eaba1e6ed9d03efef19cf476716f162a524cad8c787a44d1fa2015-04-14 04:32:59
2ff7bfb99e04d1795c66ca93f1428636ad61c791c2abf64d548ba10e789f24952015-04-14 07:31:30
8c287bd7beb9b9aca594609f25f1c3e889847ce1455c12f02784b8ab631540482015-04-14 07:34:08
136812e9afdbae82cd468fedfbb9700402a9d79f0f7c50c54b1e53a21f9710a22015-04-14 08:05:32
8ad9bbc82423734fdb610e4b9d5b4ee71c7a149973a0fae2b98fc38b9ecb6a8d2015-04-16 04:18:33
90c5f9c52a4f0d2e85e04ed88881dab4cc85c414d3455bed8603f153e8904b7b2015-04-17 13:47:45
893e61560756055a681389c5e0df74995e1c9364b71feb8cba3fc8ce7cc460a92015-04-18 23:34:15
a2d4b4d27d72de3487a44dc08b4f1d2d3cd26eb3ed1f953a110c71898994f72a2015-04-19 21:59:13
4ea9c663f4c626fc9894a4256556b67fa909bf89663c70117f90c2eb7260b0382015-04-20 12:04:41
5d3d9ad9afb73dc0397ebd48bfa4e456e61748f82a8a8137addb582a0361ae732015-04-20 14:42:22
4c620987677df30839bd6d9bb23ca658340e6fa39059cd1c2924a5fbf53e37a12015-04-21 00:21:41
6ae8c5c5911638d32ebfdff19457510688b1168baa513b37d8fd53c0b23545c72015-04-21 20:03:46
575473f4e90c11d7201f391cc29c654a5a44b640846808128453df4b175bf0062015-04-21 20:09:02
5b48130a7bd82ac52863bea7c391eebebdf281e31b65e1c59649949f099752062015-04-21 20:17:22
30445e974bb27cc5a46adb8318f14a92c1feec3064632e2867478e503dd077b72015-04-21 20:58:48
00661d19cb66c154abe01e54ecfb70d476f53af5f5ee49643daa68dd2be6be712015-04-21 21:04:22
67f186b7d713b4a792678d4eb5c09ace8f37fa70c3c0fb9998a98b2b3260a2fa2015-04-21 21:23:38
5e162a06969408e46351037493841bff68223da39883f210ad2c25cf9f6c43b32015-04-21 21:58:03
5287da41bd8d47d8c96496b67d9e2d98e45e47f6a31a31b62189cca1d23ebd4a2015-04-21 22:16:10
0c6184028e4d6d8b26218e4de00010bf5e60d8f53d854abcdd5a62ff6f62eb082015-04-21 22:22:35
be3d09d8e5e890cd5815346ded176a01c5ab63fc607554f87d7b03b39b3b93792015-04-21 22:44:27
17ff6e53efe399bf413d67eac52ec0238a0702eda9f15798492afdb1f3aaf5352015-04-21 23:13:04
3d593e983408a5db1264cf433e18cce192f615a5b591b50ebdddbd396706f5052015-04-21 23:20:32
00fff247dda43bc75189c8038585e96c1570e2b76a4408a35667fd6cc49530d52015-04-22 00:10:03
1b23b6206b1d64bd724ed7fcf5775db0099a17f02c50bcdb11709776ecf5cd862015-04-22 00:12:33
33c1cd1757f93021693c5ee50ca721a0b3962a11c5d37e20382adc17b55e9d7a2015-04-22 00:53:18
d0f691f0fa5b7e6b9554115035765b61f14f5661ead84593c0c970322a64317f2015-04-22 00:55:15
09cb4da016ada345423cd34baba77b7eae3c267a64ecc1ead74bd381bc3822952015-04-22 01:20:03
fb6994e8ffa8734e70180cc8eebda226d89f6bcfbe846a5528e8a12a94698cec2015-04-22 01:34:47
8580826c88d992f38de076a448f87639c727786cb3cd36708da4f327f51dd50d2015-04-22 01:37:57
e4d73174f428b4faaf77855526c4f377400d72844f2e3b20bb3a043546ad3fbe2015-04-22 01:50:51
05f4fa90666031a7b045e53394dbc67bf15228df720a40b504fd9ca26e5e41112015-04-22 01:56:32
5e0ffe7fae46e30737d2d2387af5a712afa7ca820ae6af7d64d8c8c81dd745a82015-04-22 02:13:36
d5c4f8ce6274549442bf5c587fa75806e421a569489f7f0f5164702d7c08929e2015-04-22 02:29:09
b6d361565ceb720c18e0678ded321a328f355a3e2705dec04a129686aa6616ab2015-04-22 02:49:35
2c98a66dd896b58ad22ce758e58796a68bee4f90d8b3745d961f219871268bdf2015-04-22 02:51:02
57d890d805aeaadcab3f9a0f45f9d33e481204012d5e78dde6c98fa9c4817b2d2015-04-22 02:54:04
b0b5323568c6f87ebda9fbb889cc635c2f135217172225f3c3315d348210bcea2015-04-22 03:20:18
0931d40fa1a39921fc08199def148b0fb4e0887dc78997ce170bcb99c836b6672015-04-22 03:27:30
b43cf373b40189b8da8029bb372df3ffc32ec439edc7e1c82544ac4f0482c2922015-04-22 03:27:48
a61674cb8bfc362770f0938cfad9f34a9e4a6de65ab40945d5749fc7724e0c7c2015-04-22 03:30:22
6a5663ee0477048f791408cdd6df14a4a75a154a6b84821f70a07c22431c86ee2015-04-22 03:33:26
3b576dc59960b75a32710d4f84d831034f190e205c9204a4fc1afb1b5b6ba69a2015-04-22 03:37:22
474186375b34fe652898c76c51adc5724af362b94bd9be83794a91c2f5c8e41c2015-04-22 03:58:59
ae7e1fa52c116599928311362f65f44b79992ef6b2f32a5cea485f2233847bef2015-04-22 04:18:22
9ea1494e318ed16f69d12605997cc045cd49a9ed78a7ffb48ec1195eb8e6968f2015-04-22 05:11:58
61aa2560df86547a18121db6bcf5a4ee7134f1032a46ebd28a8a29d82ff90a312015-04-22 05:16:43
49c7f33002fe46ee9b888e4385a2688ecab363b6a2abcde91f8c0977a3ecbae92015-04-22 05:26:26
71682077ea2f3f0f0c45f4cd85d1f4d5f42f0a128fd210131376ea370c71ca332015-04-22 05:33:09
6e2a011fb324b3812aaa4ebf5a8e0f4c2226aa7bdd4008609eb8d95c4f6168b32015-04-22 05:36:47
ded32849f86675f7c6738a04c2fdd0ea97d80eddc95c52d4c0d510136bde778d2015-04-22 05:42:56
ad41a48d875c04c8ad5766e7fdd1b932871a0f7141a3849d72c15c528aa739e62015-04-22 06:02:31
401c65ef4d2b542b578dc5a6afd5311d7604f06c2299619549b1082a1d7747732015-04-22 07:05:40
2a84a6825f382f56c89638849aaeef9dff1e254ad57c6d34530f5ccff399ea912015-04-22 09:56:20
45b024abda0ad2e0203b5be478b90360dd458acb5097741db782cc41acd9d64a2015-04-22 10:09:17
f2ff81e0a2f1bc15eb45018953e764dd60088a7c3cc656e429cdad36f1dd46e92015-04-22 16:54:08
082e6d138a39d94d2b5b793e381ad355551a28a8aabaa32fc7dac9c0b1c655ca2015-04-22 16:55:18
c184bed7ab422d23809cd52b6c4404ab1a4a6af68ec00fb0905b70419b6789132015-04-22 17:10:49
545c872142a705ec515826570b5d3ec82d1321abc28e234dc1faa92c6662f80d2015-04-22 17:15:06
15d26e0b831b41186950eced02ceedadcfc9011d56e16db357e2414b71465ef92015-04-22 17:16:13
6e36b5998dc79da398a9a47f40b07b9de61f0792f9b583deaa8b8745c7c03da32015-04-22 17:16:51
7ef40ec0acf123f33276b84d4ea4f414e993da3b6cc798b8e3a5a6e299fb5e732015-04-22 17:24:08
a0aed54ee395e9bbb31870da876fb544dd9e75f5bf80545ac11a45ea5da0e27b2015-04-22 17:55:40
5682e201c2f2b30309e70b7d7be6c3b5793b8c09698cac36bba9a29adcf2b1052015-04-22 18:06:01
1a529331a831c0fa55b241899bee78ceafaa958a0bc9c4514e4e6fb33db235592015-04-22 18:20:04
428b22c92f29b334430c041c20efc4fbbbbb5e0e90e77d76adda2d7a3b6e7e392015-04-22 18:32:37
cb63263156a08ac50dd97a20a95c61800b56783564df1a1a3d1d736caa622c432015-04-22 18:50:03
39534de6de34ed8c400dfa40aa31cf9d51203c4422b076c9620e2281e2b6502a2015-04-22 18:53:14
93dc94ccc3acec33bd80e7ed3c6a1e8e29178d6804467e365f6cc1a7492edfca2015-04-22 18:55:47
693ebd9e15155063e41d6538cc060321b6b2744e686d93c3bec478607e1eb9832015-04-22 20:33:05
06b2e02c02e6df16db35d341ec4e146dfde4d893eecb418e88d626045916d7002015-04-22 21:17:44
d3022738e152a1c94a023858b78b90cf24b4404ec6d3b448ccf21cc9695b825b2015-04-22 21:51:36
e49cb51d14ac21bf595da82c9ad0476138c943a6f49d1a8c4c871056329d28a82015-04-22 23:53:51
f084328fa2bb40b1eddd6b1371c9eab8af2257cc7cb9298b801163eb26ca6ce12015-04-23 01:40:56
595febeccd37120ef0bb76fe4f344681be206984c6812c983cd614e491a566602015-04-23 03:15:10
e2246cdd1c699a9b40fc12d9f9896bf8c73e0aaf1d788cef41e0575a2850f7362015-04-23 03:29:38
ce1c84ed34e413e8d082a5f587ce8f85945708114fd218e7e63d9861ac1f32292015-04-23 08:54:27
79ac91bab195d924ad03195b82040bc2be147ffe80f89244f2232702679c21f52015-04-23 08:58:24
c53221a010f53a61969b4f5fae0efc117bbc878936e573f08cbcfa30ea2c34042015-04-23 09:12:09
770554525ace845f8d6e6b795188afaff7c2b64e6d41ef57a923787ab15610862015-04-23 10:00:32
ec4bfcfd278709289f216fcb6959bd6f5c3521938cff003c5dac340472c7c1fd2015-04-23 10:10:59
989e19d0813a86f18e82a27884088a11db63027f90e7817ceef7e60d7690bb8c2015-04-23 23:31:12
d032378420dc453ba2766d18a359334d736fa40cad905a1f6cabdaa644e5e4b02015-04-24 00:35:03
caf006d44a91b120a9dae2604babad2c450564838dc772b5271517ac61a635cc2015-04-24 01:10:13
e0275098c7efdedafb1559b324ce1ca622f61a3c5ee430050efc519300ad37a02015-04-24 02:07:57
8641b44534e1345fd51770101e919f0c69dbfe6b7a7af42f391e3f9a340785862015-04-24 02:08:45
e0f2ed071ce4b9f064a8c6d839b52d2499dd42909b5deffdbdd10606727f1df62015-04-24 09:45:05
30d833d4765bb7fbf2eda1cdebee7f192356f7a61c587a83af080a85730913662015-04-24 10:45:14
51576a4f9505cfe3522d96691f2c9ee4590fb9f56061905a86221a9e90d5f06c2015-04-24 12:50:31
596f286a38a82a6243f2c14333b491b56eba5491010065e9b6bd7b71015908f02015-04-24 13:04:10
9aa1a4aed816ccb977d8aabae22cb86b4751338139c30256c301a6a9a90c98e32015-04-24 17:33:35
5179b35ad749673e166695bf66db71e3e522763ad20e2c3afd78d02d9ecc107d2015-04-24 18:40:49
881a7e7404a4387188dbdb586cae050f52bc3ef88e5799f4861710a821b16e5e2015-04-24 20:44:18
081b595ee263425261aeb9f8158ffaf97cda0872d070fed6c1b632a357b3a62b2015-04-25 10:27:32
68f2066ad7ebdf40fe3b759bcaa0080fa0ec9e1fdba63d8ef9856d63e92c60772015-04-26 02:59:31
fdab7494ac11e4c6b7b3fba3fe645f78740b3e602d5092c2ba1f950c36d9136f2015-04-26 04:10:52
4154d98a8f917cb64d53a9dadc7a7dcd2a63bc80250cf335b091e3722ec6b8c12015-04-27 15:14:14
ec7ad97c40ba878b0ca315b509bbd3f77e9ee4568e7b194fefdce4bc3609c91d2015-04-29 03:48:30
84513ce079acca3bb7f89b24d32b5cb81b8f495e457708a4d85d4ad40397a9e22015-04-29 17:22:42
a654cefba18acc8e9422bd8d9826f2153fc48ab70d9d64eb91ee47dccc28e7242015-04-29 17:36:57
5c145b93712b4798ab535d0d12aa872cdea5fe84614e652b7245bdf4b57e1cba2015-04-29 23:40:47
8b056ccd59abc89a86c3bdb76525952dd197377bc2f5ecd4faff6b44e94563612015-04-30 07:18:06
0c48289133e3fc73f69535de108ba9378319a32b71438abb6d7f61fc929450aa2015-04-30 15:55:12
fb696e936d65a81e11f024a7021a5b21b193241f5275422c237a4b87b8b7bb592015-05-01 17:38:17
49876878e6ece7dd5e71d10f32211c34cc947a95371e8315cf365563e068d7ba2015-05-02 12:31:03
733b8eb083ff24b41058d3d10134e2512ecbd141dfbed299a0dec5d7051cbe602015-05-04 16:35:18
0b7ea02edd9f8968dac4d023f3e376742abb91c1855aa35fd3659829fef683272015-05-04 20:20:10
eee0baf46e7ef2e996c2b8a4b43969b164749b38ecc7a5e3d43a71a16fabffba2015-05-05 14:25:46
ca0527039d8ae8343f73efb665ab562aed8c1f478acc710d0e20ef09055e121f2015-05-06 17:42:08
295c94fb639a633fdf2414def1c96a61f1f23ed39b7e9f6d4810c32b12ae219d2015-05-06 17:42:46
d33d814b7e436ccc6a85e27ae8be90208a6a7060ae225254800856d1e72bf7042015-05-07 00:51:35
5475b241f2be1e1824a323a90b510149d6733c0a6d9ea24652b4b243ca2613472015-05-07 15:58:47
7a284d2efce4e37ff3100afdbc5c7e61a29bb1cf6e96ebee254e40d5b32959572015-05-07 18:46:50
f56ac71d7c40d35557f28c686310251849c5caa827f87408bc39a07cd77dc1ee2015-05-08 03:20:15
0ac64df541f1ad462d44ada790ca524d8e02263d9cafd7401ab6afddb130d8f62015-05-11 16:25:33
f4d8fccd22c332bd815e1b13efe5c2e0e3b04e6cefbbd6f221d32609cfe8f6462015-05-11 22:19:17
bd5b2718b2517c18599e7a2afd5d955ad81d4f65af9826e0dcaa85627aa543732015-05-13 08:01:59
3dfedd054cfc003c2755051fb8392626f4ab1ef0e5c62ea8f34997ce5c19ae822015-05-14 01:47:05
4a74cddc17120de5ad0bb75817de9cab13481321dfaf03dc6d3f0cce23c8f5552015-05-14 07:40:24
eda648b6856578c476bb6608ccbe63ed140287d628a6d813ef4b825358811e272015-05-15 08:14:29
e0a175e4a79eb18a29179b68735a41c14bfa70c3157e09d80aca11ab0daaeaf12015-05-16 07:01:27
cabc692bfbd8fb6799a95821d27532bf2ccbb29d1d910defc22a2d3ae647184f2015-05-16 22:35:38
9a238c95de1ba5bc414aa0fd45297bf79f02b1de03d93a65ad74e91e37eb9ae92015-05-17 10:07:51
bf170f3aa14fff30fe48b554bdfb89600d154514d77f8e30076b7c6aac91b81f2015-05-18 05:36:19
1af7b4b0bb919dc6717dd425cf885285bca2da2b216990828dc77b87a0bc018a2015-05-19 15:26:59
080b8752b213b0d2df81427ba702d251372da4d23f37c71e3ca2e1be2332f9f62015-05-20 03:42:00
b398818488910bb520ae8b1e9f3cd3f6c456c62f981177b113830666850647052015-05-20 06:06:58
caa7d5c2d890f3b3ea456723e743eeb8557a125240960409a5801294be1fbf992015-05-20 10:39:12
6360809d0b8d463cb4dc5588a9b838af25fd2318267628e170d5ac30d74002db2015-05-20 15:25:33
525bad96b9cd55721360876359abf56b67dfe3c1fd63c0221766a5c554b5545d2015-05-21 00:50:12
a52bebf24f2ee6b4c4dddb2cbd99acf544da905497483216a9d258acc102a4642015-05-21 04:20:16
13c962c02f3d40307889c14e20fd6cbbe92da4ae349fdeff6660354e8e0e54382015-05-21 10:03:29
467bdae6fac3b776dbb3f82974e5d94dcf3797b3b73d27a99342974e0a6343c32015-05-24 06:52:37
54b9585aca7d8c742d8f3bd132dc030971b1d7249ee4f5173e8c0de19e95426c2015-05-26 13:31:38
d1cd02c96160df021db25ee8b5849baefafe5e2e1f3d9f29747e40c4c5cc1e982015-05-26 15:12:49
d163d9a6678601becdd4f8cb4df26a01e0960f2e7e4c336a6ca016a58862e4582015-05-27 21:58:03
45bceb480ee54199c1cd241f4f4025b9e64a5f62010746227ecb25b18845d1992015-05-28 09:10:38
d027f821ad57fdb5b3bac3ee30d22182062e3832d648fec7eeacbe24ac7789322015-05-28 11:50:07
93de6694765995c5004d4a2a3c75b3957b12b73dd11693fff2d09bafe07829b92015-05-29 05:47:16
aae50ed1fdd105c38920371e2e3c447214bbced5a4a9a9ea1e916051a798ea6b2015-05-29 15:18:10
e75ec5ada3080fa2dce6d067b1e46fbf0037666eb22e2b8079d047a9809ac0bf2015-05-29 16:54:27
4651a06e4463da6fd9cfb03b4d03dd544f49890084ac3a854e3c250d6bbc84692015-05-29 22:00:44
c31d8989be058dc4762f00968c3df3c776b0abf0f0804882bdd5d50e4790a3892015-05-29 23:41:37
62a5a0e1552f05ef261598b60d95e94bf91237f5f703d3f62a6c456cfe461dd22015-05-30 06:38:44
b274d8e254ce4ad45a60fbc551a5a8c5a044429d266b1617e964097cf4c7c4da2015-06-01 15:22:46
cf7b1e43d327dd2589133ac8fda2a1009ffd58645d52d5b90bbb6b02aba6101d2015-06-05 16:02:57
64e5eafac62aaeba0ab15d0663d7bddbbf561f04af36b0feb2016463668bf5392015-06-05 17:42:39
701eb45a11c7600a738c4b2c2f52888c5fc58beea8fef5e968bbc40828bcb7852015-06-05 22:07:23
cc9eabafde5cfd87a79b9430a44dc1bafd8b9aefd5f306cc964c8cd6513901562015-06-06 20:09:20
6d85032ad6afcb0284e4a0d4719cc8e24c57dba67ae062406522065dc3775ead2015-06-07 13:20:25
e280d218f653f0d4651978b845eaa10cfb4334e5d0002057eab9d6c8f87a8f942015-06-09 13:16:02
1b1bdc0c075fbbc103bcba7d1890e4109a167f4da39c46b2d0a952e6cf4702a22015-06-10 15:07:40
abdcc4e4bab8b24fb7c17a0c2b37cae096fefff4494de990edb5d6bddcf63efe2015-06-13 04:13:47
7b48ce8c4e2e9c6d7484ba7583b83b4df5968668466c2ee327d272addef3fe722015-06-14 16:00:24
df0e556145271179fa5e7c05038cc36b7f53bfcc6d799e04c4163c3becbd35182015-06-16 08:24:05
3513ca4a7751e5e785ecd708f759bc24b593db80ce6c8956fe4f7fa7ce9826f22015-06-16 15:16:28
0178c85ab19168721d82854395b60c967042be703ac6343a63e0c862dc1eca052015-06-16 17:45:15
feae84290bdd10c8ce0ba5f11adbd6ee0403aaef3a6a97da51cfc79b4d92039d2015-06-16 20:29:02
cf6003715d5e9a096fbf10bcb37ec2f25d365d51da4989b0389ac1286252ec1c2015-06-17 20:57:41
7c943a9122a919b7039e51a3766b6392a33b4fdf5132b1bb83e37ba2a3b1bdcd2015-06-18 16:14:07
4a3f2e408596e11e4654e20e821885905cf61d47635378b1c28a55dd8e56b6582015-06-19 13:41:23
1bd70c6b0ac1a8dccf49e65247545f8ea60bab6636ca236a85559a306b7820d62015-06-22 04:16:49
6fb8f099a71c1afe601ae6584d368664ae5a542237b1fc91ce62cdbc22bd7ac62015-06-23 11:17:50
61fabd06910317d7bc35df3eacde9d43e4151827a5c7af62d126aec4684194db2015-06-24 23:07:52
245c034873a9599510d114812e24c4c700a47dc65b2a4d24289400cc6938c8222015-06-26 15:13:13
d3c7baa7654097f13f66a7ba29b3bf7181e58f6a85c217b17babb2c05682f1842015-06-28 01:11:20
f7f31ab6e11f52a15f3cf6c2a61d3cfadf535128575e55825dbd0f8e005c283f2015-06-28 15:55:04
e2c0d58922a0e81213911ad47426f4e318297231cd5f2014ba2809ddff809b382015-06-29 09:35:31
375eb92c099cfe5ec6126e8755308c95d44e73682e83fbc93243d53bfb3259752015-06-30 12:06:43
93a4f68d4a575e801bca7b17c7cfb0225679797aa0240817d8ca61761379d69d2015-06-30 12:12:51
15756ea20f766353a6388233f29838b07e08492ade59aa8aea4aa58fd15498512015-07-01 16:44:56
f0598abf289746497e87c51032a95f2636c2e1311e9f50190cf471e94b1937d42015-07-01 16:53:12
87403d73883f0a580837d7292ba3687ef4a490de0e69a7bb3ef5d6316ee9047b2015-07-02 01:21:13
e90dae6f8ec2dd982bbd3ca957b349cce77cc10a0f8c6e3d1ff683e7183a44dc2015-07-05 07:22:26
c4643840ddb5488a4f064c1811d7b23c16538041ba1509d2d67dbe7adc43e9b32015-07-06 22:18:57
82351c7fc88bdef4d39d87cd6a318a06e4c63fa55a272fecce9d4268ede197672015-07-09 21:35:13
19d06a047b24449e816efe784f605aa8d86306439becc3e74961aa285489bb9a2015-07-10 10:28:59
ab59e766c1754e98a83d41a2a752d33c3594a367ec6cc3751f8e6e5be94eb8d92015-07-10 21:07:42
9eaa65eacacd482a48f21895e73faaa6188214a6b4539ad0dad4987a080a51f52015-07-13 14:34:07
57196aa774d9a37d204db85ed2224d1492900120adfb9f6529966131e761d1342015-07-13 21:24:52
90fd0fb19f482a4205cabc246786676f3e018dfedaf84a81512b0f49d22c49542015-07-14 15:56:54
9ca7bfa367b40aba9121288bcee301ff93edc89db4ceda6e963d934a8c3469f82015-07-15 03:34:58
52c934fd384a02b5ef90a89dea05693d4f349f35666a9c26773e93afff48371d2015-07-15 19:52:24
6c67b8b2e3712668b7a2d5e55729485ebfe9632bc6ab3c330801c0c114f37cd02015-07-15 19:58:07
b4c2c994ba4345d5dc37f5298c51f721fb28847a741fb78274c710ed5116b98c2015-07-17 15:50:25
e897971a34d508cd7c241ecab26a49138e4540fedbd5b6dc6b255d5a0af640452015-07-17 16:54:50
681fc1ed7eb78b595782c8b4fe629bf6a24dcc56a90a7d71a7ed61965a6b2fb52015-07-18 15:49:15
d4db484c7fdc87b301a2f572a6c9b98d008ec1205a731c1d559c8e844e527db22015-07-19 01:18:36
1aede5dd6260a25bff76875a92b8d5e2c9c0aaea0769e580daa6f57a3533d6b42015-07-21 17:01:07
16bc5bf07fbcf3c208758b49ae748e36d725f15d89a7aedc3d408deb13b5c4512015-07-22 14:41:29
e4cabd7cd90ed2e8a3cceacc34f2995f95acfb41caecc31b52aab74adb6235fa2015-07-23 04:12:28
106a43fd6f108bf3d2e59380cf03f0005cb1796339bbf632fa632632b8ad24042015-07-23 04:17:47
350f8d2950852e07f9675c4b1d2ca72d2affe2995c8fa90d2b4e31b2ffd2cd052015-07-23 14:00:37
e62a8528969a89e1d8a5a8ef5ee4190b24dcaed604e5b3197846aedbd84423fe2015-07-24 14:30:31
de123f30c7302a1932581a6a91b1c0058ac4fa0dd87bed08bfc9468ccd683efb2015-07-24 21:27:18
bb2d4d8861dcf82a51861e8719e5c0d53ab7362cc56134bf724ddd0ed17e4dc42015-07-25 15:58:40
81bcbbd9d7bc3b649325b40e5262f7431a7717020b0dbdb1e9cbbcb966938b802015-07-26 04:40:58
abea8a05798cf61de41eb6351c6d5002ceea5e62446b066ebe0f0bddbab620a72015-07-29 13:59:27
9a24d3bdd722f9f060b1e112a3f13e7e45c8126ec65f62c51709cebde9b5d5e72015-07-29 14:07:47
b4e800336de661c7d102389812d07a49a52817cfe13d0337d5eff767589c6fa62015-07-30 16:39:26
236422857876fc7642e2c8c3b0812015dce26119e212d118550af5a68fdb93132015-07-30 16:43:28
7d7718249dff7ea03ae367ced7f50ab5ecf99558bb2c0229305ea3ee2b821cb12015-07-30 21:48:14
e10579345f69a6d615a48574756f9aa812101e27d508c7ee42576724b3b42f692015-07-31 23:24:06
d0878bde0b339d6e8f1dfa1efa2032c370514efc61e855a123843415e06593512015-08-02 16:00:27
a24d52326908ed4bbf331981723510c16fc84f6ad8e92853c6f3c23bac4cf80e2015-08-03 04:50:57
18ae1756de1510f5fa795f4d96961c2b466f43a6e378f8fd262bcaf7e67b5d6b2015-08-04 15:18:26
e31bf349edef30ed510c067c7ab90f775fe2450b3e291f85f5c9511773f390b82015-08-06 08:43:41
5f716cb91aa9b0722afc6e96cc32a643a905308a296624db8fcf0773a8579df82015-08-07 02:13:57
9ea5655df078af9fd5f0a8288d7ca563ff9325ec71deceb6a2433693d86cd5e22015-08-07 17:33:46
e6d7d4cac56f197e9191c0a5c5c540576bf3bb8743ea34e0338df7c936b249662015-08-09 04:54:42
91a2d2f35cdf8f55315f5272d25f202a27623a9b91e897ca63bea4c08ff25a3a2015-08-10 11:21:04
93e64322f023e51af0357241a03cbdf6974deb68fd8b5f45adc2417bfe19a2ff2015-08-10 17:17:46
5330a2c98a216ff87733fe3377e5793298c747a83c617047f861a9da0ef559cc2015-08-13 08:38:09
a9f8b7b1c3d987ef7517c32e33bce4d0cba61007bddb4ebf25f445d34c8586382015-08-13 08:44:07
82622c3ae133bd1768a0b0185cd31ebb648bd1bf96da609f80805e80f7b4aee02015-08-13 08:46:17
93471b22f83dc79495f40f619e66274746f64275330c9eda35a4e5d8717ec5762015-08-13 08:53:32
288ea407cb67b0347bf16a487a42eda3916e73a761c478e923cb01896d5846c42015-08-13 08:59:04
593b151f61ab8c60d14ae249aea2cb1f30639561818fc16cac0e75ebd478557a2015-08-13 09:05:02
09c629aced4640b7b06d8f880d8a506a86a56d9ea462b0039f4cfb79966f7e242015-08-13 09:16:32
ce802bdb01d6ea8d7aa169807ed21b5c9a4972af8173453c23bb7a49e96357c42015-08-13 09:26:32
9c947bc8a37d26f83249008f2e7dfe6128ece7d3e064ac3445b0f8c0fe5232082015-08-13 09:28:28
213f7378f35d6d61b2d9a9ffe61fa1c06b00a4c90a49aca5c4e86273bd7b05b72015-08-13 09:52:09
f6c5c2bbad977ae6bbf94385129f90b000be1d060618f9e15dd823fd769859932015-08-13 09:56:31
e3eb924c7261ec109a70f3ae465d10ca0ced588519b63892ff917d80085ba7092015-08-13 09:57:35
d3c24da311dd6296432a5ca59b91c1198d69e6b5fd3e728a20f9ff61427ddf162015-08-13 09:58:30
f8906c10a0f1d9a124325a3688b14ed3c7707e13d57d7b55dea00b9b43f518ea2015-08-14 04:42:18
74a61a4214b82c0117990e5be6ded21fac5cab4bbb68d6ae5912aa22563c12a42015-08-14 05:06:12
bacad53f8aea4249178e79f2aff1b64d50ada73d8d433e79203e94a5ab3d25552015-08-14 17:57:33
3c326154b51c94a91abaf4f84bd57e386afee9652b8c29450f7b791f63cdd8102015-08-17 18:43:14
db366430745a8e214c1cc144398a20df7140fa1c2826278e9c7497d64bf268632015-08-17 19:34:06
eb14296db142e0a6e856dc3690062dd45b9922eb5b218fa9b28be1a276596b502015-08-19 10:04:07
ebfc9eddb6ae6e9b36591973a11360494e0279fca5f2d88057e78db7e75456b02015-08-20 09:27:56
a29e367e38a653a395f3d32027b6703636a1708fdbe2eeceddb8daa565cbd4db2015-08-20 15:51:37
54ff8f28cc2bb1550a8fd1056d0bfa8cc6aff9ad2f75becac5e6ba4d32bf16a42015-08-27 16:43:21
f10a1966bcce9f7547375ff9b67e8e849e0d2f78c37ce00a2e0ff2a64cf299082015-08-28 02:44:40
755303cb366d5e54c220d4a24ffc540626b6468a3890eb4b51d2d60ceb264e7c2015-09-01 19:33:43
e6b5b309d165067985c230953d86c5a28432ea097482add729c753f27f488b062015-09-02 19:23:45
7b57134bbec76ade16699d307fb61e05b9f6026195350b50deacb87387b1b58d2015-09-05 23:16:01
188465c5b53db75d7dd94f96d9bb3698aa3bd5bcbdd2e572bf1789dfb99507952015-09-07 06:28:34
e8973c9d7ca8b67234a3a6cff8923bdcfd6f553d6e7ae902f1c53fd9685fecb52015-09-07 06:29:15
9fb723ac2f7451156af92730287435045b1db18222cb7400f1f62d2ebd22a0082015-09-07 06:29:21
023d4964c74f4649fe82f0ef521614b530b5ebddd81311cf29d2b3152b4fd56b2015-09-07 06:30:28
fd2d9822dc26f2a0e96d1e0196488df67f14910a0195e4fe7fb977e5e4dd60c82015-09-07 11:02:09
4eeaf4be756a6226172ae8bbfddf7a109902ece4b325869c1623df636211f38e2015-09-08 18:03:52
3e128086d601f06f22348db17efa9fd9411e023b36578196b7f57eff5f658d552015-09-08 18:06:38
44269f287b5d57daa854bd481f9f4f4eed9d201326023a689915d32b36d250252015-09-08 18:09:53
d173bc2ad6a57e015ea39ed523874fddf83e127dbcfbbab271e62e5aca472e742015-09-08 18:10:40
5811028567def217c3654d2c3897e277144f98268b0a3aef290331bd7ecabcac2015-09-08 18:10:56
74a4e5317f4bb723b4a3a9001c82cbacc80689a9a9cef4ce7afc348a76e93a972015-09-08 18:11:50
e2a13e0c4be62077ff9cfefef78fd2610ce8a4c4c19e5ab71abc019ddf65327a2015-09-08 18:12:13
dfb340fa30b99fa55ee653ae1a17b938b4299f52f519af43508c4f7014c17c3e2015-09-08 18:12:24
0445d8cabd1d177d1099f5d230ca5593a93e6e53a3bc7d49e7695a07b6e3ec572015-09-08 18:13:20
077bcedbe4344813d618970640b948db162dc183b17455d8664872b64c9c7fc42015-09-08 18:13:29
330ab15f208a5db92b5a4967b2de9ffe6dc5f1c38b0df82c548a3217e477cdf02015-09-08 18:14:48
138e3f4935d35db97d7973823a9d3ee9b12fae9aab11aac1f60f1e9020b6528c2015-09-08 18:18:45
cbacbd4065f9af06d340d1cc977f3d7c9a4f2f7b2ec18647fd6eccf332aa45972015-09-08 18:21:25
e792aa1ea4a408ded47216037d52721dad9f60bee274d5d9b2a22e826a6420b52015-09-08 18:22:58
b459330cea09dfc6ad875568f04b55c5de56bdbd5298ca8a6626cdb8894aaac62015-09-08 18:24:55
727ea3d523121f1034b4d6a64bcb927a12e18fc9cf5def4957042260e51d078d2015-09-08 18:26:18
aa336b8390127e3ee3eb56cf621015a1762507c1bb78258f265668e021f8272b2015-09-08 18:26:52
de14517df88afc50da3ad0e6692d481075a12c59829a65a2c6f0d9da46a4e2692015-09-08 18:30:05
fbf483a32bf51302d750205ab5ed2e2e09de821e3e96bcb7853ec77c0944bfdc2015-09-08 18:30:16
f93f85a31d65ac8a401676be7fb997822fe234181b82793bb5ed15df81554f732015-09-08 18:33:16
4ed6c3dc8bc5e87b8762c059207f41f8064e2ab76330774dda27082f0b699bbd2015-09-08 18:33:38
7dd7c984a132925efd628fc49199ea190b4c05d04c47880ca14c28341fab1f862015-09-08 18:36:44
d53eecf218ce035ed229701c3f74d59b71b72d9c1a2cd12dd5ac9ea381e61cba2015-09-08 18:37:07
de2a1302c69f8907b6e65d5153371c281ecbbc8e283fd8322b2f663f1f4d3e312015-09-08 18:38:17
4d764adcbf15d0834522c31046a464843784eadae215d01ba09ee15fed94a11a2015-09-08 18:39:22
66365ece809a9f4f54358c853ab4b17ceadf8487ea4c59e58600a2dae9fb11d22015-09-08 18:39:38
5ca6c65345a9ceea7f790073a1ad3b324d4916284851bc8e48174fa60d58b3b22015-09-08 18:40:00
9d66248af1b8d0a47aa9919b32b49cb4196557e9d2f15922619a3c74170bad912015-09-08 18:42:01
95c88901dc7d9beddc89f02fe8b4ad4fff30cf6367db789e4894068cd2eeef842015-09-08 18:42:03
21ab7897566c1a4278607d309c6fdf780cca70e5399de2c4adbcd4df115efff22015-09-08 18:42:56
232f84ab8672e885a4a4ed76b0a978c00e9c3be66baad3d4406fcb5808c4c1bf2015-09-08 18:46:52
7c5806cb9b278e6c73072df702badbfaaf2c82a368ec4debcfc167aab7cd27432015-09-08 18:46:53
54ccd769194ef3a4b3d4a6eb1dbe963e98aab5f354cb3910b7d8a8ad981d45572015-09-08 18:47:41
54f55fdd7cfcd6123f1a1bc9a01e9cc4903f15370761d3a60efbce697758bad32015-09-08 18:50:53
3cf47304180efd91887bef17f9eb6787e0e48cab1b584a2f748e79a1de8e73042015-09-08 18:55:19
5c2f5b42624de26e041a35f3252fdf2f8b183ba84bc4831161b500bce07ba2a32015-09-08 18:55:30
fdb67a4e0cbf80a9534c2bcecd2e83b20a5359c364b3ed957be017f0fda5e1b62015-09-08 18:57:24
37998ac968de8ad4fc4a82c7421aa7fe57838584925c9ed86a8a6bc544e8064a2015-09-08 18:57:59
45373e5d4f9bcd60a26f684046cf82e3ef6bee3335d6d0bd7ed2122a7adb509c2015-09-08 18:59:43
883af577fdcd9d1398589ec374c6173dc55d37dba02aed132229dffd951bc71a2015-09-08 19:06:24
320ee9ed2169198a7546d311e3e23c175740fb11c5d38aeb12bf3475fb801b082015-09-08 19:09:42
ad70dd13d5fc0d73c4a377b8a51895675eee7a4f5b37f7fbbc2a9aaec1d6c30e2015-09-08 19:11:57
bdfaadbbb76b8213076b1c4105a136ac35e39c5d2fbb7c5656bbdc74f6c3a5792015-09-08 19:13:25
fd08f00fdcec136f041f753a75f8f7776ef9f0aec78d06a3d734e874ecdf75172015-09-08 19:17:01
d3022bb434da4e69478a9ac84eb36cc9263702aa368f2417e7f34d4249e6568d2015-09-08 19:17:01
72a838e7cfcde3e4eff8cf707304eebfe429439bf345025f5e3a6f56d199b1c62015-09-08 19:17:24
fd46f9d85987fcb4c89e16c95d70cbaf0c200bbd19742f6fec186455358c940f2015-09-08 19:18:20
de1e5986f143e5d7cebb172953a93dbbef50ddf42a99b51084471aa8d74b98452015-09-08 19:22:06
aa6142165d43bf92a7a5e85c365d9cf72da58f22288fa21f4103d5ceb86ed68c2015-09-08 19:23:07
f7ec2d3953cd9c31d5f953504ad7abd50bc08386d70f5c62854be912ccdaebbb2015-09-08 19:23:51
3d7da83a4743bb18da78d588098c797fd9ce933f8d57f8ee8d7f7d115ed46e452015-09-08 19:28:32
72c00e2c782b351e458cd1fd558dec9e9ccacb9f6569551df455c574423d85e32015-09-08 19:28:46
33f6c06b6c55ec59fd83d925dd01489a0c4316c21ba59f5330716517900c38182015-09-08 19:29:13
95e915a54a7fccf0367e99206160a62660604facaefd198cf9267767d017fc4f2015-09-08 19:31:52
5dceb7853951335b80862fdcedd19bd43f82b6cdde30afda5e280cb3e403aea22015-09-08 19:34:36
03d04a272c6dcdb4abef1a20cce98e447904ab0bf1172815af1777ff79e937dc2015-09-08 19:36:37
78bdf42df19c5f143e5b863360064dbb8f0ee13d371a4a858742d209a7dda2a32015-09-08 19:37:09
e66237b3ad8a40017c4f79834b1bd609a7cbdeebb1f50a3a0d848a54ed83b33c2015-09-08 19:38:19
61ffed9932d035db71c1ed5055ed735c3e5d0c24446df4e689555e06c81276d32015-09-08 19:38:34
2e4747fb1e1e9dcdbeb175483c9bb4cae2a7163adbcff6c44b542f1f2fbdfbd42015-09-08 19:38:45
da8dadbfead1d8553d52d98ecfb04446e8ad5d78477ba50a38e8ea736ada2ac92015-09-08 19:41:29
019edccbf0b0c3988c5a4e704c788a67f7ce8522ede8644da0aab9709b84929c2015-09-08 19:41:35
b7b757cdbea162c1191eb37d58a95b8eac0fdbfc3edb3a0bd539801923c7f74a2015-09-08 19:42:55
f275d5413612b02825bc1d34126babea5bfdadbe62627d2d163d691e6cfabacc2015-09-08 19:47:00
9a940ac7759944758df36cc8b360e1919e2f5aaf2890f050f2eaf8ffdf789a6b2015-09-08 19:49:16
7113aa5662405e7c0a161be668720017fa7d96c19fb44c9dcdef2cce93d86f562015-09-08 19:51:38
b57032c92cbcf469976940dcabc2557e12cc99e75cbcbaf718628cdcefe90d2f2015-09-08 19:52:04
56a165767fcc04d91f38eafb4793c80681cb2772af960b07e2013d032bd731602015-09-08 19:58:25
45898a764e14bc26385de40f11884c9b482601f19775a5298f8d8e13429c92722015-09-08 19:58:54
592d20c7541d68c440d588a37acc07374bfc0d9c0666509a2a75c11af36d11262015-09-08 19:59:43
0cb0e692ee385ab4702e8c090db743b1054d34f345142967bda14d5b809d8d862015-09-08 19:59:57
2980eaf9cd8dfcb33fb14fae9c93f609e4c6fdc34ebc319f53ae56c7b5d6569a2015-09-08 20:05:48
837c5cf285e6d12af08ee7b183a0de87f4a47efd725fc8d898c653abc2a5a80c2015-09-08 20:05:54
10c449dcbc3df85456f4405aac1a095fe87a6ce5366b6471284f4ac7ac267c142015-09-08 20:06:50
7c2b24813ed7bc68eaa81ebab2c2c71f81d3da0edd059dfa47cb97f804ccc50f2015-09-08 20:08:43
843fce353f249a5f2cfcd0c7502701d0724e49f53e5b82129f58fe993a2750102015-09-08 20:10:25
1b9a141a62da459b6320382efcb0fb878b42f424e3d4fb72f0f1f84a092215e12015-09-08 20:11:00
4473e0edad9aa8bcdabf9a9f9dfe1490a102a58180ce777b070c9a64a31f79732015-09-08 20:17:55
cda68ce45a2be5fcf77008fa43b5640652910e1f1f7b51711b860080be29c8082015-09-08 20:22:16
57da250f096136eab5dbb48d89d19067f52ff71840958b21d606cead9fb5e73f2015-09-08 20:31:32
8a068e50dae1577f5d7691f12bff82299b559becd89443e5a2d6f43a63a186052015-09-08 20:35:19
f2ad46faa49f9c83514c29578aef0eed014596b7419a12829b00fdf2550d1e072015-09-08 20:36:07
4313a2d36344dae2322ef4bd973c25cba09a114abe716be06333287fdd1395c42015-09-08 20:36:47
54dfeba5df2ce4f4f75e4b311a05b42ce635f3363f4bac2a07cc90505dcc3a9a2015-09-08 20:36:49
cc8768459810b4c2a55c12ffc87d546394ec242038052016196d99f7dd456a342015-09-08 20:40:12
868d4e29025e30d0fac5895237fb1301161353c33f2be6407cd1453099ff4dca2015-09-08 20:41:56
16407e6d1b6af91dbbd40ad3cae89d56ff86328ed0ee232f82f5bee864ee3cdf2015-09-09 00:16:02
0f9c3270a6c1f92034d1fd5300feaf6aa88da9da4c3ab4091189a9f8f00f71ca2015-09-19 19:35:52
b318949ee3e400ebaf42a3f44524be274faf834cfb85896097b4ba8021ce426c2015-09-19 19:42:57
354158f903c56cedc0d1631ef96810d2c66f4b8b53aece62e6f757f103d10fad2015-09-26 01:28:22
f4e133b0a10f136984e1ed654af7dde902ff25e62f9a33b299d857348354649f2015-09-26 04:23:16
add2ad3f42a28dbaa247636f3e3ffad5b4f452676cccd6be41f305825ce26c452015-09-26 04:23:22
08c996e48a616aa881ca4da7dfed40a521fa2a14cb248fec5cd308de8dba54e52015-09-26 04:28:19
b8c48dfa2b669f54e94a9a8e6e4ee35fa0ebac09c52f4dfec4ae6a6c7fca74212015-09-26 04:32:35
e44da1fb68c9bad236499fd37d9ae04a0e8963e3e5aebe36fd05e07d728902b22015-09-26 04:42:08
4bce9552bc710d3835c25e0ae47df9e763b8c568180b65e9463f2dcf919f918f2015-09-26 04:49:23
b684d08c6fd6ade5fc26eb26ed69095bbc5066fdbe968966426db2fd5276ae902015-09-26 04:50:57
e29bae912ed2c996b40752f622cb1935304835d5dac6ccbbb433c2f41fb32aac2015-09-26 04:57:19
985237895c17e99065c6db3d86d98725de8380776979d16c6d76ecde5cb2facf2015-09-26 05:04:33
217e64d22868bff1d8e5567b0204804ccde1752336ac7fbb8296518a72fb3b6f2015-09-26 05:15:24
7b6f5b457e9ae8252c38705dc42a8a3266910b3c7ba25ae95b28198bcf8ccae82015-09-26 05:20:45
18afa3b2947efac6bf8d6a2fb922a7f4eff3d1851b323762817014b7fea34ba22015-09-26 05:26:34
df4b18e6154bf6c1c614f9b4da12beda761c1ac64d681d62bab979f85eb512682015-09-26 05:29:32
dffde5082ea1d7b8b868a521cb07861d8dbc74a2757991ab119793b1a2afb2072015-09-26 05:30:33
3ab1848e7ec9f9baf8066c33bd873e8e1a49763233f4068dccf53cda07a062902015-09-26 05:32:39
297ef310a1cf2e313e0a4dae214fe8dbffe272111202f0dc9c880b419cf5df402015-09-26 05:45:08
9d39f8dfe9bd489f758c91868787b4dca0bbde1f307d166b46c542c429207d582015-09-26 05:45:49
49d114261ceb4f40b05550128e120925fc7a661b208f740bf1e0259c7323aeb52015-09-30 10:18:57
e1626945e2f92db34fdd0686a17942b46bf55917ed24ce92d33365d8be47838e2015-10-01 17:21:10
e10dd835b516c161cb3e0eb0b263dcdd10628359ef040bc071775f995b7382342015-10-13 01:06:28
4e32d986190111d3fbd3b9b3f382b9f3f9f4843678e63a0bfce8e0fa5e9199792015-10-22 05:15:33
7d181d514e39a78c568d4e775d9d3c4362e96c832032040ef544d2f09665b3152015-10-23 16:33:51
94852e5e48934816cc103ad52dba511053f721aa9344e8b4ca558a39878eb8592015-10-23 17:28:56
139211579a7d0f00685b5f3dd6c833e28c9dc4161c0f5c7e024ddb97e795db482015-10-23 22:12:38
c985237c20a106887efbad31d86da6639ddb5a994af5836428cc2a74109a14622015-10-26 05:48:15
9b213b0a592d91004b5bda28d69dd4426616bbb0e5130516eb35ec467d6f603e2015-10-28 13:56:39
1556c461ff12468e7124a51a22355fc5e590059c01b924e2d06af867228c15062015-10-28 17:22:29
ae821737978bc1a24cc0e095933cbebb7c7b2c5252dc67d0020b4506609d99482015-10-29 00:45:20
8634eae65f381022143e5bced8e5dc19aa406b7b750ead3d6fbd27cf68d905052015-10-29 18:37:57
09c929cafc14333e03feedf2adc48ad139ebb1c89d019c238f2a2b29d0aaf5d72015-10-30 15:17:07
9d751b9b44a9f1e6f400a596ebe186ab1dc3729507e2bb9b0de63925e1af8df82015-10-31 16:45:41
ebc76b0d401cfbe5d952afc86b30538657204200fa0d83cc4f87df50eae3aaca2015-10-31 18:31:02
11e170f7098498ba0d48f006d4f8e8eb8dc7cafdc4ba64abbc77f4d1ad6c0d1b2015-11-01 11:57:30
d0e35aab7229d23afce4a53f28bb21ba2a31d397e7f6599819c7d0f432d6abf22015-11-01 13:50:13
0cb98230f7d96827db2c6c2b66a36473d5aed396677a0cfbbb3581ba958d99202015-11-01 21:46:21
1267ac794fa1c0596f82e4ed8ef917831a112b54eeeb8ffa54c507d00bb2e5612015-11-03 18:14:24
1d262cd0b390381587aebfee4737e740dcda3babec3feaae9768e6558cebdbc02015-11-03 21:25:13
af05d12fb6c7b404bebeea3d0eeafe017a1c3849e7ee5798b8e2bfdf10dd8c872015-11-03 23:16:37
af04b3d8e27f2bb42d8b2a37e4000bc4776d6679bd8a30d680c6bc1abee5e7a72015-11-05 03:05:04
92058ac110f9f2528f63b6006b171a2feff24f12778739b96e1d1347988ab1f22015-11-05 03:29:35
d55a53a862a918771c79beb7e98e108581efe8affc355a6b115b13b4420bcd372015-11-05 04:17:11
977a8ed2aa542fcd8d8f960a07aa5fc829f6e646a46fc26721e8ce6b9f6be1252015-11-05 04:24:14
063b5e79d6c97074b1351c0728f9a59b18bea6ccd2a1339dc6cd747047d097412015-11-05 05:22:52
41fe5b1a4ae4ffc983326143a1ef46626fcb7dd5850ddf182f6c2f4a6f49feb52015-11-05 10:56:31
593e07071af8129992b3b08b9a2fdf309a17f37386f6947739cbf20bab312aa42015-11-05 11:26:03
e5aeebab14e6c16dd4e15fd73776ef6eef3f6bd81c0fdea04694fcdcafcb0cea2015-11-05 13:38:00
68ddd641ac15acd33155b40d23563f1d811bbb97b1654ce7e2bb7314d3c0e7232015-11-05 22:12:03
0cf89a1bb82f27efd03b97b6db9b30bf7a56892f7e872e2679e2337b4d78e6ab2015-11-06 02:50:47
7d334d84e7bedb42d45cca6aa7140d560f7515d467e590989afe183cacc2d5b92015-11-06 09:31:32
64ad3eff44957dd3e6792b2dcd8ecee3123229cbd7cce52ca0b4950330c042d82015-11-06 09:36:35
e4bb0af51817ac87663940a4f99de3faa1720743771fca3b45456f77d151f42a2015-11-08 00:20:11
6732880f32454b0019a3da3ba2434ba249bccaea6b1414d435e33270dc9145b72015-11-08 11:28:23
2abf713fa4345124da334e8f241c32c811d7714a32133a216f3ddf5181068a7b2015-11-09 05:31:35
78bb38aaa8a1d2c4a46e38bd940d96fcc19cb8d9925479f45c9299078d07f6882015-11-09 05:35:54
5c6fa11b7bd17edcd3dbc46a3853f8b8933ae12e1c86daa461fa90cfb6d0e5262015-11-09 06:19:31
93a7e3b39eb6f8789d141831e0836e96de3a8506154cf47219f7a720bdb34fd02015-11-09 06:26:47
55b03a2297e77390267407e494b44ec62977e8317de81c8d10e15033c58ad9932015-11-09 06:35:46
dd8b3969cc7b2c49c57885369c95994fc99278eaccffa61030da3b8fdd7746092015-11-09 06:37:20
e98d6a1ff4ac2c0b2baa48d7ea6b8802c527daf89e7e646d50279029b0228af12015-11-09 07:01:29
bddc2e4b263b392775375c35eeef4eee09729ee43293c505a49d61318354bdaf2015-11-09 07:27:48
4689314a20b79dec52b3baabb9e644cf3c43971ddfeef05a5cb72e8620a2681f2015-11-09 07:45:45
13aa336c311705f71dd6709caa2d76a0a5c41adc4fe1499bc8da8139a12a7be52015-11-09 08:44:54
2db4f9e5300583af806705d66e8641c89aba6f2fc783c66ba55097c5820b00012015-11-09 09:50:00
de62490139b605e6d4122562c835ed835a29139db08e165c942a1784d6c17af52015-11-11 14:24:04
9da768db9af60f543b69652f7f731439c6036841bdfa5b5b0f7173f6edae5e552015-11-13 14:14:19
a9f7ace21338b4c2437ed3263ace16f426f2e180b3e7bb73b981aef9a5c056362015-11-13 14:18:46
88ebe7caafa96a47a016b0b19fc0b91207a794c2af9f0b50ab19b50cf7ce807e2015-11-13 19:05:41
7b677001233b7197d77d4e557bd448b30c84eab2586635e11c3fe73919eead1e2015-11-13 19:22:01
326ef39b87ca40e4ec5e175fbb147b89d9cabe6d78b11c68f6bf37ce5d62f28a2015-11-13 20:31:22
b9830349f8c505333de3216d2bf2979a3ac3897abbd6ef0962ca95cda9068bad2015-11-13 20:57:02
12ce8990af784315cb321f2a1624f17c0c91284af8acf47fbe5a75a7905174f92015-11-13 20:57:18
b1b063c0b14df10584ca9eb0169fb1f70cadf765589b90eec5681415bcfb86582015-11-14 06:18:47
0caa6dbb549b3c1160effc26a77f3cbf68d15392d8c1ed58b59887ae3cca57a32015-11-15 02:42:09
cbfa9af2216b974e24f5ad86e7ad23194d2a8d147d9b23a9ff58905fe09ae8ac2015-11-15 03:04:43
4431a94ef83dd067d43ee5ee182f2a272741fc42c7a6a56cadd2a22205809cd02015-11-15 03:25:05
f2e95c4118efd5cee2b423ac66cb9bdb51ed9eeef388a7c537659954ba7bbd1b2015-11-15 03:58:05
e06c62d4e8df35473a5012ea68918e7bf6a319f9a14974e472120e0df89df5152015-11-15 04:36:45
dc134b77daa53d1b56978503275cb208b530191a300f5f6560996196958c391e2015-11-15 06:01:30
5706eb271742c273e58c419059c986b0ebeb2214e5e0a471b29547180c00580a2015-11-15 06:06:14
f9ddfb291a1c785fd2bcf3f9ed59f7d64e0d1f9f1b39ac7f369f881244fe516d2015-11-15 06:20:31
4ac45d73bfa0e1a64a839e3bedbe9b067ab0dfec31f00e05b2390757e3c34b5e2015-11-15 07:42:41
bf7988ee1f5669c20230ee2f0d210e39def4a40faec3aff04893ef8b544f68b32015-11-15 08:01:08
243e0cc9f1f1132861622766626b4fb028bb6ffe2e6bb8086ed99ba09ea0d31a2015-11-15 08:09:20
6a7a202fa2d494cbf43b1d44c4710e79eca95b68d83e99ac8a93e3471382449a2015-11-15 11:15:27
fd2bebdf062add402cb67efad61add04040224977e98ff14d889984a21e91f602015-11-16 04:57:37
8546334b5467b052559f16d12f3bada6f7127a7d86bf1b1099b48aae7530dcf12015-11-17 00:07:09
e43e1bf11bd6c2e5c6611a3ac18a0545b18af613c97d64fc559b9b659fb194bd2015-11-17 07:09:15
033819226a24287567cd7c2b222bd82181dcb2d63023dd5f91a61b83b33a6db62015-11-17 17:26:53
afba7c794d3dc68d62d796164f0e4c2828891cd70d6c0b4094e6fa4775c3bf282015-11-18 18:21:46
ab636ec259b3538b64c981909b390fffe4dfb314854c7aa7bcd67da46401963c2015-11-20 02:11:05
fbdba30dabdf2216674a5ef7ba031757abfea05d2cdbaf3bdec3a53d68dff04a2015-11-20 07:18:52
0b4a9e84de3c73320189208171e1113f18a1f2535c2d1a5b71839ed747d6f88e2015-11-22 05:36:21
7696de9ce43e95593a38048a5d52aaea354c3ea5e636d78e6707ef87630ae0322015-11-23 05:24:42
abf9ca41ae38bbd1691f4f554f27738dc379ed8d458f9a7b83981345987112782015-11-23 05:29:31
cbd3be76418d225c41838113419a7b5c8ec8992dc3fcbb7a7d4f0058834094632015-11-27 01:24:52
a7238becf37432a02d945a3dcdd97ac997b4af8f032c6baf5c8296b95f4925822015-11-27 01:43:36
678e0581b70e57d3d4a607fe052f05a55ce9f4e8f66122ce84cc25bc7bad815c2015-11-27 02:41:58
7505ad7ac7ab0c2e11ead5c8acf31dd3de8494d2b2ef9a9d08c9f128e9635bee2015-11-27 03:22:56
36faf4b93d40692adb51cb8c371d1310a2f631c8e0097fe219a69b5f770600c02015-11-27 03:23:55
847859e0163c364452b13444f697a0853ad49c019128de5eae33ed7a8e604f042015-11-27 03:47:51
7feceaf5398693bb4fbbbecab4f6127b4a42a1a79b1f2b893fa80dc2a7d5be832015-11-27 04:24:32
c78c176622b5dac5aff1c36d2008a0567adf1a3b9041a3d75ff448462dbd29d12015-11-27 04:29:13
9e0c2351b31044052a0218675a300ae7e570c317519ef8b5d171731c05e72bfa2015-11-27 05:52:56
bca404d9d88790bdfcaa3b4edeaf7ec7cbe0df77fe8f5c4e388c228549451fff2015-11-27 06:10:32
f447533e3ddec52305be9177511988be3568b56c0918a5b32acf3989150ecc9a2015-11-27 10:26:26
2d53fbd311034a98a2f3d120b97db623481574c13887b1f8a584849e3a8e4d242015-12-16 20:06:59
c85c0797afb881d6fc71fbc7007f3e7e4a3645a832bff766f06fcdf3f1a644832015-12-16 20:16:28
9bdf5610fdb740ac15d710205fbf15cbd04807d634d3446fcc91c925c55ac8622015-12-16 20:45:18
f3a06de90f14e8b03253dfd49c6a571eba000b3e5ee3e36fb31e9b2dbb196f292015-12-23 18:13:21
82e7ea5ef62156105c12e6c6d3703d928aa1fd0c276003987792fb631232d5642015-12-24 12:48:18

Archived Comments

Note: I removed the Disqus integration in an effort to cut down on bloat. The following comments were retrieved with the export functionality of Disqus. If you have comments, please reach out to me by Twitter or email.

Jawad Ahmed Jul 22, 2019 06:40:13 UTC

Hi, Can you share the .pcap file of this malware, if you have it? I want to see the pattern like how many domains are generated, how many NXDomains are generated etc.

Johannes Bader Jul 22, 2019 08:33:10 UTC

Here https://mega.nz/#!ObwxnAgJ!... is a PCAP for 1e135d7e024f2fb57182ae3313acae6d.

I only ran it on a simulated network, so you won't see how many domains
actually resolve and you only see the decoy domains (same pattern
though).

If you are interested in seeing the ratio
of resolving to NX domains, I recommend you run the Python script to
generate the 5000 domains for the day and check them. I would be
surprised if anyone is still registering domains for Qakbot.