Threat
Grandoreiro banking malware: deciphering the DGA
January, 13, 2023
20 minutes read
By Leonardo Beltran & Diana Tadeo Metabase Q’s Ocelot Team
Context
Grandoreiro is a Banking Trojan written in Delphi language that emerged in 2017, attacking mainly Brazil and some Latin American countries. This banking trojan is used as a backdoor to allow the attacker to access the victim’s devices and thus steal their banking information in the online banking sessions they open.
A common feature of this type of banking trojans is the use of different domain generator algorithms (DGA) that make it difficult for organizations to block outgoing malicious traffic since multiple domains are generated, even on a daily basis. Being able to decipher this type of algorithm would allow an organization to monitor, detect, block and therefore, anticipate future attacks by these actors.
In this blog, we describe the process followed by the Threat Intelligence Team to decipher the DGA algorithm used by Grandoreiro in a recently active campaign in Mexico, which allowed us to predict the future malicious domains to be used by actors for the rest of 2022, and with this, protect account holders of our banking customers proactively. With the intention of contributing to the protection of the region, we have decided to share these indicators for the benefit of the Mexican banking sector.
Motivation/Impact
Theft of online banking credentials from account holders.
Key Points
- This campaign is active in Mexico and is distributed through spam emails.
- The victims are account holders of multiple Mexican banks.
- This malware allows the remote collection of user and banking data by using dynamic domains.
Conclusions
- As Grandoreiro has targeted the Mexican region, constant monitoring of its indicators is essential to prevent future attacks.
Malware Properties
File name: dbghelp.dll
MD5: 61ebbb2dec6895f168e5feec74452be9
First seen: 12/07/2022
Type: DLL
Class: Backdoor, Banking Trojan, Infostealer
TTPs:
- Browser window monitoring
- Screenshot
- The use of the Domain Generator Algorithm (DGA)
- Stop operating system processes
Detail of the analysis
Analysis of the infection process
Through the monitoring of the Threat Intelligence team, an active campaign of the Brazilian Malware Grandoreiro described in this blog was detected.
This sample was identified on July 12 of the current year, however, there is a very similar variant from July 6. What suggests the potential beginning of the campaign, and, as a matter of fact, it was still active at the time of this writing.
The way Grandoreiro infects is through phishing campaigns to convince users to download and execute an attachment. In this case, it is a DLL named dbghelp.dll posing as part of a legitimate software named “intune.exe” or “Advanced Installer Intune Tool” (Figure 1).
Detailed technical analysis: dbghelp.dll
During the first part of the analysis of the dbghelp artifact.dll a relationship was found between it and the domain “bsalsa.com“, which belongs to a site originally created for the development of freeware solutions of the Delphi language.
This in turn, has as one of its most notable contributions the “Delphi – Embedded Web Browser”, which, according to its official github: https://github.com/ghquant/Delphi-EmbeddedWB allows you to create a custom web browsing application, add Internet, file navigation, mouse control, document viewing, and the ability to download data from applications. It is possible that this functionality has allowed the acceleration of the integration of Delphi with browsers and then have malicious purposes.
Continuing with the analysis, the following text strings were found to correspond to the initial suspicion that this variant targets account holders from mexican banks (hidden in the image):
The malware was written in Delphi7 and with a possible nickname of the developer as “lulalivre”, a name that expresses a political opinion about one of the former presidents of Brazil. This, along with the fact that there are many strings written in Portuguese, allows us to begin to outline the variant that we eventually ended up confirming as Grandoreiro due to the TTPs and IOCs described below.
The interesting thing is that this new variant focuses on account holders in Mexico but, by maintaining the functions in Portuguese, it suggests a collaboration between Brazilian developers and actors with context in the Mexican banking sector or that the malware was modified by this second group without the knowledge of the Brazilian actors.
The malware has validations to be able to work on the following versions of Windows:
- Windows 8
- Windows 10
- Windows 11
- Windows Server
Going deeper into the code, a function was found that allows to check if the infected user is using any of the most common browsers in the Windows operating system: Chrome, Firefox, IE, Edge, Opera, listed in the code as shown in the following figure:
Subsequently, it monitors when the victim accesses the online banking website searching for browser titles related to their online banking and words such as “Log on” and “Net”.
In the case of identifying any of these chains in the name of the window and the name of the site, it focuses on the collection of sensitive information:
A very interesting feature is the validation that the communication is only between the malware and the Command & Control without third parties. This is achieved with the use of specific strings from each bank, injected into the callback traffic generated:
Another interesting function is responsible for capturing screens in the system, applying a colored mask to obfuscate the image. This mask looks as the image below:
DGA subdomain generation
A function was found in charge of generating dynamic domains for the connection with the C2. The algorithm starts.
The algorithm starts using TIdDayTime and makes requests at time[.] nist[.] gov to get the date and make this request multiple times in case of error.
From the strings obtained, these are separated according to their spaces and “:” to give them a DD/MM/20YY format, thus obtaining a new list of dates. The day, month, and the year are extracted from each of these dates.
And depending on the value of the month, in the getMonthKey() method you get a different key called mKey.
Based on this, from the value of the day that has been obtained, the substring to be used is extracted in the following section:
The getFormat, xorHexValues, remap, and replaceEqToNull functions are then called.
In getFormat the key obtained from the month, the value of the day and the last value obtained from the year are combined into a key.
In xorHexValues an XOR is made with the values of the date and the month key to then obtain its hexadecimal value.
Then, it starts remap where, from the previous output, a conversion and exchange of values is carried out by concatenating the “=” symbol several times.
The result passes everything to lowercase and in the segment replaceEqToNull changes all the “=” to “null”, resulting in a subdomain that will be concatenated with the string “[.] freedynamicdns[.] org”, which turns out to be the domain of a service used to generate dynamic domains for free.
The append string freedynamicdns[.]org is a service that allows you to generate dynamic domains for free, according to its description:
How we can help
The Threat Intelligence Team created a tool to automatically predict the dynamic domains to be used during 2022 by this Grandoreiro variant, which is available on our Intelligence Platform for customers:
We confirm that as of today, the domain is active and ready to be used in future campaigns:
Once the day is over, this domain stops working to pave the way for the next dynamic domain.
It is worth mentioning that Trustwave’s great work helped a lot to the quick understanding of previous algorithms similar to the one explained in this blog:
Indicators of Compromise
Hashes:
61ebbb2dec6895f168e5feec74452be9
26f8dd7bba9792821eafddc3d0abb480
URLs:
http[:]//www[.] bsalsa[.]com
Domains:
bsalsa[.]com
freedynamicdns[.] Org
File Names:
dbghelp.dll
Intune.exe
Registration Keys:
Software\\Microsoft\\Windows\\CurrentVersion\\Run
Domains generated by the DGA during 2022:
2022-01-01 hdpftao0sqo0tbw.freedynamicdns.org
2022-01-02 hdpftjb0wqpjtaj.freedynamicdns.org
2022-01-03 hdpftkk1sjo4tar.freedynamicdns.org
2022-01-04 hdpftjb0xapktaw.freedynamicdns.org
2022-01-05 hdpftjs0szpmtaf.freedynamicdns.org
2022-01-06 hdpftbb0tjo3tjf.freedynamicdns.org
2022-01-07 hdpftjr1szodtjk.freedynamicdns.org
2022-01-08 hdpftjj1watmtaw.freedynamicdns.org
2022-01-09 hdpftjb0sjpktbb.freedynamicdns.org
2022-01-10 hdpftko1szodtjf.freedynamicdns.org
2022-01-11 hdpftjb0ujpktbb.freedynamicdns.org
2022-01-12 hdpftjf0ujpitbb.freedynamicdns.org
2022-01-13 hdpftbk0tapmtaf.freedynamicdns.org
2022-01-14 hdpftjj0xapktbb.freedynamicdns.org
2022-01-15 hdpftas1sjtltjw.freedynamicdns.org
2022-01-16 hdpftbw0tas4tas.freedynamicdns.org
2022-01-17 hdpftjs1sjthtjb.freedynamicdns.org
2022-01-18 hdpftaj1satitkk.freedynamicdns.org
2022-01-19 hdpftar0xjs5tag.freedynamicdns.org
2022-01-20 hdpftbk1wqs4tko.freedynamicdns.org
2022-01-21 hdpftjs1tqo0tjj.freedynamicdns.org
2022-01-22 hdpftjg1tathtjb.freedynamicdns.org
2022-01-23 hdpftjs1wqo1tjb.freedynamicdns.org
2022-01-24 hdpftjo1sao0tjw.freedynamicdns.org
2022-01-25 hdpftaf1szo1tbs.freedynamicdns.org
2022-01-26 hdpftjk1wzoztjo.freedynamicdns.org
2022-01-27 hdpftbb1ujs4tjn.freedynamicdns.org
2022-01-28 hdpftaj1tqtitko.freedynamicdns.org
2022-01-29 hdpftaf1tztktjw.freedynamicdns.org
2022-01-30 hdpftab1wqodtjg.freedynamicdns.org
2022-01-31 hdpftak0szo5tbb.freedynamicdns.org
2022-02-01 hdpftab0taphtaf.freedynamicdns.org
2022-02-02 hdpftar1uatktjg.freedynamicdns.org
2022-02-03 hdpftjg0tjsetjs.freedynamicdns.org
2022-02-04 hdpftjs1wztltjs.freedynamicdns.org
2022-02-05 hdpftan1xatktaj.freedynamicdns.org
2022-02-06 hdpftak1sqtjtjf.freedynamicdns.org
2022-02-07 hdpftjg0sqpitak.freedynamicdns.org
2022-02-08 hdpftbs0ujo1tko.freedynamicdns.org
2022-02-09 hdpftas1tzodtjw.freedynamicdns.org
2022-02-10 hdpftjk0taphtaf.freedynamicdns.org
2022-02-11 hdpftbw1xao1tko.freedynamicdns.org
2022-02-12 hdpftas1tzoztjj.freedynamicdns.org
2022-02-13 hdpftao1xqodtjw.freedynamicdns.org
2022-02-14 hdpftko1tztktjk.freedynamicdns.org
2022-02-15 hdpftjj0wzs3tbf.freedynamicdns.org
2022-02-16 hdpftjj0wzs2tbs.freedynamicdns.org
2022-02-17 hdpftjf1tas2tbw.freedynamicdns.org
2022-02-18 hdpftag1wztktjk.freedynamicdns.org
2022-02-19 hdpftjn1xjtltjo.freedynamicdns.org
2022-02-20 hdpftas1tjtjtjf.freedynamicdns.org
2022-02-21 hdpftjn1sqtktjk.freedynamicdns.org
2022-02-22 hdpftbb1xjo3tko.freedynamicdns.org
2022-02-23 hdpftbs0sjo1tjn.freedynamicdns.org
2022-02-24 hdpftbf0tjo1tko.freedynamicdns.org
2022-02-25 hdpftbs0tqo1tas.freedynamicdns.org
2022-02-26 hdpftjo0sao5tak.freedynamicdns.org
2022-02-27 hdpftar0sasftaf.freedynamicdns.org
2022-02-28 hdpftjn1wztltjf.freedynamicdns.org
2022-03-01 hdpftaf0tjs1tak.freedynamicdns.org
2022-03-02 hdpftjw0tjs2taf.freedynamicdns.org
2022-03-03 hdpftjb0uatktaw.freedynamicdns.org
2022-03-04 hdpftjo1wzs4tko.freedynamicdns.org
2022-03-05 hdpftaj1uaoztjg.freedynamicdns.org
2022-03-06 hdpftjg1sas4tjb.freedynamicdns.org
2022-03-07 hdpftbs0tqphtar.freedynamicdns.org
2022-03-08 hdpftjn1uatktbk.freedynamicdns.org
2022-03-09 hdpftbf0xjs1tag.freedynamicdns.org
2022-03-10 hdpftko1tjoftjj.freedynamicdns.org
2022-03-11 hdpftjf0wqo5tbs.freedynamicdns.org
2022-03-12 hdpftjg1tjo3tjw.freedynamicdns.org
2022-03-13 hdpftaj1waoetjs.freedynamicdns.org
2022-03-14 hdpftjf1tatktab.freedynamicdns.org
2022-03-15 hdpftag1sjoztjj.freedynamicdns.org
2022-03-16 hdpftbo0szs2taf.freedynamicdns.org
2022-03-17 hdpftar1wzs0tas.freedynamicdns.org
2022-03-18 hdpftjr1wqoetjf.freedynamicdns.org
2022-03-19 hdpftjj0sjo4taw.freedynamicdns.org
2022-03-20 hdpftan0tqs1taf.freedynamicdns.org
2022-03-21 hdpftbs0sjphtan.freedynamicdns.org
2022-03-22 hdpftbf0sqthtjn.freedynamicdns.org
2022-03-23 hdpftab1xqtjtaj.freedynamicdns.org
2022-03-24 hdpftjg1szs4tjb.freedynamicdns.org
2022-03-25 hdpftjw0xqo4tbs.freedynamicdns.org
2022-03-26 hdpftaf1wqtjtjj.freedynamicdns.org
2022-03-27 hdpftar0xqpktaf.freedynamicdns.org
2022-03-28 hdpftbs0wzs1tag.freedynamicdns.org
2022-03-29 hdpftas1xjpitan.freedynamicdns.org
2022-03-30 hdpftbk1xjtjtaj.freedynamicdns.org
2022-03-31 hdpftjo1tzo1tjf.freedynamicdns.org
2022-04-01 hdpftak0sztltbf.freedynamicdns.org
2022-04-02 hdpftjg0sjsdtjf.freedynamicdns.org
2022-04-03 hdpftas1tatltbs.freedynamicdns.org
2022-04-04 hdpftan0sapmtak.freedynamicdns.org
2022-04-05 hdpftas1sztltbf.freedynamicdns.org
2022-04-06 hdpftbw0tjtmtar.freedynamicdns.org
2022-04-07 hdpftan0szodtag.freedynamicdns.org
2022-04-08 hdpftbo0sjs2taf.freedynamicdns.org
2022-04-09 hdpftan0wzpmtag.freedynamicdns.org
2022-04-10 hdpftaf0tjodtas.freedynamicdns.org
2022-04-11 hdpftbw0sjsetan.freedynamicdns.org
2022-04-12 hdpftjo1wathtjo.freedynamicdns.org
2022-04-13 hdpftag1tzsdtan.freedynamicdns.org
2022-04-14 hdpftas0tasetbo.freedynamicdns.org
2022-04-15 hdpftjb0wzs1tjg.freedynamicdns.org
2022-04-16 hdpftjr1tjo2tbk.freedynamicdns.org
2022-04-17 hdpftag1szo0tbk.freedynamicdns.org
2022-04-18 hdpftjg1xqtjtbs.freedynamicdns.org
2022-04-19 hdpftar1sqs4taw.freedynamicdns.org
2022-04-20 hdpftab1wzs4taj.freedynamicdns.org
2022-04-21 hdpftan1wzo1tab.freedynamicdns.org
2022-04-22 hdpftbb1xjsetbo.freedynamicdns.org
2022-04-23 hdpftjo1tjtktjj.freedynamicdns.org
2022-04-24 hdpftbw0tqtltjf.freedynamicdns.org
2022-04-25 hdpftjs1sqtjtjb.freedynamicdns.org
2022-04-26 hdpftaw1xqoztjb.freedynamicdns.org
2022-04-27 hdpftas0tqtmtar.freedynamicdns.org
2022-04-28 hdpftjs1xqtktbw.freedynamicdns.org
2022-04-29 hdpftbo1tas4taj.freedynamicdns.org
2022-04-30 hdpftbo1xjo3taj.freedynamicdns.org
2022-05-01 hdpftjg0uaoetaw.freedynamicdns.org
2022-05-02 hdpftjo1tjpitbb.freedynamicdns.org
2022-05-03 hdpftaj1xqsztbk.freedynamicdns.org
2022-05-04 hdpftjk1wzo5tjo.freedynamicdns.org
2022-05-05 hdpftbs0tjphtar.freedynamicdns.org
2022-05-06 hdpftjj1tjpmtjo.freedynamicdns.org
2022-05-07 hdpftan1wzthtag.freedynamicdns.org
2022-05-08 hdpftjs0xatitaf.freedynamicdns.org
2022-05-09 hdpftjs1szpktaw.freedynamicdns.org
2022-05-10 hdpftjb0uaoetbs.freedynamicdns.org
2022-05-11 hdpftjb0ujodtjs.freedynamicdns.org
2022-05-12 hdpftjw0ujo3tbs.freedynamicdns.org
2022-05-13 hdpftas1xas2tko.freedynamicdns.org
2022-05-14 hdpftaf1xapktjg.freedynamicdns.org
2022-05-15 hdpftbs0tas1tjn.freedynamicdns.org
2022-05-16 hdpftaf1wzpjtaj.freedynamicdns.org
2022-05-17 hdpftbo0sqtitag.freedynamicdns.org
2022-05-18 hdpftbb0wztitak.freedynamicdns.org
2022-05-19 hdpftko1wasetbo.freedynamicdns.org
2022-05-20 hdpftab1wapktjg.freedynamicdns.org
2022-05-21 hdpftbo1wzsztab.freedynamicdns.org
2022-05-22 hdpftbb1xjsdtbo.freedynamicdns.org
2022-05-23 hdpftar1xjsztaw.freedynamicdns.org
2022-05-24 hdpftar1wqsdtab.freedynamicdns.org
2022-05-25 hdpftjg1sqo4tbw.freedynamicdns.org
2022-05-26 hdpftak0taphtar.freedynamicdns.org
2022-05-27 hdpftjj0xqoztaf.freedynamicdns.org
2022-05-28 hdpftbs0wzthtag.freedynamicdns.org
2022-05-29 hdpftkk1wqsdtab.freedynamicdns.org
2022-05-30 hdpftjr1szo0tbo.freedynamicdns.org
2022-05-31 hdpftjw1sjsztab.freedynamicdns.org
2022-06-01 hdpftjo1ujsztak.freedynamicdns.org
2022-06-02 hdpftjr1sjpltbw.freedynamicdns.org
2022-06-03 hdpftjw0wao4tbf.freedynamicdns.org
2022-06-04 hdpftjj0xapltbw.freedynamicdns.org
2022-06-05 hdpftjn1tqo3tjk.freedynamicdns.org
2022-06-06 hdpftjb0xqpmtjk.freedynamicdns.org
2022-06-07 hdpftjf0xao4taw.freedynamicdns.org
2022-06-08 hdpftbb0wztjtjn.freedynamicdns.org
2022-06-09 hdpftbs1tqtmtkk.freedynamicdns.org
2022-06-10 hdpftao1wzs4tjb.freedynamicdns.org
2022-06-11 hdpftjf1sjpmtbw.freedynamicdns.org
2022-06-12 hdpftaw1waodtjw.freedynamicdns.org
2022-06-13 hdpftbo1xas5tab.freedynamicdns.org
2022-06-14 hdpftas0tzoftbb.freedynamicdns.org
2022-06-15 hdpftbf0tqsztag.freedynamicdns.org
2022-06-16 hdpftab1wqtitjb.freedynamicdns.org
2022-06-17 hdpftjj0xjo4tbb.freedynamicdns.org
2022-06-18 hdpftaf0wztjtjn.freedynamicdns.org
2022-06-19 hdpftan0wzsztak.freedynamicdns.org
2022-06-20 hdpftaj1ujtmtjb.freedynamicdns.org
2022-06-21 hdpftbb1xapktbo.freedynamicdns.org
2022-06-22 hdpftbs0szoztjf.freedynamicdns.org
2022-06-23 hdpftbk1xqtitaw.freedynamicdns.org
2022-06-24 hdpftjg1szo3tbw.freedynamicdns.org
2022-06-25 hdpftjn1sas4tan.freedynamicdns.org
2022-06-26 hdpftbw0sjsftak.freedynamicdns.org
2022-06-27 hdpftjj0xjpmtbf.freedynamicdns.org
2022-06-28 hdpftkk1uao3tbw.freedynamicdns.org
2022-06-29 hdpftan0wzsztak.freedynamicdns.org
2022-06-30 hdpftan0tqphtaf.freedynamicdns.org
2022-07-01 hdpftjr1tas1tjb.freedynamicdns.org
2022-07-02 hdpftjj0was4tjs.freedynamicdns.org
2022-07-03 hdpftjg0tjs4tjk.freedynamicdns.org
2022-07-04 hdpftjr1sjo5tan.freedynamicdns.org
2022-07-05 hdpftan1xas0taj.freedynamicdns.org
2022-07-06 hdpftjf0xqtltbf.freedynamicdns.org
2022-07-07 hdpftab1uapmtkk.freedynamicdns.org
2022-07-08 hdpftjg0xaodtaf.freedynamicdns.org
2022-07-09 hdpftbf0wzodtak.freedynamicdns.org
2022-07-10 hdpftas0sasftar.freedynamicdns.org
2022-07-11 hdpftbf0sjsftar.freedynamicdns.org
2022-07-12 hdpftjk1tzsdtjj.freedynamicdns.org
2022-07-13 hdpftaj1wapjtko.freedynamicdns.org
2022-07-14 hdpftbo0saoftag.freedynamicdns.org
2022-07-15 hdpftan0saoftas.freedynamicdns.org
2022-07-16 hdpftaj1wzpktjn.freedynamicdns.org
2022-07-17 hdpftjk1sasztjf.freedynamicdns.org
2022-07-18 hdpftbb1xjsdtjj.freedynamicdns.org
2022-07-19 hdpftar1sqphtaj.freedynamicdns.org
2022-07-20 hdpftbb1xqo4tbk.freedynamicdns.org
2022-07-21 hdpftjo1tjsftjf.freedynamicdns.org
2022-07-22 hdpftbf0sjtktjf.freedynamicdns.org
2022-07-23 hdpftbk1ujpktjn.freedynamicdns.org
2022-07-24 hdpftaf1szsdtbf.freedynamicdns.org
2022-07-25 hdpftjb0xqs5tbs.freedynamicdns.org
2022-07-26 hdpftag1szphtjw.freedynamicdns.org
2022-07-27 hdpftjs1sasetjb.freedynamicdns.org
2022-07-28 hdpftjg1xqsdtjb.freedynamicdns.org
2022-07-29 hdpftaj1sasetjw.freedynamicdns.org
2022-07-30 hdpftan1xatmtbo.freedynamicdns.org
2022-07-31 hdpftbf1xao4tbo.freedynamicdns.org
2022-08-01 hdpftaf1was3tak.freedynamicdns.org
2022-08-02 hdpftab1xqtmtjj.freedynamicdns.org
2022-08-03 hdpftbo0szphtan.freedynamicdns.org
2022-08-04 hdpftjk1sqo0tjw.freedynamicdns.org
2022-08-05 hdpftjw0sqs1taj.freedynamicdns.org
2022-08-06 hdpftjw0xapjtbb.freedynamicdns.org
2022-08-07 hdpftaj0szs4tjn.freedynamicdns.org
2022-08-08 hdpftbw0wao4tar.freedynamicdns.org
2022-08-09 hdpftar1tatmtaj.freedynamicdns.org
2022-08-10 hdpftas0sao5tar.freedynamicdns.org
2022-08-11 hdpftjb0uapltaf.freedynamicdns.org
2022-08-12 hdpftbf0tzs3tag.freedynamicdns.org
2022-08-13 hdpftas1xqodtjw.freedynamicdns.org
2022-08-14 hdpftbo0sas1tak.freedynamicdns.org
2022-08-15 hdpftjk1szo1tjw.freedynamicdns.org
2022-08-16 hdpftan1waodtaw.freedynamicdns.org
2022-08-17 hdpftbk1uatktab.freedynamicdns.org
2022-08-18 hdpftbw0uao5tbo.freedynamicdns.org
2022-08-19 hdpftbs0uaphtan.freedynamicdns.org
2022-08-20 hdpftbb1xqo5tbo.freedynamicdns.org
2022-08-21 hdpftbb0sjo4tan.freedynamicdns.org
2022-08-22 hdpftbf0sqo4tan.freedynamicdns.org
2022-08-23 hdpftbb1wzphtbk.freedynamicdns.org
2022-08-24 hdpftak1sqo1tbf.freedynamicdns.org
2022-08-25 hdpftjf0xjpjtjg.freedynamicdns.org
2022-08-26 hdpftjj0xapktjs.freedynamicdns.org
2022-08-27 hdpftjf0xqpjtbb.freedynamicdns.org
2022-08-28 hdpftjb0sqphtbs.freedynamicdns.org
2022-08-29 hdpftjw0sjpktbb.freedynamicdns.org
2022-08-30 hdpftjf0ujpltaj.freedynamicdns.org
2022-08-31 hdpftkk1szphtjo.freedynamicdns.org
2022-09-01 hdpftak0sqpktbf.freedynamicdns.org
2022-09-02 hdpftjo1tapltjw.freedynamicdns.org
2022-09-03 hdpftaj1xqpitaw.freedynamicdns.org
2022-09-04 hdpftbb0tztjtas.freedynamicdns.org
2022-09-05 hdpftao1ujs0tjw.freedynamicdns.org
2022-09-06 hdpftjn1tzs2tab.freedynamicdns.org
2022-09-07 hdpftjk1sapmtbw.freedynamicdns.org
2022-09-08 hdpftjr1wqoftbo.freedynamicdns.org
2022-09-09 hdpftjw0xatltjs.freedynamicdns.org
2022-09-10 hdpftjr1sao4tbw.freedynamicdns.org
2022-09-11 hdpftaw1uapmtjb.freedynamicdns.org
2022-09-12 hdpftar1uas0taw.freedynamicdns.org
2022-09-13 hdpftab1tapmtbs.freedynamicdns.org
2022-09-14 hdpftjn1tqs3tbk.freedynamicdns.org
2022-09-15 hdpftjn1tzs3tbo.freedynamicdns.org
2022-09-16 hdpftjf1tjs1taw.freedynamicdns.org
2022-09-17 hdpftag1szs3tbk.freedynamicdns.org
2022-09-18 hdpftjj0sqo3tjg.freedynamicdns.org
2022-09-19 hdpftbs0uasztjn.freedynamicdns.org
2022-09-20 hdpftaf1xas3tjw.freedynamicdns.org
2022-09-21 hdpftjn1tjphtjf.freedynamicdns.org
2022-09-22 hdpftkk1szo4tbw.freedynamicdns.org
2022-09-23 hdpftjn1sjo5tjo.freedynamicdns.org
2022-09-24 hdpftjb1taodtbw.freedynamicdns.org
2022-09-25 hdpftan0sjtltak.freedynamicdns.org
2022-09-26 hdpftan0sjtktag.freedynamicdns.org
2022-09-27 hdpftaf1sapktbb.freedynamicdns.org
2022-09-28 hdpftaf0wqpltbf.freedynamicdns.org
2022-09-29 hdpftkk1was2tab.freedynamicdns.org
2022-09-30 hdpftjs0tatjtag.freedynamicdns.org
2022-10-01 hdpftab0tjtmtaj.freedynamicdns.org
2022-10-02 hdpftjb0wao0taf.freedynamicdns.org
2022-10-03 hdpftkk1sjoztar.freedynamicdns.org
2022-10-04 hdpftar0sjtjtag.freedynamicdns.org
2022-10-05 hdpftab1xjpltjw.freedynamicdns.org
2022-10-06 hdpftao1szs1tjj.freedynamicdns.org
2022-10-07 hdpftas1wqphtjw.freedynamicdns.org
2022-10-08 hdpftbw0ujsftjn.freedynamicdns.org
2022-10-09 hdpftaw1tjs2tjw.freedynamicdns.org
2022-10-10 hdpftar1wqtktag.freedynamicdns.org
2022-10-11 hdpftbs0saoftar.freedynamicdns.org
2022-10-12 hdpftbk1wzs0taw.freedynamicdns.org
2022-10-13 hdpftjb0tjo3tjs.freedynamicdns.org
2022-10-14 hdpftbf0tzsztko.freedynamicdns.org
2022-10-15 hdpftao1wqs2tjb.freedynamicdns.org
2022-10-16 hdpftjn1tjo4tjk.freedynamicdns.org
2022-10-17 hdpftao1wqs1tjj.freedynamicdns.org
2022-10-18 hdpftag1wzphtjf.freedynamicdns.org
2022-10-19 hdpftan0wztmtak.freedynamicdns.org
2022-10-20 hdpftan0tatmtaf.freedynamicdns.org
2022-10-21 hdpftbk1watktas.freedynamicdns.org
2022-10-22 hdpftaj1wasetkk.freedynamicdns.org
2022-10-23 hdpftab1ujtktas.freedynamicdns.org
2022-10-24 hdpftaj1wzsdtkk.freedynamicdns.org
2022-10-25 hdpftab1xqsftas.freedynamicdns.org
2022-10-26 hdpftan0sztktas.freedynamicdns.org
2022-10-27 hdpftjk1xqo4tjo.freedynamicdns.org
2022-10-28 hdpftbo1tjphtaw.freedynamicdns.org
2022-10-29 hdpftan1tjs3tab.freedynamicdns.org
2022-10-30 hdpftjk1tzo5tbw.freedynamicdns.org
2022-10-31 hdpftjw0wqs0taw.freedynamicdns.org
2022-11-01 hdpftbb0tzsetjg.freedynamicdns.org
2022-11-02 hdpftas1tqtltjk.freedynamicdns.org
2022-11-03 hdpftjb0uasztbs.freedynamicdns.org
2022-11-04 hdpftjg0sqsetjs.freedynamicdns.org
2022-11-05 hdpftjj1tjs0tab.freedynamicdns.org
2022-11-06 hdpftbs0tqs3tan.freedynamicdns.org
2022-11-07 hdpftaf1wzo2tas.freedynamicdns.org
2022-11-08 hdpftjk1xathtjj.freedynamicdns.org
2022-11-09 hdpftjg1wzs5tjf.freedynamicdns.org
2022-11-10 hdpftbb1tqs5tjj.freedynamicdns.org
2022-11-11 hdpftan1xqoftab.freedynamicdns.org
2022-11-12 hdpftan0tjo5tak.freedynamicdns.org
2022-11-13 hdpftbf0sjo4tag.freedynamicdns.org
2022-11-14 hdpftbw1wqo2tko.freedynamicdns.org
2022-11-15 hdpftbf0tqo4tas.freedynamicdns.org
2022-11-16 hdpftaw0tqo2tko.freedynamicdns.org
2022-11-17 hdpftao1wqtmtjj.freedynamicdns.org
2022-11-18 hdpftjw0sas0tbf.freedynamicdns.org
2022-11-19 hdpftjn1waoztbo.freedynamicdns.org
2022-11-20 hdpftkk1szoztbk.freedynamicdns.org
2022-11-21 hdpftko1szoztbo.freedynamicdns.org
2022-11-22 hdpftas0szs2tar.freedynamicdns.org
2022-11-23 hdpftjs1tjthtbf.freedynamicdns.org
2022-11-24 hdpftjg1sztjtjo.freedynamicdns.org
2022-11-25 hdpftjk1xqtktjo.freedynamicdns.org
2022-11-26 hdpftan1ujoetaw.freedynamicdns.org
2022-11-27 hdpftko1tatktjo.freedynamicdns.org
2022-11-28 hdpftjj0sjsetjg.freedynamicdns.org
2022-11-29 hdpftjn1was2tan.freedynamicdns.org
2022-11-30 hdpftjb0uas0tjk.freedynamicdns.org
2022-12-01 hdpftak1xjs5tjw.freedynamicdns.org
2022-12-02 hdpftjw0tzpmtag.freedynamicdns.org
2022-12-03 hdpftbs0sjpltas.freedynamicdns.org
2022-12-04 hdpftjo1xjoftko.freedynamicdns.org
2022-12-05 hdpftbo0sqs3taj.freedynamicdns.org
2022-12-06 hdpftbk0sas3taf.freedynamicdns.org
2022-12-07 hdpftab1xqtktkk.freedynamicdns.org
2022-12-08 hdpftaf1szs4tjg.freedynamicdns.org
2022-12-09 hdpftao0wqtmtbb.freedynamicdns.org
2022-12-10 hdpftjk0tapltak.freedynamicdns.org
2022-12-11 hdpftjb0tqs3taf.freedynamicdns.org
2022-12-12 hdpftbw0saodtjn.freedynamicdns.org
2022-12-13 hdpftjk0tqpjtaf.freedynamicdns.org
2022-12-14 hdpftbb0sjpltas.freedynamicdns.org
2022-12-15 hdpftbs0taoztkk.freedynamicdns.org
2022-12-16 hdpftjj1tzsftbf.freedynamicdns.org
2022-12-17 hdpftjw0xqs0taj.freedynamicdns.org
2022-12-18 hdpftjk1xatmtjw.freedynamicdns.org
2022-12-19 hdpftaf1szs4taj.freedynamicdns.org
2022-12-20 hdpftbk1wqs4tjg.freedynamicdns.org
2022-12-21 hdpftbo1xjo3taw.freedynamicdns.org
2022-12-22 hdpftjg1wqtitjo.freedynamicdns.org
2022-12-23 hdpftjk1wqthtbw.freedynamicdns.org
2022-12-24 hdpftas0tasetar.freedynamicdns.org
2022-12-25 hdpftko1tzo1tbk.freedynamicdns.org
2022-12-26 hdpftjw0xqs1tjg.freedynamicdns.org
2022-12-27 hdpftjj0xas0tjk.freedynamicdns.org
2022-12-28 hdpftbb1tzodtko.freedynamicdns.org
2022-12-29 hdpftaj1tzo1tjb.freedynamicdns.org
2022-12-30 hdpftao1tjtitjk.freedynamicdns.org
2022-12-31 hdpftao1xjo2tjj.freedynamicdns.org
