# The DGA of Qakbot.T

**bin.re/blog/the-dga-of-qakbot/**

Qakbot, Akbot or Qbot is an older banking trojan from 2009 that underwent multiple
[modifications — Symantec calls the current version Generation 10, Microsoft arrived at letter](https://www.symantec.com/security_response/writeup.jsp?docid=2016-011409-4221-99)
“U” . Since at least September 2013, Qakbot relies on a domain generation algorithm (DGA)
[for C&C communication. On January 11, the blog malware-traffic-analysis.net showed such a](http://www.malware-traffic-analysis.net/2016/01/11/index.html)
DGA empowered Qakbot sample that was spread by the Rig Exploit Kit. Others have
reversed the algorithm already, but I could not find any public documentation or
implementation of the algorithm online, and therefore publish my notes here. I only reversed
one sample and did not spend much time finding other versions of the DGA, so please
interpret my results with caution.

The DGA in Qakbot is interesting for multiple reasons:


-----

Qakbot uses the [Mersenne Twister (MT) as pseudorandom number generator. This not](https://en.wikipedia.org/wiki/Mersenne_Twister)
surprising, as the bot is written in Microsoft Visual C++ 5.0 where the MT is the default
pseudo random number generator. Still, to my knowledge, it is the only DGA that uses
a MT; Usually, DGAs are based on linear congruential generators (LCG) or hash
functions like MD5.
Qakbot tries to detect packet capture tools. If it finds one, it does not abort like many
other malware would, but instead generates decoy domains to fool researchers. On the
one hand, this is innocent-looking to a researcher compared to staying silent. On the
other hand, the operators of Qbot could register decoy domains to track labs that leak
DNS queries.
Qakbot uses low level Windows sockets for it’s network traffic. For example, instead of
using gethostbyname or DNSQuery to resolve domains, it will craft the DNS packet
manually and send it with ws2_32.send. This bypasses hooks on the common DNS
APIs.

## Reverse Engineering

I reversed this sample from December 23, 2015:

**MD5**
1e135d7e024f2fb57182ae3313acae6d

**SHA-256**
be9625921253dca2929c849d3ea04fa9d406113bda9459af2c79487e7afdac88

**upload date**
2015-12-23 20:51:54

**malwr link**
[link](https://malwr.com/analysis/MDg2N2M2YTNmZjFiNDZlNDhlNGIxZjc3MDFhZTYyODQ/)

[The sample unpacks to this executable. The executable decrypts and loads this Qakbot dll.](https://www.virustotal.com/en/file/ce557aec10bbe7705e4632003a6b4b0ecba63cafa6f2b2c330ab58f129882d4d/analysis/)
Microsoft detects all three stages as Qakbot.T, which is the second latest version of Qakbot
from around July 2014.

### Seeding

The seed to initialize the Mersenne Twister is calculated in four steps:

1. The current date is determined by making an HTTP request to one of three popular

websites (offset 10009417 in the next graphic).
2. The date string is reformatted into a different string, which also includes a hard-coded

seed value (0 or 1).
3. The CRC32 checksum of the resulting string is calculated (the two last steps are done

in date_to_crc, called at 1000942A).


-----

4. Qakbot tries to detect packet capture software. If it does, it increments the CRC sum by

one.

The CRC sum then initializes the Mersenne Twister (call at 10009444):

**Step 1: Current Date**

The date is determined by making an HTTP GET request to one of the following websites:

google.com
microsoft.com
cnn.com

Qakbot starts with google.com and only tries the other two options if Google is down. Qbot
uses low level sockets for networking, which means it manually has to forge the requests.
For example, this is the data it sends to google.com:


-----

The request data is built with sprintf, and then sent using sockets:

The response is read until the HTTP header “Date: “ is found. Qbot cuts the first 6 letters,
which correspond to “Date: “, and returns the resulting date string. For example, “Thu, 21 Jan
_2016 23:31:32 GMT”:_

**Step 2: Formatting the Date and Hard-Coded Magic Value**


-----

The date string is split at the space character into an array of string pointers, for example:

[“Thu,", “21”, “Jan”, “2016”, “23:31:32”, “GMT”]. Only the day (“21”), month (“Jan”) and year
(“2016”) are used. These values are first transformed as follows:

The day is converted to an integer, which is then mapped to 0, if the day was 1-10;
mapped to 1 if the day was 11-20; and 2 otherwise. In the example above, the value
would become 2.
The month is converted to lowercase, i.e., “Jan” becomes “jan”.
The year is taken as is.

The resulting three values, plus a fourth hard-coded integer value, are then formatted
according to:
```
%u.%s.%s.%08x


```
There are only two known possible magic values: 0 and 1. For example, for the magic value
1 the seed string on January 1, 2016 is:
```
1.jan.2016.00000001


```
**Step 3: CRC-32**

The string is turned into a 32bit value by calculating the CRC checksum, so
“1.jan.2016.00000001” becomes 0xC758FFB8.

**Step 4: Packet Capture Detection**

Qakbot has a hardcoded list of executable names that are indicative of lab environments:

The tools are:

tcpdump.exe
windump.exe
ethereal.exe
wireshark.exe


-----

ettercap.exe
rtsniff.exe
packetcapture.exe
capturenet.exe
wireshark.exe

If Qbot detects any of those executables running, or if it finds the WinPCap Library
```
wpcap.dll installed, it will increase the CRC sum by one. The CRC is used to initialize the

```
Mersenne Twister, and the small increment is enough to lead to completely different random
numbers.

The way the day string is transformed leads to two periods of 10 days at the start of the
month, and a period of 8 to 11 days at the end of the month. During those periods the
domains won’t change.

### Maximum Number of Domains

Qbot generates the domains in batches. The second arguments determines how many
domains to generate at once:

After the batch of domains is used up without success, Qbot loops back to generate
additional domains, up to a total of 5000 domains:

### Batches of Domain


-----

The routine to generate the algorithmically generated domains first decrypts and splits the list
of top level domains:
```
com, net, org, info, biz, org


```
For my samples the domains are .com, .net, .org, .info, .biz and .org (a second time):

Qakbot then generate five domains by calling the dga routine (shown later).

The five domains are then shuffled:


-----

or in pseudo code:
```
n = domains.length

for i = 1 to n

  swap domains[i] with domains[Random(1,n)]


```
This randomizes the sequence, although not uniformly (see exercise 5.3-3 on page 129 of
[Introduction to Algorithms, 3rd Edition).](http://www.amazon.com/Introduction-Algorithms-3rd-Thomas-Cormen/dp/0262033844/ref=sr_1_1?s=books&ie=UTF8&qid=1424430552&sr=1-1&keywords=introduction%20to%20algorithms%20third%20edition&tag=viglink123228-20)

### The DGA

The dga routine takes five arguments:

1. OUT: pointer to the domain
2. IN: (unused) an integer (256)
3. IN: the Mersenne twister.
4. IN: the array of top level domains
5. IN: the length of the top level array


-----

The next image shows the disassembly:

The routine calls generate_random_string, which takes the minimum and maximum length
as input, to determine the second level domain. The dga routine then appends a random top
level domain. The routine generate_random_string disassembles to:


-----

The routine first picks a length by using the Mersenne-Twister. Then it calls the MersenneTwister for the determine length to pick letters between a and y. The letter z is not included
[due to the same modular arithmetic bug that many other DGAs share (for example: Necurs,](https://bin.re/blog/the-dgas-of-necurs/)
[Ramnit,](https://bin.re/blog/the-dga-of-ramnit/) [Ranbyus,](https://bin.re/blog/the-dga-of-ranbyus/) [Tinba,](https://bin.re/blog/new-top-level-domains-for-tinbas-dga/) [Geodo/Emotet,](http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan:Win32/Emotet.C) [Cryptolocker, or](https://blog.fortinet.com/post/a-closer-look-at-cryptolocker-s-dga) [Corebot).](https://bin.re/blog/the-dga-of-corebot/)

Further details of the DGA can be seen from the reimplementation of the DGA shown next.


-----

## Reimplementation

The following Python code generates the domains for any given date and seed value:


-----

```
import binascii

from datetime import datetime

from ctypes import c_uint

import argparse

def date_to_seed(date, seed):

  dx = (date.day-1) // 10

  data = "{}.{}.{}.{:08x}".format(

      dx if dx <= 2 else 2,

      date.strftime("%b").lower(),

      date.year,

      seed)

  crc = c_uint(binascii.crc32(data.encode('ascii')))

  return crc

def _int32(x):

  return int(0xFFFFFFFF & x)

class MT19937:

  def __init__(self, seed):

    # Initialize the index to 0

    self.index = 624

    self.mt = [0] * 624

    self.mt[0] = seed # Initialize the initial state to the seed

    for i in range(1, 624):

      self.mt[i] = _int32(

        1812433253 * (self.mt[i - 1] ^ self.mt[i - 1] >> 30) + i)

  def extract_number(self):

    if self.index >= 624:

      self.twist()

    y = self.mt[self.index]

    y = y ^ y >> 11

    y = y ^ y << 7 & 2636928640

    y = y ^ y << 15 & 4022730752

    y = y ^ y >> 18

    self.index = self.index + 1

    return _int32(y)

  def twist(self):

    for i in range(0, 624):

      y = _int32((self.mt[i] & 0x80000000) +

          (self.mt[(i + 1) % 624] & 0x7fffffff))

      self.mt[i] = self.mt[(i + 397) % 624] ^ y >> 1

      if y % 2 != 0:

        self.mt[i] = self.mt[i] ^ 0x9908b0df

    self.index = 0


```

-----

```
  def rand_int(self, lower, upper):

    r = self.extract_number()

    r &= 0xFFFFFFF

    t = lower + float(r) / (2**28)*(upper - lower + 1)

    t = int(t)

    return t

def dga(date, tlds, nr_domains=5, sandbox=False, seed=0):

  seed = date_to_seed(date, seed).value + sandbox

  mt = MT19937(seed)

  for i in range(nr_domains):

    tld_nr = mt.rand_int(0, len(tlds) - 1)

    length = mt.rand_int(8, 25)

    domain = ""

    for l in range(length):

      domain += chr(mt.rand_int(0, 25) + ord('a'))

    domain += "." + tlds[tld_nr]

    print(domain)

if __name__ == "__main__":

  parser = argparse.ArgumentParser()

  parser.add_argument("-d", "--date",

      help="date for which to generate domains")

  parser.add_argument("-s", "--sandbox",

      help="domains when sandbox is detected", action="store_true")

  parser.add_argument("-n", "--nr",

      help="nr of domains", type=int, default=5000)

  parser.add_argument("-m", "--seed",

      help="seed", type=int, choices={0,1}, default=0)

  args = parser.parse_args()

  if args.date:

    d = datetime.strptime(args.date, "%Y-%m-%d")

  else:

    d = datetime.now()

  tlds = ["com", "net", "org", "info", "biz", "org"]

  dga(d, tlds, args.nr, args.sandbox, args.seed)

```
[You also find the code on GitHub.](https://github.com/baderj/domain_generation_algorithms/tree/master/qakbot)

## Samples

There are two different hard-coded seeds, 0 and 1. The seed 1 is much rarer. In fact, I only
found the one sample analyzed in this blog post. Seed 0, on the other hand, is very common
with hundreds of sample.

### Seed 1


-----

**SHA-256** **Date**

be9625921253dca2929c849d3ea04fa9d406113bda9459af2c79487e7afdac88 2015-1223
12:00:00

### Seed 0

**SHA-256** **Date**

5d815068ed588b4b7c0ee34873548da49e4fc91aad0ceab9a2b9872670a8744d 201405-15
16:42:45

652a50c609acf82f10274cb917b11ec528f75154ae149203296e648948412b38 201405-17
23:38:21

49301bf209dc73d1c10fd5884fba33f557c9062a9285d779eaa5e81e665ca05f 201405-20
07:40:02

aaa45dd6f88472e50dbed9ca5fdbedffb12a81b0501613f40a1a580153d18ea8 201405-20
09:12:34

ae0b1c5b7967f8d649bd7e96de55253e1cbdb07baf4b65bd11e547301e1384f1 201405-21
13:19:44

fd38f8da23753a91f020398cff2dce264396c67e962c08b10025bc7db5d971a7 201405-22
07:17:25

10c744789ea2ca1f676ca5ecbff7574f9102525ba106e8598dddbe952dffe803 201405-29
15:58:28

e4154575c1ff28256408be805c9f3b05ed777691476a9f1d01206769a164ce86 201405-31
04:04:38

dd9128c3da483db4b5f0766c3ed1c18dd2bbe5c42b5cd77cf68a8f2ac6e6b7fc 201406-01
16:06:17

5843da19f61b5d438db50ae17792090c5887c04986351ca660c364f8287d744f 201406-03
00:08:30


-----

**SHA-256** **Date**

116a557e355f10185ea4a035d97bd94d8823ccbca9237273f71fbae3fcfe672a 201406-04
07:27:36

2f84adbef9adeaa7f9a46928592ca558cc82e0fdc9ee19779dfb2668a2d120a7 201406-05
13:05:16

d53d7032bb727dfb6bd63c66715e71a7ce0c462d36682c7a3eeaebf58e490d20 201406-06
18:48:43

d1530f8d244893d78d2ca75ea3be8dfae2d4711b7d671bfa142fb8e334a86ca3 201406-09
13:24:55

2f31f1bce7502d226735c90db3bb9438a238c3c85db6e43cc2342578a0af0489 201406-09
20:16:28

2ce602dccee44ab5598a2352d244f59bb1819d4d565d575cf25c6529e702f6bb 201406-10
15:53:57

cfc68a5d0e2999fddbcffc18d46eaec88f53361cfc5ced629099d61822941aea 201406-10
20:40:56

2bf98f3b39644bafd1229cefd8869547271027ea9a5aa1deef118155718af8b9 201406-13
07:11:49

7220cf63489009c7e7a573d387bd1f9953d0a0743439c373175dba90227949a7 201406-20
14:54:25

8a081bfc6637e08da73eb956e40f1a591e7281b3beeabb49db3b6d95f641985e 201406-21
00:54:59

9daa0a03dc1313afa810249de3072f471e095bcdc0eca03437b66bf56aae34ad 201406-23
09:00:51

c79aa4266b4a4a1c6387347fab90aa493d700ec56f042e8c58aaf27725ac46f2 201406-23
20:16:18


-----

**SHA-256** **Date**

3a8b94a282f81e6ca03b0e2d74c1b54658ba7921f296c8675ad53fe7407083ad 201406-24
00:01:18

dbcd62d9c30039f73cb6ccbc84a5e356533266b6dfd92100ae563f03a40076ad 201406-24
11:23:53

41b2f909d27007adb2ad3e0d2be9c222ed5ed1c3c550de89b7de9b609adeef3f 201406-26
15:42:25

4f57d29f99cacaeb3224f4aa081cb34b5338e478f60d72afc7e2748ae135784b 201407-01
13:08:01

4e9493bd58f47b741200d99c701126b3c3c2131032f3bcefeb97c52cd315bbd3 201407-02
19:22:42

ddef1b288b1f515b1843e264366aadd14697d0a9b05481c195afaae71914cbbc 201407-04
18:56:52

4eb5742af2f214c9bec0500c08a8136f72762d027da948cf94b3837cc624f7ba 201407-05
05:56:39

6fb0ae0acec0bbdf1a0fe32bf9df850927c8f1a7b08dff316759b86cf0c3490b 201407-07
13:31:39

83c77d898da3356bceac9a4c2cc10b364fe7bed3cfe426a6ff69b7351ad5e865 201407-08
18:27:08

bddd9fe6663f115d11606aa7451cefe89f10c7003488de7ccd2daee805eb4d76 201407-10
08:13:11

f85384bafd4065cda9dd703ec9e6753c770d8ef1eb31d729c959971ba87c5ef7 201407-15
15:19:34

cc3f4bb1731d0cde57adaac4054a6f8224b2e004794e5e9803f8a1d29fa8df10 201407-16
12:41:48


-----

**SHA-256** **Date**

668cb5bc660f0c1a40a57e4c13eab50865ad82e7782edd5e387f7a8a9cfd554c 201407-18
22:36:33

a0eab5a407ccc0db30965ed5af1a90d308d5db4e5ba53702b175dad260c1c817 201407-19
21:06:40

39f0b727634d479be6f52a4ec38293c70f52f4a1b73c874c24fd195dd2b1cd58 201407-20
01:07:15

9d2f3a3b88c05b629cbd09f41f82099677e97a14689965914999287fd1d136f9 201407-28
13:12:39

cb2a63e917a7056f64f0d04d9173c53d88171cbd42c690131d510e3cbc1d43d3 201408-01
13:48:18

92eb2a1f2306665ae7ac238d2e2f24f267dd7b996dc8f7cd04b21adb531887f6 201408-01
14:54:13

49224f2a90a225bca8b0e6da4375d7876a64f2b2c3b2011a36c63cfd9d376c0b 201408-14
11:48:07

9c2ffb4feeccb57a27f85558043f22a8618e3916eb6b5c3f60f3443610881148 201408-25
15:39:23

ad33569a69b8fa85bd86cd7e16ce29f71b43580973608e86b1e124e6d44f3b08 201408-28
05:27:53

4b2dfccc4c028dc36eed090cd7738f825e012c4e84fa5a09ee11ec4168b148f3 201408-29
15:51:32

155ee1e7fba4d57497759e0d8aa518393c555361057bf0428b3ef8d37bab3f9b 201408-30
16:06:41

7c4560025ca3dcb8d5595fbb04a87880cf9a8fd56250a1fe2edb558637f1acdc 201409-16
06:06:44


-----

**SHA-256** **Date**

74ac2694226cab48a8295a4374aa0f3d5ef5060882210d8fd4202f4786943a8c 201409-18
09:45:56

9bd85d308b09a561f278afe1bda968784bf7d96f31c1f64f3e6e91ac1551e1d1 201409-19
23:35:19

0d42f249cae2837ab38a5cb79c253345df745c89947cb54a3ebe5b302cf8368c 201409-20
08:13:02

7ab508b49893b5f39149248756c4d30311f6edf3350661f65c86254e9cd7cd91 201409-25
13:44:54

dc65a1a9c2bb3752f84b29f5dd21b2a08c2b052b3af77ea22c203cb21818c166 201409-25
16:17:27

9395b37ed08c485e046a526bc1afaa2f701eb3299bc7bc5c0ed111ab6e6d7570 201409-27
05:07:31

e5d35c04738a9e44ee9a3d8a308b1a7200184b6d937256558a2bf823cc1cefd3 201409-29
19:45:46

d4040c8e2c9fb1fdea721d433fba10348bb57798c080e425a32641f6a0508c3e 201409-30
15:49:51

821ca00bf28b43e3872b3d7cf99ffbeb43836312e5ec714a9564f8de405d8938 201410-10
10:10:23

a4429871d35c18af61576ec45e997b9dc8997dd3a19e7e240cb8254e7d305561 201410-19
18:12:23

331a81a7a74997eb9523a3cd9cd0a2594a3396dfb323c45a22ab7b45bc944d9d 2014-1107
15:52:35

41d93157341d5a94347b3fcc25c6f76ad063b171b88295da498f22f92b43520b 2014-1111
19:42:51


-----

**SHA-256** **Date**

9715b518783b645959533b295cc83d8e5ba01f6cd9603a553a8690f7014ad88e 2014-1114
21:16:07

aca383ddc78cfcffd5e183aa897d1eccf0ffbf6b15dab7695705949b2632c9b0 2014-1116
02:48:23

6a8938c1675207327a3f2295d08ea1ac9b9e6fd7f28db14edfd4f385024e94c6 2014-1117
18:41:41

3faaa21a246a4dd1e9bd6460f773b6ee05b91cfc4f5bb726d77e0d08dba10e01 201412-11
02:47:50

60f09ae4ffbc8e8d6a2452ed4787390abc2b87a2ef703ac10bbd5d27a17dbfa8 201412-19
17:39:52

59cb803f2405228dec211fdc26de35090a66761e87396dcb741eb9eac618ff80 201412-26
23:05:47

9f59dbef5138cf62d0335f5ba42982422ea41dae1d1987f22a28d76da131cf8f 201501-19
13:11:04

632d19231bf45d7d39510ccb9e17196dcbd5ffab49b081e4ec3a40929850dba3 201501-21
00:09:44

0e46284032f2ae0e71effa8c58ae56a97973825ec6ce9801a554f0592553b376 201501-22
05:40:43

a5f1f4372d53856b73d6565203ec673d05901f28ae2973cbcfacf4765c01d5c3 201501-26
16:36:54

b8151f9f0c4c7995ead75125ada1737d6179f0c8e7bb6e4d13ba445c53acab3d 201501-27
05:10:51

5e54c98f8e937577249fa964a65004642f40b72506b16006363ec03f1db9bcd5 201501-27
14:45:27


-----

**SHA-256** **Date**

85c9457989390c9284138bd87f86337bb714fce8238ade5a75fe0abe3c5b699b 201501-28
18:23:26

c07b58bf848d07884fdf9d5396209b2819a5df902548e77211c70b4039010173 201501-30
03:43:03

df326767cf56302c8ee48c781e1fc48126be9db512e65ada72574604fceb659a 201501-30
14:50:54

bdd5679436949c66ce1032f19cd937c9f458de0590a6b496fbc552f2bd2d096c 201501-31
12:45:12

a05e6ad11f6eabf79813553f3156afb5e13c507b9ffa0ef07d7861a6395bb45f 201502-05
05:49:56

d580f02bfd0d2a254d6cd6772a7945aadc932cf4a7ba945709ebc0b8d9c1d1fd 201502-07
03:34:08

c505dd8c9d803030c5bc9932d61b46c3477fa2d936dac4c18d1f6192b77ee379 201502-09
23:46:13

9f3ee8719492483b762b455d8ac3883a287561054e8fe600c7913e5cebcc5d5a 201502-17
16:21:44

831ec44d888e14bd10ea7bf51b1c3c92b16315c7c85a1e8a94b369cf6b6a3cbe 201503-03
17:56:32

df0642ca49411a7c5eca4655e94dcc7cd97e944026cc1ca0594d86d94e016084 201503-08
21:31:22

7a9a5bec3ccab3b3ffaf25e2fb3ba107a69c77a08c2d580ace557e87653f0588 201503-12
21:43:44

4951a7f557203f979ed14f7678eee426bb8598937b4b549330bc128159cf4b7f 201503-16
14:39:42


-----

**SHA-256** **Date**

c731dd9c4afd56a0e06adaa7dbfe0def2511454a73fdf3638d1c0bf9cad0343f 201503-16
14:49:24

3896516ea2c5c6cf1656f5d30edaf51b563263378945a82759966d2e6772fd2f 201503-17
18:01:08

e070f9cede2953e3f138c192806cb87f4db2498e99f15e2682759a211d2ab34d 201503-19
02:08:14

a821910126e4f439ac07e51eb505c26e33792d39be8f751705d77a307cd989e4 201503-19
12:04:25

7c37af6e28bea255796f5055942893dd6564145ca461133a078bbff949a93092 201503-21
01:54:37

e2dfcfed198b4e35c35f89c328683f0872b8aa9b97f2fd449517a99ceee9ab0e 201503-27
21:31:09

cbe183ea75fd1aab102fb7a7ac5628a7214f4088ab0c5c1c77b98c260d2239d5 201503-30
09:17:10

0ae1db191b38045e1187eb63e40ef45e4790e3c4a6a093f8dea39684b4e53357 201503-30
13:01:09

e87657c24a52d2ea359d1cdd830b1019b2ded9302728982761ab7258beaf147f 201503-30
21:45:01

fb5fcf8a9b688fdbb8a982d1bf2adf2fb1d8cdd5b470bd0b22cbe8a7b09a132d 201503-31
05:31:18

76e2c4f17a3c2a94848b4491b86cf64611b4f4c9c5fb540ebcd57d0c96622d9e 201503-31
11:53:44

d36a59a1023c80305d9a33f3779b33e919808a717ed5e78259f70859cb744fa5 201504-01
18:29:25


-----

**SHA-256** **Date**

caaa5c49677c7bb4422ac561ffcbdd74703f1fec6144526ef3e3787b221b7a50 201504-04
04:11:54

7a6e634e5e7ca043a1ec0f2e2ec274d20940fb5b5a694e262b03938958ee9a55 201504-05
11:34:06

d37cb4b1dc22acd5c1f9dd3ede3db8464b32b34990144a7c29d7512626109d2a 201504-05
14:29:37

ca78d17109906a6865fdf206b234d9c0def3ff9fd33bf6791ad1974395eab0d7 201504-06
15:16:55

a24efc7f195b7fe80dbd350b67fd4a263ffbfd1abbd4e995bdc978694a57bae6 201504-06
22:13:39

aaa1edf9a899abc869b2ba5bea043e764bb63b7b44f3870466f8065601781ec4 201504-06
22:16:17

d159835a84410600bb379090153e79de8771bf8eb0534c88b43a6ab09ffbb1ba 201504-07
17:31:14

1baa95959302256dc9d413ccf60b876e4deca42ec2688953e9d7741771c945d0 201504-08
02:04:32

a1f7134ef56af7ca4e897c87432d54ab3cd0ba959ade57ac1d73a579a0756d34 201504-09
13:53:02

2c7dfaa529285a7048200a3cb3dde1b422012f1beeadd731aab719db0e757fc3 201504-11
04:09:10

261e5c3ee802138bfaccb3673354a093d67981b210c3d5637127074888be19cb 201504-12
05:00:11

c70eb3b74e6ad12f2ff033a575e2ad562b5a0b54b0f91c9fc960a6fd0fd6275b 201504-13
03:18:08


-----

**SHA-256** **Date**

440ed4eec97195f14bd33a3ed52423b1a115512471bf86e0e5b9380ba41b2ece 201504-13
14:15:29

939333b7f6b86567b9951c67f1686cb6424ab46070fb560aa5ee0e9fefc57ff4 201504-13
14:38:08

e19c3bf3041f32eaba1e6ed9d03efef19cf476716f162a524cad8c787a44d1fa 201504-14
04:32:59

2ff7bfb99e04d1795c66ca93f1428636ad61c791c2abf64d548ba10e789f2495 201504-14
07:31:30

8c287bd7beb9b9aca594609f25f1c3e889847ce1455c12f02784b8ab63154048 201504-14
07:34:08

136812e9afdbae82cd468fedfbb9700402a9d79f0f7c50c54b1e53a21f9710a2 201504-14
08:05:32

8ad9bbc82423734fdb610e4b9d5b4ee71c7a149973a0fae2b98fc38b9ecb6a8d 201504-16
04:18:33

90c5f9c52a4f0d2e85e04ed88881dab4cc85c414d3455bed8603f153e8904b7b 201504-17
13:47:45

893e61560756055a681389c5e0df74995e1c9364b71feb8cba3fc8ce7cc460a9 201504-18
23:34:15

a2d4b4d27d72de3487a44dc08b4f1d2d3cd26eb3ed1f953a110c71898994f72a 201504-19
21:59:13

4ea9c663f4c626fc9894a4256556b67fa909bf89663c70117f90c2eb7260b038 201504-20
12:04:41

5d3d9ad9afb73dc0397ebd48bfa4e456e61748f82a8a8137addb582a0361ae73 201504-20
14:42:22


-----

**SHA-256** **Date**

4c620987677df30839bd6d9bb23ca658340e6fa39059cd1c2924a5fbf53e37a1 201504-21
00:21:41

6ae8c5c5911638d32ebfdff19457510688b1168baa513b37d8fd53c0b23545c7 201504-21
20:03:46

575473f4e90c11d7201f391cc29c654a5a44b640846808128453df4b175bf006 201504-21
20:09:02

5b48130a7bd82ac52863bea7c391eebebdf281e31b65e1c59649949f09975206 201504-21
20:17:22

30445e974bb27cc5a46adb8318f14a92c1feec3064632e2867478e503dd077b7 201504-21
20:58:48

00661d19cb66c154abe01e54ecfb70d476f53af5f5ee49643daa68dd2be6be71 201504-21
21:04:22

67f186b7d713b4a792678d4eb5c09ace8f37fa70c3c0fb9998a98b2b3260a2fa 201504-21
21:23:38

5e162a06969408e46351037493841bff68223da39883f210ad2c25cf9f6c43b3 201504-21
21:58:03

5287da41bd8d47d8c96496b67d9e2d98e45e47f6a31a31b62189cca1d23ebd4a 201504-21
22:16:10

0c6184028e4d6d8b26218e4de00010bf5e60d8f53d854abcdd5a62ff6f62eb08 201504-21
22:22:35

be3d09d8e5e890cd5815346ded176a01c5ab63fc607554f87d7b03b39b3b9379 201504-21
22:44:27

17ff6e53efe399bf413d67eac52ec0238a0702eda9f15798492afdb1f3aaf535 201504-21
23:13:04


-----

**SHA-256** **Date**

3d593e983408a5db1264cf433e18cce192f615a5b591b50ebdddbd396706f505 201504-21
23:20:32

00fff247dda43bc75189c8038585e96c1570e2b76a4408a35667fd6cc49530d5 201504-22
00:10:03

1b23b6206b1d64bd724ed7fcf5775db0099a17f02c50bcdb11709776ecf5cd86 201504-22
00:12:33

33c1cd1757f93021693c5ee50ca721a0b3962a11c5d37e20382adc17b55e9d7a 201504-22
00:53:18

d0f691f0fa5b7e6b9554115035765b61f14f5661ead84593c0c970322a64317f 201504-22
00:55:15

09cb4da016ada345423cd34baba77b7eae3c267a64ecc1ead74bd381bc382295 201504-22
01:20:03

fb6994e8ffa8734e70180cc8eebda226d89f6bcfbe846a5528e8a12a94698cec 201504-22
01:34:47

8580826c88d992f38de076a448f87639c727786cb3cd36708da4f327f51dd50d 201504-22
01:37:57

e4d73174f428b4faaf77855526c4f377400d72844f2e3b20bb3a043546ad3fbe 201504-22
01:50:51

05f4fa90666031a7b045e53394dbc67bf15228df720a40b504fd9ca26e5e4111 201504-22
01:56:32

5e0ffe7fae46e30737d2d2387af5a712afa7ca820ae6af7d64d8c8c81dd745a8 201504-22
02:13:36

d5c4f8ce6274549442bf5c587fa75806e421a569489f7f0f5164702d7c08929e 201504-22
02:29:09


-----

**SHA-256** **Date**

b6d361565ceb720c18e0678ded321a328f355a3e2705dec04a129686aa6616ab 201504-22
02:49:35

2c98a66dd896b58ad22ce758e58796a68bee4f90d8b3745d961f219871268bdf 201504-22
02:51:02

57d890d805aeaadcab3f9a0f45f9d33e481204012d5e78dde6c98fa9c4817b2d 201504-22
02:54:04

b0b5323568c6f87ebda9fbb889cc635c2f135217172225f3c3315d348210bcea 201504-22
03:20:18

0931d40fa1a39921fc08199def148b0fb4e0887dc78997ce170bcb99c836b667 201504-22
03:27:30

b43cf373b40189b8da8029bb372df3ffc32ec439edc7e1c82544ac4f0482c292 201504-22
03:27:48

a61674cb8bfc362770f0938cfad9f34a9e4a6de65ab40945d5749fc7724e0c7c 201504-22
03:30:22

6a5663ee0477048f791408cdd6df14a4a75a154a6b84821f70a07c22431c86ee 201504-22
03:33:26

3b576dc59960b75a32710d4f84d831034f190e205c9204a4fc1afb1b5b6ba69a 201504-22
03:37:22

474186375b34fe652898c76c51adc5724af362b94bd9be83794a91c2f5c8e41c 201504-22
03:58:59

ae7e1fa52c116599928311362f65f44b79992ef6b2f32a5cea485f2233847bef 201504-22
04:18:22

9ea1494e318ed16f69d12605997cc045cd49a9ed78a7ffb48ec1195eb8e6968f 201504-22
05:11:58


-----

**SHA-256** **Date**

61aa2560df86547a18121db6bcf5a4ee7134f1032a46ebd28a8a29d82ff90a31 201504-22
05:16:43

49c7f33002fe46ee9b888e4385a2688ecab363b6a2abcde91f8c0977a3ecbae9 201504-22
05:26:26

71682077ea2f3f0f0c45f4cd85d1f4d5f42f0a128fd210131376ea370c71ca33 201504-22
05:33:09

6e2a011fb324b3812aaa4ebf5a8e0f4c2226aa7bdd4008609eb8d95c4f6168b3 201504-22
05:36:47

ded32849f86675f7c6738a04c2fdd0ea97d80eddc95c52d4c0d510136bde778d 201504-22
05:42:56

ad41a48d875c04c8ad5766e7fdd1b932871a0f7141a3849d72c15c528aa739e6 201504-22
06:02:31

401c65ef4d2b542b578dc5a6afd5311d7604f06c2299619549b1082a1d774773 201504-22
07:05:40

2a84a6825f382f56c89638849aaeef9dff1e254ad57c6d34530f5ccff399ea91 201504-22
09:56:20

45b024abda0ad2e0203b5be478b90360dd458acb5097741db782cc41acd9d64a 201504-22
10:09:17

f2ff81e0a2f1bc15eb45018953e764dd60088a7c3cc656e429cdad36f1dd46e9 201504-22
16:54:08

082e6d138a39d94d2b5b793e381ad355551a28a8aabaa32fc7dac9c0b1c655ca 201504-22
16:55:18

c184bed7ab422d23809cd52b6c4404ab1a4a6af68ec00fb0905b70419b678913 201504-22
17:10:49


-----

**SHA-256** **Date**

545c872142a705ec515826570b5d3ec82d1321abc28e234dc1faa92c6662f80d 201504-22
17:15:06

15d26e0b831b41186950eced02ceedadcfc9011d56e16db357e2414b71465ef9 201504-22
17:16:13

6e36b5998dc79da398a9a47f40b07b9de61f0792f9b583deaa8b8745c7c03da3 201504-22
17:16:51

7ef40ec0acf123f33276b84d4ea4f414e993da3b6cc798b8e3a5a6e299fb5e73 201504-22
17:24:08

a0aed54ee395e9bbb31870da876fb544dd9e75f5bf80545ac11a45ea5da0e27b 201504-22
17:55:40

5682e201c2f2b30309e70b7d7be6c3b5793b8c09698cac36bba9a29adcf2b105 201504-22
18:06:01

1a529331a831c0fa55b241899bee78ceafaa958a0bc9c4514e4e6fb33db23559 201504-22
18:20:04

428b22c92f29b334430c041c20efc4fbbbbb5e0e90e77d76adda2d7a3b6e7e39 201504-22
18:32:37

cb63263156a08ac50dd97a20a95c61800b56783564df1a1a3d1d736caa622c43 201504-22
18:50:03

39534de6de34ed8c400dfa40aa31cf9d51203c4422b076c9620e2281e2b6502a 201504-22
18:53:14

93dc94ccc3acec33bd80e7ed3c6a1e8e29178d6804467e365f6cc1a7492edfca 201504-22
18:55:47

693ebd9e15155063e41d6538cc060321b6b2744e686d93c3bec478607e1eb983 201504-22
20:33:05


-----

**SHA-256** **Date**

06b2e02c02e6df16db35d341ec4e146dfde4d893eecb418e88d626045916d700 201504-22
21:17:44

d3022738e152a1c94a023858b78b90cf24b4404ec6d3b448ccf21cc9695b825b 201504-22
21:51:36

e49cb51d14ac21bf595da82c9ad0476138c943a6f49d1a8c4c871056329d28a8 201504-22
23:53:51

f084328fa2bb40b1eddd6b1371c9eab8af2257cc7cb9298b801163eb26ca6ce1 201504-23
01:40:56

595febeccd37120ef0bb76fe4f344681be206984c6812c983cd614e491a56660 201504-23
03:15:10

e2246cdd1c699a9b40fc12d9f9896bf8c73e0aaf1d788cef41e0575a2850f736 201504-23
03:29:38

ce1c84ed34e413e8d082a5f587ce8f85945708114fd218e7e63d9861ac1f3229 201504-23
08:54:27

79ac91bab195d924ad03195b82040bc2be147ffe80f89244f2232702679c21f5 201504-23
08:58:24

c53221a010f53a61969b4f5fae0efc117bbc878936e573f08cbcfa30ea2c3404 201504-23
09:12:09

770554525ace845f8d6e6b795188afaff7c2b64e6d41ef57a923787ab1561086 201504-23
10:00:32

ec4bfcfd278709289f216fcb6959bd6f5c3521938cff003c5dac340472c7c1fd 201504-23
10:10:59

989e19d0813a86f18e82a27884088a11db63027f90e7817ceef7e60d7690bb8c 201504-23
23:31:12


-----

**SHA-256** **Date**

d032378420dc453ba2766d18a359334d736fa40cad905a1f6cabdaa644e5e4b0 201504-24
00:35:03

caf006d44a91b120a9dae2604babad2c450564838dc772b5271517ac61a635cc 201504-24
01:10:13

e0275098c7efdedafb1559b324ce1ca622f61a3c5ee430050efc519300ad37a0 201504-24
02:07:57

8641b44534e1345fd51770101e919f0c69dbfe6b7a7af42f391e3f9a34078586 201504-24
02:08:45

e0f2ed071ce4b9f064a8c6d839b52d2499dd42909b5deffdbdd10606727f1df6 201504-24
09:45:05

30d833d4765bb7fbf2eda1cdebee7f192356f7a61c587a83af080a8573091366 201504-24
10:45:14

51576a4f9505cfe3522d96691f2c9ee4590fb9f56061905a86221a9e90d5f06c 201504-24
12:50:31

596f286a38a82a6243f2c14333b491b56eba5491010065e9b6bd7b71015908f0 201504-24
13:04:10

9aa1a4aed816ccb977d8aabae22cb86b4751338139c30256c301a6a9a90c98e3 201504-24
17:33:35

5179b35ad749673e166695bf66db71e3e522763ad20e2c3afd78d02d9ecc107d 201504-24
18:40:49

881a7e7404a4387188dbdb586cae050f52bc3ef88e5799f4861710a821b16e5e 201504-24
20:44:18

081b595ee263425261aeb9f8158ffaf97cda0872d070fed6c1b632a357b3a62b 201504-25
10:27:32


-----

**SHA-256** **Date**

68f2066ad7ebdf40fe3b759bcaa0080fa0ec9e1fdba63d8ef9856d63e92c6077 201504-26
02:59:31

fdab7494ac11e4c6b7b3fba3fe645f78740b3e602d5092c2ba1f950c36d9136f 201504-26
04:10:52

4154d98a8f917cb64d53a9dadc7a7dcd2a63bc80250cf335b091e3722ec6b8c1 201504-27
15:14:14

ec7ad97c40ba878b0ca315b509bbd3f77e9ee4568e7b194fefdce4bc3609c91d 201504-29
03:48:30

84513ce079acca3bb7f89b24d32b5cb81b8f495e457708a4d85d4ad40397a9e2 201504-29
17:22:42

a654cefba18acc8e9422bd8d9826f2153fc48ab70d9d64eb91ee47dccc28e724 201504-29
17:36:57

5c145b93712b4798ab535d0d12aa872cdea5fe84614e652b7245bdf4b57e1cba 201504-29
23:40:47

8b056ccd59abc89a86c3bdb76525952dd197377bc2f5ecd4faff6b44e9456361 201504-30
07:18:06

0c48289133e3fc73f69535de108ba9378319a32b71438abb6d7f61fc929450aa 201504-30
15:55:12

fb696e936d65a81e11f024a7021a5b21b193241f5275422c237a4b87b8b7bb59 201505-01
17:38:17

49876878e6ece7dd5e71d10f32211c34cc947a95371e8315cf365563e068d7ba 201505-02
12:31:03

733b8eb083ff24b41058d3d10134e2512ecbd141dfbed299a0dec5d7051cbe60 201505-04
16:35:18


-----

**SHA-256** **Date**

0b7ea02edd9f8968dac4d023f3e376742abb91c1855aa35fd3659829fef68327 201505-04
20:20:10

eee0baf46e7ef2e996c2b8a4b43969b164749b38ecc7a5e3d43a71a16fabffba 201505-05
14:25:46

ca0527039d8ae8343f73efb665ab562aed8c1f478acc710d0e20ef09055e121f 201505-06
17:42:08

295c94fb639a633fdf2414def1c96a61f1f23ed39b7e9f6d4810c32b12ae219d 201505-06
17:42:46

d33d814b7e436ccc6a85e27ae8be90208a6a7060ae225254800856d1e72bf704 201505-07
00:51:35

5475b241f2be1e1824a323a90b510149d6733c0a6d9ea24652b4b243ca261347 201505-07
15:58:47

7a284d2efce4e37ff3100afdbc5c7e61a29bb1cf6e96ebee254e40d5b3295957 201505-07
18:46:50

f56ac71d7c40d35557f28c686310251849c5caa827f87408bc39a07cd77dc1ee 201505-08
03:20:15

0ac64df541f1ad462d44ada790ca524d8e02263d9cafd7401ab6afddb130d8f6 201505-11
16:25:33

f4d8fccd22c332bd815e1b13efe5c2e0e3b04e6cefbbd6f221d32609cfe8f646 201505-11
22:19:17

bd5b2718b2517c18599e7a2afd5d955ad81d4f65af9826e0dcaa85627aa54373 201505-13
08:01:59

3dfedd054cfc003c2755051fb8392626f4ab1ef0e5c62ea8f34997ce5c19ae82 201505-14
01:47:05


-----

**SHA-256** **Date**

4a74cddc17120de5ad0bb75817de9cab13481321dfaf03dc6d3f0cce23c8f555 201505-14
07:40:24

eda648b6856578c476bb6608ccbe63ed140287d628a6d813ef4b825358811e27 201505-15
08:14:29

e0a175e4a79eb18a29179b68735a41c14bfa70c3157e09d80aca11ab0daaeaf1 201505-16
07:01:27

cabc692bfbd8fb6799a95821d27532bf2ccbb29d1d910defc22a2d3ae647184f 201505-16
22:35:38

9a238c95de1ba5bc414aa0fd45297bf79f02b1de03d93a65ad74e91e37eb9ae9 201505-17
10:07:51

bf170f3aa14fff30fe48b554bdfb89600d154514d77f8e30076b7c6aac91b81f 201505-18
05:36:19

1af7b4b0bb919dc6717dd425cf885285bca2da2b216990828dc77b87a0bc018a 201505-19
15:26:59

080b8752b213b0d2df81427ba702d251372da4d23f37c71e3ca2e1be2332f9f6 201505-20
03:42:00

b398818488910bb520ae8b1e9f3cd3f6c456c62f981177b11383066685064705 201505-20
06:06:58

caa7d5c2d890f3b3ea456723e743eeb8557a125240960409a5801294be1fbf99 201505-20
10:39:12

6360809d0b8d463cb4dc5588a9b838af25fd2318267628e170d5ac30d74002db 201505-20
15:25:33

525bad96b9cd55721360876359abf56b67dfe3c1fd63c0221766a5c554b5545d 201505-21
00:50:12


-----

**SHA-256** **Date**

a52bebf24f2ee6b4c4dddb2cbd99acf544da905497483216a9d258acc102a464 201505-21
04:20:16

13c962c02f3d40307889c14e20fd6cbbe92da4ae349fdeff6660354e8e0e5438 201505-21
10:03:29

467bdae6fac3b776dbb3f82974e5d94dcf3797b3b73d27a99342974e0a6343c3 201505-24
06:52:37

54b9585aca7d8c742d8f3bd132dc030971b1d7249ee4f5173e8c0de19e95426c 201505-26
13:31:38

d1cd02c96160df021db25ee8b5849baefafe5e2e1f3d9f29747e40c4c5cc1e98 201505-26
15:12:49

d163d9a6678601becdd4f8cb4df26a01e0960f2e7e4c336a6ca016a58862e458 201505-27
21:58:03

45bceb480ee54199c1cd241f4f4025b9e64a5f62010746227ecb25b18845d199 201505-28
09:10:38

d027f821ad57fdb5b3bac3ee30d22182062e3832d648fec7eeacbe24ac778932 201505-28
11:50:07

93de6694765995c5004d4a2a3c75b3957b12b73dd11693fff2d09bafe07829b9 201505-29
05:47:16

aae50ed1fdd105c38920371e2e3c447214bbced5a4a9a9ea1e916051a798ea6b 201505-29
15:18:10

e75ec5ada3080fa2dce6d067b1e46fbf0037666eb22e2b8079d047a9809ac0bf 201505-29
16:54:27

4651a06e4463da6fd9cfb03b4d03dd544f49890084ac3a854e3c250d6bbc8469 201505-29
22:00:44


-----

**SHA-256** **Date**

c31d8989be058dc4762f00968c3df3c776b0abf0f0804882bdd5d50e4790a389 201505-29
23:41:37

62a5a0e1552f05ef261598b60d95e94bf91237f5f703d3f62a6c456cfe461dd2 201505-30
06:38:44

b274d8e254ce4ad45a60fbc551a5a8c5a044429d266b1617e964097cf4c7c4da 201506-01
15:22:46

cf7b1e43d327dd2589133ac8fda2a1009ffd58645d52d5b90bbb6b02aba6101d 201506-05
16:02:57

64e5eafac62aaeba0ab15d0663d7bddbbf561f04af36b0feb2016463668bf539 201506-05
17:42:39

701eb45a11c7600a738c4b2c2f52888c5fc58beea8fef5e968bbc40828bcb785 201506-05
22:07:23

cc9eabafde5cfd87a79b9430a44dc1bafd8b9aefd5f306cc964c8cd651390156 201506-06
20:09:20

6d85032ad6afcb0284e4a0d4719cc8e24c57dba67ae062406522065dc3775ead 201506-07
13:20:25

e280d218f653f0d4651978b845eaa10cfb4334e5d0002057eab9d6c8f87a8f94 201506-09
13:16:02

1b1bdc0c075fbbc103bcba7d1890e4109a167f4da39c46b2d0a952e6cf4702a2 201506-10
15:07:40

abdcc4e4bab8b24fb7c17a0c2b37cae096fefff4494de990edb5d6bddcf63efe 201506-13
04:13:47

7b48ce8c4e2e9c6d7484ba7583b83b4df5968668466c2ee327d272addef3fe72 201506-14
16:00:24


-----

**SHA-256** **Date**

df0e556145271179fa5e7c05038cc36b7f53bfcc6d799e04c4163c3becbd3518 201506-16
08:24:05

3513ca4a7751e5e785ecd708f759bc24b593db80ce6c8956fe4f7fa7ce9826f2 201506-16
15:16:28

0178c85ab19168721d82854395b60c967042be703ac6343a63e0c862dc1eca05 201506-16
17:45:15

feae84290bdd10c8ce0ba5f11adbd6ee0403aaef3a6a97da51cfc79b4d92039d 201506-16
20:29:02

cf6003715d5e9a096fbf10bcb37ec2f25d365d51da4989b0389ac1286252ec1c 201506-17
20:57:41

7c943a9122a919b7039e51a3766b6392a33b4fdf5132b1bb83e37ba2a3b1bdcd 201506-18
16:14:07

4a3f2e408596e11e4654e20e821885905cf61d47635378b1c28a55dd8e56b658 201506-19
13:41:23

1bd70c6b0ac1a8dccf49e65247545f8ea60bab6636ca236a85559a306b7820d6 201506-22
04:16:49

6fb8f099a71c1afe601ae6584d368664ae5a542237b1fc91ce62cdbc22bd7ac6 201506-23
11:17:50

61fabd06910317d7bc35df3eacde9d43e4151827a5c7af62d126aec4684194db 201506-24
23:07:52

245c034873a9599510d114812e24c4c700a47dc65b2a4d24289400cc6938c822 201506-26
15:13:13

d3c7baa7654097f13f66a7ba29b3bf7181e58f6a85c217b17babb2c05682f184 201506-28
01:11:20


-----

**SHA-256** **Date**

f7f31ab6e11f52a15f3cf6c2a61d3cfadf535128575e55825dbd0f8e005c283f 201506-28
15:55:04

e2c0d58922a0e81213911ad47426f4e318297231cd5f2014ba2809ddff809b38 201506-29
09:35:31

375eb92c099cfe5ec6126e8755308c95d44e73682e83fbc93243d53bfb325975 201506-30
12:06:43

93a4f68d4a575e801bca7b17c7cfb0225679797aa0240817d8ca61761379d69d 201506-30
12:12:51

15756ea20f766353a6388233f29838b07e08492ade59aa8aea4aa58fd1549851 201507-01
16:44:56

f0598abf289746497e87c51032a95f2636c2e1311e9f50190cf471e94b1937d4 201507-01
16:53:12

87403d73883f0a580837d7292ba3687ef4a490de0e69a7bb3ef5d6316ee9047b 201507-02
01:21:13

e90dae6f8ec2dd982bbd3ca957b349cce77cc10a0f8c6e3d1ff683e7183a44dc 201507-05
07:22:26

c4643840ddb5488a4f064c1811d7b23c16538041ba1509d2d67dbe7adc43e9b3 201507-06
22:18:57

82351c7fc88bdef4d39d87cd6a318a06e4c63fa55a272fecce9d4268ede19767 201507-09
21:35:13

19d06a047b24449e816efe784f605aa8d86306439becc3e74961aa285489bb9a 201507-10
10:28:59

ab59e766c1754e98a83d41a2a752d33c3594a367ec6cc3751f8e6e5be94eb8d9 201507-10
21:07:42


-----

**SHA-256** **Date**

9eaa65eacacd482a48f21895e73faaa6188214a6b4539ad0dad4987a080a51f5 201507-13
14:34:07

57196aa774d9a37d204db85ed2224d1492900120adfb9f6529966131e761d134 201507-13
21:24:52

90fd0fb19f482a4205cabc246786676f3e018dfedaf84a81512b0f49d22c4954 201507-14
15:56:54

9ca7bfa367b40aba9121288bcee301ff93edc89db4ceda6e963d934a8c3469f8 201507-15
03:34:58

52c934fd384a02b5ef90a89dea05693d4f349f35666a9c26773e93afff48371d 201507-15
19:52:24

6c67b8b2e3712668b7a2d5e55729485ebfe9632bc6ab3c330801c0c114f37cd0 201507-15
19:58:07

b4c2c994ba4345d5dc37f5298c51f721fb28847a741fb78274c710ed5116b98c 201507-17
15:50:25

e897971a34d508cd7c241ecab26a49138e4540fedbd5b6dc6b255d5a0af64045 201507-17
16:54:50

681fc1ed7eb78b595782c8b4fe629bf6a24dcc56a90a7d71a7ed61965a6b2fb5 201507-18
15:49:15

d4db484c7fdc87b301a2f572a6c9b98d008ec1205a731c1d559c8e844e527db2 201507-19
01:18:36

1aede5dd6260a25bff76875a92b8d5e2c9c0aaea0769e580daa6f57a3533d6b4 201507-21
17:01:07

16bc5bf07fbcf3c208758b49ae748e36d725f15d89a7aedc3d408deb13b5c451 201507-22
14:41:29


-----

**SHA-256** **Date**

e4cabd7cd90ed2e8a3cceacc34f2995f95acfb41caecc31b52aab74adb6235fa 201507-23
04:12:28

106a43fd6f108bf3d2e59380cf03f0005cb1796339bbf632fa632632b8ad2404 201507-23
04:17:47

350f8d2950852e07f9675c4b1d2ca72d2affe2995c8fa90d2b4e31b2ffd2cd05 201507-23
14:00:37

e62a8528969a89e1d8a5a8ef5ee4190b24dcaed604e5b3197846aedbd84423fe 201507-24
14:30:31

de123f30c7302a1932581a6a91b1c0058ac4fa0dd87bed08bfc9468ccd683efb 201507-24
21:27:18

bb2d4d8861dcf82a51861e8719e5c0d53ab7362cc56134bf724ddd0ed17e4dc4 201507-25
15:58:40

81bcbbd9d7bc3b649325b40e5262f7431a7717020b0dbdb1e9cbbcb966938b80 201507-26
04:40:58

abea8a05798cf61de41eb6351c6d5002ceea5e62446b066ebe0f0bddbab620a7 201507-29
13:59:27

9a24d3bdd722f9f060b1e112a3f13e7e45c8126ec65f62c51709cebde9b5d5e7 201507-29
14:07:47

b4e800336de661c7d102389812d07a49a52817cfe13d0337d5eff767589c6fa6 201507-30
16:39:26

236422857876fc7642e2c8c3b0812015dce26119e212d118550af5a68fdb9313 201507-30
16:43:28

7d7718249dff7ea03ae367ced7f50ab5ecf99558bb2c0229305ea3ee2b821cb1 201507-30
21:48:14


-----

**SHA-256** **Date**

e10579345f69a6d615a48574756f9aa812101e27d508c7ee42576724b3b42f69 201507-31
23:24:06

d0878bde0b339d6e8f1dfa1efa2032c370514efc61e855a123843415e0659351 201508-02
16:00:27

a24d52326908ed4bbf331981723510c16fc84f6ad8e92853c6f3c23bac4cf80e 201508-03
04:50:57

18ae1756de1510f5fa795f4d96961c2b466f43a6e378f8fd262bcaf7e67b5d6b 201508-04
15:18:26

e31bf349edef30ed510c067c7ab90f775fe2450b3e291f85f5c9511773f390b8 201508-06
08:43:41

5f716cb91aa9b0722afc6e96cc32a643a905308a296624db8fcf0773a8579df8 201508-07
02:13:57

9ea5655df078af9fd5f0a8288d7ca563ff9325ec71deceb6a2433693d86cd5e2 201508-07
17:33:46

e6d7d4cac56f197e9191c0a5c5c540576bf3bb8743ea34e0338df7c936b24966 201508-09
04:54:42

91a2d2f35cdf8f55315f5272d25f202a27623a9b91e897ca63bea4c08ff25a3a 201508-10
11:21:04

93e64322f023e51af0357241a03cbdf6974deb68fd8b5f45adc2417bfe19a2ff 201508-10
17:17:46

5330a2c98a216ff87733fe3377e5793298c747a83c617047f861a9da0ef559cc 201508-13
08:38:09

a9f8b7b1c3d987ef7517c32e33bce4d0cba61007bddb4ebf25f445d34c858638 201508-13
08:44:07


-----

**SHA-256** **Date**

82622c3ae133bd1768a0b0185cd31ebb648bd1bf96da609f80805e80f7b4aee0 201508-13
08:46:17

93471b22f83dc79495f40f619e66274746f64275330c9eda35a4e5d8717ec576 201508-13
08:53:32

288ea407cb67b0347bf16a487a42eda3916e73a761c478e923cb01896d5846c4 201508-13
08:59:04

593b151f61ab8c60d14ae249aea2cb1f30639561818fc16cac0e75ebd478557a 201508-13
09:05:02

09c629aced4640b7b06d8f880d8a506a86a56d9ea462b0039f4cfb79966f7e24 201508-13
09:16:32

ce802bdb01d6ea8d7aa169807ed21b5c9a4972af8173453c23bb7a49e96357c4 201508-13
09:26:32

9c947bc8a37d26f83249008f2e7dfe6128ece7d3e064ac3445b0f8c0fe523208 201508-13
09:28:28

213f7378f35d6d61b2d9a9ffe61fa1c06b00a4c90a49aca5c4e86273bd7b05b7 201508-13
09:52:09

f6c5c2bbad977ae6bbf94385129f90b000be1d060618f9e15dd823fd76985993 201508-13
09:56:31

e3eb924c7261ec109a70f3ae465d10ca0ced588519b63892ff917d80085ba709 201508-13
09:57:35

d3c24da311dd6296432a5ca59b91c1198d69e6b5fd3e728a20f9ff61427ddf16 201508-13
09:58:30

f8906c10a0f1d9a124325a3688b14ed3c7707e13d57d7b55dea00b9b43f518ea 201508-14
04:42:18


-----

**SHA-256** **Date**

74a61a4214b82c0117990e5be6ded21fac5cab4bbb68d6ae5912aa22563c12a4 201508-14
05:06:12

bacad53f8aea4249178e79f2aff1b64d50ada73d8d433e79203e94a5ab3d2555 201508-14
17:57:33

3c326154b51c94a91abaf4f84bd57e386afee9652b8c29450f7b791f63cdd810 201508-17
18:43:14

db366430745a8e214c1cc144398a20df7140fa1c2826278e9c7497d64bf26863 201508-17
19:34:06

eb14296db142e0a6e856dc3690062dd45b9922eb5b218fa9b28be1a276596b50 201508-19
10:04:07

ebfc9eddb6ae6e9b36591973a11360494e0279fca5f2d88057e78db7e75456b0 201508-20
09:27:56

a29e367e38a653a395f3d32027b6703636a1708fdbe2eeceddb8daa565cbd4db 201508-20
15:51:37

54ff8f28cc2bb1550a8fd1056d0bfa8cc6aff9ad2f75becac5e6ba4d32bf16a4 201508-27
16:43:21

f10a1966bcce9f7547375ff9b67e8e849e0d2f78c37ce00a2e0ff2a64cf29908 201508-28
02:44:40

755303cb366d5e54c220d4a24ffc540626b6468a3890eb4b51d2d60ceb264e7c 201509-01
19:33:43

e6b5b309d165067985c230953d86c5a28432ea097482add729c753f27f488b06 201509-02
19:23:45

7b57134bbec76ade16699d307fb61e05b9f6026195350b50deacb87387b1b58d 201509-05
23:16:01


-----

**SHA-256** **Date**

188465c5b53db75d7dd94f96d9bb3698aa3bd5bcbdd2e572bf1789dfb9950795 201509-07
06:28:34

e8973c9d7ca8b67234a3a6cff8923bdcfd6f553d6e7ae902f1c53fd9685fecb5 201509-07
06:29:15

9fb723ac2f7451156af92730287435045b1db18222cb7400f1f62d2ebd22a008 201509-07
06:29:21

023d4964c74f4649fe82f0ef521614b530b5ebddd81311cf29d2b3152b4fd56b 201509-07
06:30:28

fd2d9822dc26f2a0e96d1e0196488df67f14910a0195e4fe7fb977e5e4dd60c8 201509-07
11:02:09

4eeaf4be756a6226172ae8bbfddf7a109902ece4b325869c1623df636211f38e 201509-08
18:03:52

3e128086d601f06f22348db17efa9fd9411e023b36578196b7f57eff5f658d55 201509-08
18:06:38

44269f287b5d57daa854bd481f9f4f4eed9d201326023a689915d32b36d25025 201509-08
18:09:53

d173bc2ad6a57e015ea39ed523874fddf83e127dbcfbbab271e62e5aca472e74 201509-08
18:10:40

5811028567def217c3654d2c3897e277144f98268b0a3aef290331bd7ecabcac 201509-08
18:10:56

74a4e5317f4bb723b4a3a9001c82cbacc80689a9a9cef4ce7afc348a76e93a97 201509-08
18:11:50

e2a13e0c4be62077ff9cfefef78fd2610ce8a4c4c19e5ab71abc019ddf65327a 201509-08
18:12:13


-----

**SHA-256** **Date**

dfb340fa30b99fa55ee653ae1a17b938b4299f52f519af43508c4f7014c17c3e 201509-08
18:12:24

0445d8cabd1d177d1099f5d230ca5593a93e6e53a3bc7d49e7695a07b6e3ec57 201509-08
18:13:20

077bcedbe4344813d618970640b948db162dc183b17455d8664872b64c9c7fc4 201509-08
18:13:29

330ab15f208a5db92b5a4967b2de9ffe6dc5f1c38b0df82c548a3217e477cdf0 201509-08
18:14:48

138e3f4935d35db97d7973823a9d3ee9b12fae9aab11aac1f60f1e9020b6528c 201509-08
18:18:45

cbacbd4065f9af06d340d1cc977f3d7c9a4f2f7b2ec18647fd6eccf332aa4597 201509-08
18:21:25

e792aa1ea4a408ded47216037d52721dad9f60bee274d5d9b2a22e826a6420b5 201509-08
18:22:58

b459330cea09dfc6ad875568f04b55c5de56bdbd5298ca8a6626cdb8894aaac6 201509-08
18:24:55

727ea3d523121f1034b4d6a64bcb927a12e18fc9cf5def4957042260e51d078d 201509-08
18:26:18

aa336b8390127e3ee3eb56cf621015a1762507c1bb78258f265668e021f8272b 201509-08
18:26:52

de14517df88afc50da3ad0e6692d481075a12c59829a65a2c6f0d9da46a4e269 201509-08
18:30:05

fbf483a32bf51302d750205ab5ed2e2e09de821e3e96bcb7853ec77c0944bfdc 201509-08
18:30:16


-----

**SHA-256** **Date**

f93f85a31d65ac8a401676be7fb997822fe234181b82793bb5ed15df81554f73 201509-08
18:33:16

4ed6c3dc8bc5e87b8762c059207f41f8064e2ab76330774dda27082f0b699bbd 201509-08
18:33:38

7dd7c984a132925efd628fc49199ea190b4c05d04c47880ca14c28341fab1f86 201509-08
18:36:44

d53eecf218ce035ed229701c3f74d59b71b72d9c1a2cd12dd5ac9ea381e61cba 201509-08
18:37:07

de2a1302c69f8907b6e65d5153371c281ecbbc8e283fd8322b2f663f1f4d3e31 201509-08
18:38:17

4d764adcbf15d0834522c31046a464843784eadae215d01ba09ee15fed94a11a 201509-08
18:39:22

66365ece809a9f4f54358c853ab4b17ceadf8487ea4c59e58600a2dae9fb11d2 201509-08
18:39:38

5ca6c65345a9ceea7f790073a1ad3b324d4916284851bc8e48174fa60d58b3b2 201509-08
18:40:00

9d66248af1b8d0a47aa9919b32b49cb4196557e9d2f15922619a3c74170bad91 201509-08
18:42:01

95c88901dc7d9beddc89f02fe8b4ad4fff30cf6367db789e4894068cd2eeef84 201509-08
18:42:03

21ab7897566c1a4278607d309c6fdf780cca70e5399de2c4adbcd4df115efff2 201509-08
18:42:56

232f84ab8672e885a4a4ed76b0a978c00e9c3be66baad3d4406fcb5808c4c1bf 201509-08
18:46:52


-----

**SHA-256** **Date**

7c5806cb9b278e6c73072df702badbfaaf2c82a368ec4debcfc167aab7cd2743 201509-08
18:46:53

54ccd769194ef3a4b3d4a6eb1dbe963e98aab5f354cb3910b7d8a8ad981d4557 201509-08
18:47:41

54f55fdd7cfcd6123f1a1bc9a01e9cc4903f15370761d3a60efbce697758bad3 201509-08
18:50:53

3cf47304180efd91887bef17f9eb6787e0e48cab1b584a2f748e79a1de8e7304 201509-08
18:55:19

5c2f5b42624de26e041a35f3252fdf2f8b183ba84bc4831161b500bce07ba2a3 201509-08
18:55:30

fdb67a4e0cbf80a9534c2bcecd2e83b20a5359c364b3ed957be017f0fda5e1b6 201509-08
18:57:24

37998ac968de8ad4fc4a82c7421aa7fe57838584925c9ed86a8a6bc544e8064a 201509-08
18:57:59

45373e5d4f9bcd60a26f684046cf82e3ef6bee3335d6d0bd7ed2122a7adb509c 201509-08
18:59:43

883af577fdcd9d1398589ec374c6173dc55d37dba02aed132229dffd951bc71a 201509-08
19:06:24

320ee9ed2169198a7546d311e3e23c175740fb11c5d38aeb12bf3475fb801b08 201509-08
19:09:42

ad70dd13d5fc0d73c4a377b8a51895675eee7a4f5b37f7fbbc2a9aaec1d6c30e 201509-08
19:11:57

bdfaadbbb76b8213076b1c4105a136ac35e39c5d2fbb7c5656bbdc74f6c3a579 201509-08
19:13:25


-----

**SHA-256** **Date**

fd08f00fdcec136f041f753a75f8f7776ef9f0aec78d06a3d734e874ecdf7517 201509-08
19:17:01

d3022bb434da4e69478a9ac84eb36cc9263702aa368f2417e7f34d4249e6568d 201509-08
19:17:01

72a838e7cfcde3e4eff8cf707304eebfe429439bf345025f5e3a6f56d199b1c6 201509-08
19:17:24

fd46f9d85987fcb4c89e16c95d70cbaf0c200bbd19742f6fec186455358c940f 201509-08
19:18:20

de1e5986f143e5d7cebb172953a93dbbef50ddf42a99b51084471aa8d74b9845 201509-08
19:22:06

aa6142165d43bf92a7a5e85c365d9cf72da58f22288fa21f4103d5ceb86ed68c 201509-08
19:23:07

f7ec2d3953cd9c31d5f953504ad7abd50bc08386d70f5c62854be912ccdaebbb 201509-08
19:23:51

3d7da83a4743bb18da78d588098c797fd9ce933f8d57f8ee8d7f7d115ed46e45 201509-08
19:28:32

72c00e2c782b351e458cd1fd558dec9e9ccacb9f6569551df455c574423d85e3 201509-08
19:28:46

33f6c06b6c55ec59fd83d925dd01489a0c4316c21ba59f5330716517900c3818 201509-08
19:29:13

95e915a54a7fccf0367e99206160a62660604facaefd198cf9267767d017fc4f 201509-08
19:31:52

5dceb7853951335b80862fdcedd19bd43f82b6cdde30afda5e280cb3e403aea2 201509-08
19:34:36


-----

**SHA-256** **Date**

03d04a272c6dcdb4abef1a20cce98e447904ab0bf1172815af1777ff79e937dc 201509-08
19:36:37

78bdf42df19c5f143e5b863360064dbb8f0ee13d371a4a858742d209a7dda2a3 201509-08
19:37:09

e66237b3ad8a40017c4f79834b1bd609a7cbdeebb1f50a3a0d848a54ed83b33c 201509-08
19:38:19

61ffed9932d035db71c1ed5055ed735c3e5d0c24446df4e689555e06c81276d3 201509-08
19:38:34

2e4747fb1e1e9dcdbeb175483c9bb4cae2a7163adbcff6c44b542f1f2fbdfbd4 201509-08
19:38:45

da8dadbfead1d8553d52d98ecfb04446e8ad5d78477ba50a38e8ea736ada2ac9 201509-08
19:41:29

019edccbf0b0c3988c5a4e704c788a67f7ce8522ede8644da0aab9709b84929c 201509-08
19:41:35

b7b757cdbea162c1191eb37d58a95b8eac0fdbfc3edb3a0bd539801923c7f74a 201509-08
19:42:55

f275d5413612b02825bc1d34126babea5bfdadbe62627d2d163d691e6cfabacc 201509-08
19:47:00

9a940ac7759944758df36cc8b360e1919e2f5aaf2890f050f2eaf8ffdf789a6b 201509-08
19:49:16

7113aa5662405e7c0a161be668720017fa7d96c19fb44c9dcdef2cce93d86f56 201509-08
19:51:38

b57032c92cbcf469976940dcabc2557e12cc99e75cbcbaf718628cdcefe90d2f 201509-08
19:52:04


-----

**SHA-256** **Date**

56a165767fcc04d91f38eafb4793c80681cb2772af960b07e2013d032bd73160 201509-08
19:58:25

45898a764e14bc26385de40f11884c9b482601f19775a5298f8d8e13429c9272 201509-08
19:58:54

592d20c7541d68c440d588a37acc07374bfc0d9c0666509a2a75c11af36d1126 201509-08
19:59:43

0cb0e692ee385ab4702e8c090db743b1054d34f345142967bda14d5b809d8d86 201509-08
19:59:57

2980eaf9cd8dfcb33fb14fae9c93f609e4c6fdc34ebc319f53ae56c7b5d6569a 201509-08
20:05:48

837c5cf285e6d12af08ee7b183a0de87f4a47efd725fc8d898c653abc2a5a80c 201509-08
20:05:54

10c449dcbc3df85456f4405aac1a095fe87a6ce5366b6471284f4ac7ac267c14 201509-08
20:06:50

7c2b24813ed7bc68eaa81ebab2c2c71f81d3da0edd059dfa47cb97f804ccc50f 201509-08
20:08:43

843fce353f249a5f2cfcd0c7502701d0724e49f53e5b82129f58fe993a275010 201509-08
20:10:25

1b9a141a62da459b6320382efcb0fb878b42f424e3d4fb72f0f1f84a092215e1 201509-08
20:11:00

4473e0edad9aa8bcdabf9a9f9dfe1490a102a58180ce777b070c9a64a31f7973 201509-08
20:17:55

cda68ce45a2be5fcf77008fa43b5640652910e1f1f7b51711b860080be29c808 201509-08
20:22:16


-----

**SHA-256** **Date**

57da250f096136eab5dbb48d89d19067f52ff71840958b21d606cead9fb5e73f 201509-08
20:31:32

8a068e50dae1577f5d7691f12bff82299b559becd89443e5a2d6f43a63a18605 201509-08
20:35:19

f2ad46faa49f9c83514c29578aef0eed014596b7419a12829b00fdf2550d1e07 201509-08
20:36:07

4313a2d36344dae2322ef4bd973c25cba09a114abe716be06333287fdd1395c4 201509-08
20:36:47

54dfeba5df2ce4f4f75e4b311a05b42ce635f3363f4bac2a07cc90505dcc3a9a 201509-08
20:36:49

cc8768459810b4c2a55c12ffc87d546394ec242038052016196d99f7dd456a34 201509-08
20:40:12

868d4e29025e30d0fac5895237fb1301161353c33f2be6407cd1453099ff4dca 201509-08
20:41:56

16407e6d1b6af91dbbd40ad3cae89d56ff86328ed0ee232f82f5bee864ee3cdf 201509-09
00:16:02

0f9c3270a6c1f92034d1fd5300feaf6aa88da9da4c3ab4091189a9f8f00f71ca 201509-19
19:35:52

b318949ee3e400ebaf42a3f44524be274faf834cfb85896097b4ba8021ce426c 201509-19
19:42:57

354158f903c56cedc0d1631ef96810d2c66f4b8b53aece62e6f757f103d10fad 201509-26
01:28:22

f4e133b0a10f136984e1ed654af7dde902ff25e62f9a33b299d857348354649f 201509-26
04:23:16


-----

**SHA-256** **Date**

add2ad3f42a28dbaa247636f3e3ffad5b4f452676cccd6be41f305825ce26c45 201509-26
04:23:22

08c996e48a616aa881ca4da7dfed40a521fa2a14cb248fec5cd308de8dba54e5 201509-26
04:28:19

b8c48dfa2b669f54e94a9a8e6e4ee35fa0ebac09c52f4dfec4ae6a6c7fca7421 201509-26
04:32:35

e44da1fb68c9bad236499fd37d9ae04a0e8963e3e5aebe36fd05e07d728902b2 201509-26
04:42:08

4bce9552bc710d3835c25e0ae47df9e763b8c568180b65e9463f2dcf919f918f 201509-26
04:49:23

b684d08c6fd6ade5fc26eb26ed69095bbc5066fdbe968966426db2fd5276ae90 201509-26
04:50:57

e29bae912ed2c996b40752f622cb1935304835d5dac6ccbbb433c2f41fb32aac 201509-26
04:57:19

985237895c17e99065c6db3d86d98725de8380776979d16c6d76ecde5cb2facf 201509-26
05:04:33

217e64d22868bff1d8e5567b0204804ccde1752336ac7fbb8296518a72fb3b6f 201509-26
05:15:24

7b6f5b457e9ae8252c38705dc42a8a3266910b3c7ba25ae95b28198bcf8ccae8 201509-26
05:20:45

18afa3b2947efac6bf8d6a2fb922a7f4eff3d1851b323762817014b7fea34ba2 201509-26
05:26:34

df4b18e6154bf6c1c614f9b4da12beda761c1ac64d681d62bab979f85eb51268 201509-26
05:29:32


-----

**SHA-256** **Date**

dffde5082ea1d7b8b868a521cb07861d8dbc74a2757991ab119793b1a2afb207 201509-26
05:30:33

3ab1848e7ec9f9baf8066c33bd873e8e1a49763233f4068dccf53cda07a06290 201509-26
05:32:39

297ef310a1cf2e313e0a4dae214fe8dbffe272111202f0dc9c880b419cf5df40 201509-26
05:45:08

9d39f8dfe9bd489f758c91868787b4dca0bbde1f307d166b46c542c429207d58 201509-26
05:45:49

49d114261ceb4f40b05550128e120925fc7a661b208f740bf1e0259c7323aeb5 201509-30
10:18:57

e1626945e2f92db34fdd0686a17942b46bf55917ed24ce92d33365d8be47838e 201510-01
17:21:10

e10dd835b516c161cb3e0eb0b263dcdd10628359ef040bc071775f995b738234 201510-13
01:06:28

4e32d986190111d3fbd3b9b3f382b9f3f9f4843678e63a0bfce8e0fa5e919979 201510-22
05:15:33

7d181d514e39a78c568d4e775d9d3c4362e96c832032040ef544d2f09665b315 201510-23
16:33:51

94852e5e48934816cc103ad52dba511053f721aa9344e8b4ca558a39878eb859 201510-23
17:28:56

139211579a7d0f00685b5f3dd6c833e28c9dc4161c0f5c7e024ddb97e795db48 201510-23
22:12:38

c985237c20a106887efbad31d86da6639ddb5a994af5836428cc2a74109a1462 201510-26
05:48:15


-----

**SHA-256** **Date**

9b213b0a592d91004b5bda28d69dd4426616bbb0e5130516eb35ec467d6f603e 201510-28
13:56:39

1556c461ff12468e7124a51a22355fc5e590059c01b924e2d06af867228c1506 201510-28
17:22:29

ae821737978bc1a24cc0e095933cbebb7c7b2c5252dc67d0020b4506609d9948 201510-29
00:45:20

8634eae65f381022143e5bced8e5dc19aa406b7b750ead3d6fbd27cf68d90505 201510-29
18:37:57

09c929cafc14333e03feedf2adc48ad139ebb1c89d019c238f2a2b29d0aaf5d7 201510-30
15:17:07

9d751b9b44a9f1e6f400a596ebe186ab1dc3729507e2bb9b0de63925e1af8df8 201510-31
16:45:41

ebc76b0d401cfbe5d952afc86b30538657204200fa0d83cc4f87df50eae3aaca 201510-31
18:31:02

11e170f7098498ba0d48f006d4f8e8eb8dc7cafdc4ba64abbc77f4d1ad6c0d1b 2015-1101
11:57:30

d0e35aab7229d23afce4a53f28bb21ba2a31d397e7f6599819c7d0f432d6abf2 2015-1101
13:50:13

0cb98230f7d96827db2c6c2b66a36473d5aed396677a0cfbbb3581ba958d9920 2015-1101
21:46:21

1267ac794fa1c0596f82e4ed8ef917831a112b54eeeb8ffa54c507d00bb2e561 2015-1103
18:14:24

1d262cd0b390381587aebfee4737e740dcda3babec3feaae9768e6558cebdbc0 2015-1103
21:25:13


-----

**SHA-256** **Date**

af05d12fb6c7b404bebeea3d0eeafe017a1c3849e7ee5798b8e2bfdf10dd8c87 2015-1103
23:16:37

af04b3d8e27f2bb42d8b2a37e4000bc4776d6679bd8a30d680c6bc1abee5e7a7 2015-1105
03:05:04

92058ac110f9f2528f63b6006b171a2feff24f12778739b96e1d1347988ab1f2 2015-1105
03:29:35

d55a53a862a918771c79beb7e98e108581efe8affc355a6b115b13b4420bcd37 2015-1105
04:17:11

977a8ed2aa542fcd8d8f960a07aa5fc829f6e646a46fc26721e8ce6b9f6be125 2015-1105
04:24:14

063b5e79d6c97074b1351c0728f9a59b18bea6ccd2a1339dc6cd747047d09741 2015-1105
05:22:52

41fe5b1a4ae4ffc983326143a1ef46626fcb7dd5850ddf182f6c2f4a6f49feb5 2015-1105
10:56:31

593e07071af8129992b3b08b9a2fdf309a17f37386f6947739cbf20bab312aa4 2015-1105
11:26:03

e5aeebab14e6c16dd4e15fd73776ef6eef3f6bd81c0fdea04694fcdcafcb0cea 2015-1105
13:38:00

68ddd641ac15acd33155b40d23563f1d811bbb97b1654ce7e2bb7314d3c0e723 2015-1105
22:12:03

0cf89a1bb82f27efd03b97b6db9b30bf7a56892f7e872e2679e2337b4d78e6ab 2015-1106
02:50:47

7d334d84e7bedb42d45cca6aa7140d560f7515d467e590989afe183cacc2d5b9 2015-1106
09:31:32


-----

**SHA-256** **Date**

64ad3eff44957dd3e6792b2dcd8ecee3123229cbd7cce52ca0b4950330c042d8 2015-1106
09:36:35

e4bb0af51817ac87663940a4f99de3faa1720743771fca3b45456f77d151f42a 2015-1108
00:20:11

6732880f32454b0019a3da3ba2434ba249bccaea6b1414d435e33270dc9145b7 2015-1108
11:28:23

2abf713fa4345124da334e8f241c32c811d7714a32133a216f3ddf5181068a7b 2015-1109
05:31:35

78bb38aaa8a1d2c4a46e38bd940d96fcc19cb8d9925479f45c9299078d07f688 2015-1109
05:35:54

5c6fa11b7bd17edcd3dbc46a3853f8b8933ae12e1c86daa461fa90cfb6d0e526 2015-1109
06:19:31

93a7e3b39eb6f8789d141831e0836e96de3a8506154cf47219f7a720bdb34fd0 2015-1109
06:26:47

55b03a2297e77390267407e494b44ec62977e8317de81c8d10e15033c58ad993 2015-1109
06:35:46

dd8b3969cc7b2c49c57885369c95994fc99278eaccffa61030da3b8fdd774609 2015-1109
06:37:20

e98d6a1ff4ac2c0b2baa48d7ea6b8802c527daf89e7e646d50279029b0228af1 2015-1109
07:01:29

bddc2e4b263b392775375c35eeef4eee09729ee43293c505a49d61318354bdaf 2015-1109
07:27:48

4689314a20b79dec52b3baabb9e644cf3c43971ddfeef05a5cb72e8620a2681f 2015-1109
07:45:45


-----

**SHA-256** **Date**

13aa336c311705f71dd6709caa2d76a0a5c41adc4fe1499bc8da8139a12a7be5 2015-1109
08:44:54

2db4f9e5300583af806705d66e8641c89aba6f2fc783c66ba55097c5820b0001 2015-1109
09:50:00

de62490139b605e6d4122562c835ed835a29139db08e165c942a1784d6c17af5 2015-1111
14:24:04

9da768db9af60f543b69652f7f731439c6036841bdfa5b5b0f7173f6edae5e55 2015-1113
14:14:19

a9f7ace21338b4c2437ed3263ace16f426f2e180b3e7bb73b981aef9a5c05636 2015-1113
14:18:46

88ebe7caafa96a47a016b0b19fc0b91207a794c2af9f0b50ab19b50cf7ce807e 2015-1113
19:05:41

7b677001233b7197d77d4e557bd448b30c84eab2586635e11c3fe73919eead1e 2015-1113
19:22:01

326ef39b87ca40e4ec5e175fbb147b89d9cabe6d78b11c68f6bf37ce5d62f28a 2015-1113
20:31:22

b9830349f8c505333de3216d2bf2979a3ac3897abbd6ef0962ca95cda9068bad 2015-1113
20:57:02

12ce8990af784315cb321f2a1624f17c0c91284af8acf47fbe5a75a7905174f9 2015-1113
20:57:18

b1b063c0b14df10584ca9eb0169fb1f70cadf765589b90eec5681415bcfb8658 2015-1114
06:18:47

0caa6dbb549b3c1160effc26a77f3cbf68d15392d8c1ed58b59887ae3cca57a3 2015-1115
02:42:09


-----

**SHA-256** **Date**

cbfa9af2216b974e24f5ad86e7ad23194d2a8d147d9b23a9ff58905fe09ae8ac 2015-1115
03:04:43

4431a94ef83dd067d43ee5ee182f2a272741fc42c7a6a56cadd2a22205809cd0 2015-1115
03:25:05

f2e95c4118efd5cee2b423ac66cb9bdb51ed9eeef388a7c537659954ba7bbd1b 2015-1115
03:58:05

e06c62d4e8df35473a5012ea68918e7bf6a319f9a14974e472120e0df89df515 2015-1115
04:36:45

dc134b77daa53d1b56978503275cb208b530191a300f5f6560996196958c391e 2015-1115
06:01:30

5706eb271742c273e58c419059c986b0ebeb2214e5e0a471b29547180c00580a 2015-1115
06:06:14

f9ddfb291a1c785fd2bcf3f9ed59f7d64e0d1f9f1b39ac7f369f881244fe516d 2015-1115
06:20:31

4ac45d73bfa0e1a64a839e3bedbe9b067ab0dfec31f00e05b2390757e3c34b5e 2015-1115
07:42:41

bf7988ee1f5669c20230ee2f0d210e39def4a40faec3aff04893ef8b544f68b3 2015-1115
08:01:08

243e0cc9f1f1132861622766626b4fb028bb6ffe2e6bb8086ed99ba09ea0d31a 2015-1115
08:09:20

6a7a202fa2d494cbf43b1d44c4710e79eca95b68d83e99ac8a93e3471382449a 2015-1115
11:15:27

fd2bebdf062add402cb67efad61add04040224977e98ff14d889984a21e91f60 2015-1116
04:57:37


-----

**SHA-256** **Date**

8546334b5467b052559f16d12f3bada6f7127a7d86bf1b1099b48aae7530dcf1 2015-1117
00:07:09

e43e1bf11bd6c2e5c6611a3ac18a0545b18af613c97d64fc559b9b659fb194bd 2015-1117
07:09:15

033819226a24287567cd7c2b222bd82181dcb2d63023dd5f91a61b83b33a6db6 2015-1117
17:26:53

afba7c794d3dc68d62d796164f0e4c2828891cd70d6c0b4094e6fa4775c3bf28 2015-1118
18:21:46

ab636ec259b3538b64c981909b390fffe4dfb314854c7aa7bcd67da46401963c 2015-1120
02:11:05

fbdba30dabdf2216674a5ef7ba031757abfea05d2cdbaf3bdec3a53d68dff04a 2015-1120
07:18:52

0b4a9e84de3c73320189208171e1113f18a1f2535c2d1a5b71839ed747d6f88e 2015-1122
05:36:21

7696de9ce43e95593a38048a5d52aaea354c3ea5e636d78e6707ef87630ae032 2015-1123
05:24:42

abf9ca41ae38bbd1691f4f554f27738dc379ed8d458f9a7b8398134598711278 2015-1123
05:29:31

cbd3be76418d225c41838113419a7b5c8ec8992dc3fcbb7a7d4f005883409463 2015-1127
01:24:52

a7238becf37432a02d945a3dcdd97ac997b4af8f032c6baf5c8296b95f492582 2015-1127
01:43:36

678e0581b70e57d3d4a607fe052f05a55ce9f4e8f66122ce84cc25bc7bad815c 2015-1127
02:41:58


-----

**SHA-256** **Date**

7505ad7ac7ab0c2e11ead5c8acf31dd3de8494d2b2ef9a9d08c9f128e9635bee 2015-1127
03:22:56

36faf4b93d40692adb51cb8c371d1310a2f631c8e0097fe219a69b5f770600c0 2015-1127
03:23:55

847859e0163c364452b13444f697a0853ad49c019128de5eae33ed7a8e604f04 2015-1127
03:47:51

7feceaf5398693bb4fbbbecab4f6127b4a42a1a79b1f2b893fa80dc2a7d5be83 2015-1127
04:24:32

c78c176622b5dac5aff1c36d2008a0567adf1a3b9041a3d75ff448462dbd29d1 2015-1127
04:29:13

9e0c2351b31044052a0218675a300ae7e570c317519ef8b5d171731c05e72bfa 2015-1127
05:52:56

bca404d9d88790bdfcaa3b4edeaf7ec7cbe0df77fe8f5c4e388c228549451fff 2015-1127
06:10:32

f447533e3ddec52305be9177511988be3568b56c0918a5b32acf3989150ecc9a 2015-1127
10:26:26

2d53fbd311034a98a2f3d120b97db623481574c13887b1f8a584849e3a8e4d24 201512-16
20:06:59

c85c0797afb881d6fc71fbc7007f3e7e4a3645a832bff766f06fcdf3f1a64483 201512-16
20:16:28

9bdf5610fdb740ac15d710205fbf15cbd04807d634d3446fcc91c925c55ac862 201512-16
20:45:18

f3a06de90f14e8b03253dfd49c6a571eba000b3e5ee3e36fb31e9b2dbb196f29 201512-23
18:13:21


-----

**SHA-256** **Date**

82e7ea5ef62156105c12e6c6d3703d928aa1fd0c276003987792fb631232d564 201512-24
12:48:18

## Archived Comments

**_Note: I removed the Disqus integration in an effort to cut down on bloat. The following_**
_comments were retrieved with the export functionality of Disqus. If you have comments,_
_please reach out to me by Twitter or email._

[Jawad Ahmed Jul 22, 2019 06:40:13 UTC](https://disqus.com/by/disqus_8AT0czK4eJ/)
Hi, Can you share the .pcap file of this malware, if you have it? I want to see the pattern like
how many domains are generated, how many NXDomains are generated etc.

[Johannes Bader Jul 22, 2019 08:33:10 UTC](https://disqus.com/by/baderj/)
[Here https://mega.nz/#!ObwxnAgJ!... is a PCAP for 1e135d7e024f2fb57182ae3313acae6d.](https://mega.nz/#!ObwxnAgJ!1ZqqSHNYrTZLUMBVTjbqVBfzqS3bP-d0EYbMu4MlDkI)

I only ran it on a simulated network, so you won't see how many domains

actually resolve and you only see the decoy domains (same pattern

though).

If you are interested in seeing the ratio

of resolving to NX domains, I recommend you run the Python script to

generate the 5000 domains for the day and check them. I would be

surprised if anyone is still registering domains for Qakbot.


-----