Grandoreiro banking malware: deciphering the DGA

By Leonardo Beltran & Diana Tadeo Metabase Q’s Ocelot Team

Context

Grandoreiro is a Banking Trojan written in Delphi language that emerged in 2017, attacking mainly Brazil and some Latin American countries. This banking trojan is used as a backdoor to allow the attacker to access the victim’s devices and thus steal their banking information in the online banking sessions they open.

A common feature of this type of banking trojans is the use of different domain generator algorithms (DGA) that make it difficult for organizations to block outgoing malicious traffic since multiple domains are generated, even on a daily basis. Being able to decipher this type of algorithm would allow an organization to monitor, detect, block and therefore, anticipate future attacks by these actors.

In this blog, we describe the process followed by the Threat Intelligence Team to decipher the DGA algorithm used by Grandoreiro in a recently active campaign in Mexico, which allowed us to predict the future malicious domains to be used by actors for the rest of 2022, and with this, protect account holders of our banking customers proactively. With the intention of contributing to the protection of the region, we have decided to share these indicators for the benefit of the Mexican banking sector.

Motivation/Impact

Theft of online banking credentials from account holders.

Key Points

  • This campaign is active in Mexico and is distributed through spam emails.
  • The victims are account holders of multiple Mexican banks.
  • This malware allows the remote collection of user and banking data by using dynamic domains.

Conclusions

  • As Grandoreiro has targeted the Mexican region, constant monitoring of its indicators is essential to prevent future attacks.

Malware Properties

File name: dbghelp.dll

MD5: 61ebbb2dec6895f168e5feec74452be9

First seen: 12/07/2022

Type: DLL

Class: Backdoor, Banking Trojan, Infostealer

TTPs:

  • Browser window  monitoring
  • Screenshot
  • The use of the Domain Generator Algorithm (DGA)
  • Stop  operating system  processes

Detail of the analysis

Analysis of the infection process

Through the monitoring of the Threat Intelligence team, an active campaign of the Brazilian Malware Grandoreiro described in this blog was detected.

This sample was identified on July 12 of the current year, however, there is a very similar variant from July 6. What suggests the potential beginning of the campaign, and, as a matter of fact, it was still active at the time of this writing.

The way Grandoreiro infects is through phishing campaigns to convince users to download and execute an attachment. In this case, it is a DLL named dbghelp.dll posing as part of a legitimate software named “intune.exe” or “Advanced Installer Intune Tool” (Figure 1).

Figure 1: Apparently legitimate software containing the Grandoreiro malware

Detailed technical analysis: dbghelp.dll

During the first part of the analysis of the dbghelp artifact.dll a relationship was found between it and the domain “bsalsa.com“, which belongs to a site originally created for the development of freeware solutions of the Delphi language.

Figure 2: Site bsalsa.com before restricting its access

This in turn, has as one of its most notable contributions the “Delphi – Embedded Web Browser”, which, according to its official github: https://github.com/ghquant/Delphi-EmbeddedWB allows you to create a custom web browsing application, add Internet, file navigation, mouse control, document viewing, and the ability to download data from applications.  It is possible that this functionality has allowed the acceleration of the integration of Delphi with browsers and then have malicious purposes.

Continuing with the analysis, the following text strings were found to correspond to the initial suspicion that this variant targets account holders from mexican banks (hidden in the image):

Figure 3: Chains related to multiple Mexican banks found in the campaign

The malware was written in Delphi7 and with a possible nickname of the developer as “lulalivre”, a name that expresses a political opinion about one of the former presidents of Brazil. This, along with the fact that there are many strings written in Portuguese, allows us to begin to outline the variant that we eventually ended up confirming as Grandoreiro due to the TTPs and IOCs described below.
The interesting thing is that this new variant focuses on account holders in Mexico but, by maintaining the functions in Portuguese, it suggests a collaboration between Brazilian developers and actors with context in the Mexican banking sector or that the malware was modified by this second group without the knowledge of the Brazilian actors.
The malware has validations to be able to work on the following versions of Windows:

  • Windows 8
  • Windows 10
  • Windows 11
  • Windows Server

Going deeper into the code, a function was found that allows to check if the infected user is using any of the most common browsers in the Windows operating system: Chrome, Firefox, IE, Edge, Opera, listed in the code as shown in the following figure:

Figure 4: Case of the opening of a browser on the victim’s computer

Subsequently, it monitors when the victim accesses the online banking website searching for browser titles related to their online banking and words such as “Log on” and “Net”.
In the case of identifying any of these chains in the name of the window and the name of the site, it focuses on the collection of sensitive information:

Figure 5: A segment of code that runs if any site in the bank is opened

A very interesting feature is the validation that the communication is only between the malware and the Command & Control without third parties. This is achieved with the use of specific strings from each bank, injected into the callback traffic generated:

Figure 6: Validation functions for connection

Another interesting function is responsible for capturing screens in the system, applying a colored mask to obfuscate the image. This mask looks as the image below:

Figure 7: Content of the 0xEB6520 function

DGA subdomain generation

A function was found in charge of generating dynamic domains for the connection with the C2. The algorithm starts.

The algorithm starts using TIdDayTime and makes requests at time[.] nist[.] gov to get the date and make this request multiple times in case of error.

Figure 8: Content of the start of the function 0xEC22AC

From the strings obtained, these are separated according to their spaces and “:” to give them a DD/MM/20YY format, thus obtaining a new list of dates. The day, month, and the year are extracted from each of these dates.

Figure 9: Segment of 0xEC22AC where the day, month and year are extracted

And depending on the value of the month, in the getMonthKey() method you get a different key called mKey.

Figure 10: getMonthKey() function

Based on this, from the value of the day that has been obtained, the substring to be used is extracted in the following section:

Figure 11: Extract of code that gets the day

The getFormat, xorHexValues, remap, and replaceEqToNull functions are then called.

Figure 12: Code extract to obtain the final result of the dynamic domain

In getFormat the key obtained from the month, the value of the day and the last value obtained from the year are combined into a key.

In xorHexValues an XOR is made with the values of the date and the month key to then obtain its hexadecimal value.

Then, it starts remap where, from the previous output, a conversion and exchange of values is carried out by concatenating the “=” symbol several times.

Figure 13: Extract from the remap function

The result passes everything to lowercase and in the segment replaceEqToNull changes all the “=” to “null”, resulting in a subdomain that will be concatenated with the string “[.] freedynamicdns[.] org”, which turns out to be the domain of a service used to generate dynamic domains for free.

Figure 14: Extract of the function with replaceEqToNull

The append string freedynamicdns[.]org is a service that allows you to generate dynamic domains for free, according to its description:

Figure 15: Image of the site freedynamicdns.org that is public

How we can help

The Threat Intelligence Team created a tool to automatically predict the dynamic domains to be used during 2022 by this Grandoreiro variant, which is available on our Intelligence Platform for customers:

Figure 16: Threat Intelligence Platform

We confirm that as of today, the domain is active and ready to be used in future campaigns:

Figure 17: Extract of future domains

Once the day is over, this domain stops working to pave the way for the next dynamic domain.

It is worth mentioning that Trustwave’s great work helped a lot to the quick understanding of previous algorithms similar to the one explained in this blog:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/grandoreiro-banking-malware-resurfaces-for-tax-season/

Indicators of Compromise

Hashes:  

61ebbb2dec6895f168e5feec74452be9

26f8dd7bba9792821eafddc3d0abb480

URLs:

http[:]//www[.] bsalsa[.]com

Domains:

bsalsa[.]com

freedynamicdns[.] Org

File Names:  

dbghelp.dll

Intune.exe

Registration Keys:  

Software\\Microsoft\\Windows\\CurrentVersion\\Run

Domains generated by the DGA during 2022:

2022-01-01 hdpftao0sqo0tbw.freedynamicdns.org

2022-01-02 hdpftjb0wqpjtaj.freedynamicdns.org

2022-01-03 hdpftkk1sjo4tar.freedynamicdns.org

2022-01-04 hdpftjb0xapktaw.freedynamicdns.org

2022-01-05 hdpftjs0szpmtaf.freedynamicdns.org

2022-01-06 hdpftbb0tjo3tjf.freedynamicdns.org

2022-01-07 hdpftjr1szodtjk.freedynamicdns.org

2022-01-08 hdpftjj1watmtaw.freedynamicdns.org

2022-01-09 hdpftjb0sjpktbb.freedynamicdns.org

2022-01-10 hdpftko1szodtjf.freedynamicdns.org

2022-01-11 hdpftjb0ujpktbb.freedynamicdns.org

2022-01-12 hdpftjf0ujpitbb.freedynamicdns.org

2022-01-13 hdpftbk0tapmtaf.freedynamicdns.org

2022-01-14 hdpftjj0xapktbb.freedynamicdns.org

2022-01-15 hdpftas1sjtltjw.freedynamicdns.org

2022-01-16 hdpftbw0tas4tas.freedynamicdns.org

2022-01-17 hdpftjs1sjthtjb.freedynamicdns.org

2022-01-18 hdpftaj1satitkk.freedynamicdns.org

2022-01-19 hdpftar0xjs5tag.freedynamicdns.org

2022-01-20 hdpftbk1wqs4tko.freedynamicdns.org

2022-01-21 hdpftjs1tqo0tjj.freedynamicdns.org

2022-01-22 hdpftjg1tathtjb.freedynamicdns.org

2022-01-23 hdpftjs1wqo1tjb.freedynamicdns.org

2022-01-24 hdpftjo1sao0tjw.freedynamicdns.org

2022-01-25 hdpftaf1szo1tbs.freedynamicdns.org

2022-01-26 hdpftjk1wzoztjo.freedynamicdns.org

2022-01-27 hdpftbb1ujs4tjn.freedynamicdns.org

2022-01-28 hdpftaj1tqtitko.freedynamicdns.org

2022-01-29 hdpftaf1tztktjw.freedynamicdns.org

2022-01-30 hdpftab1wqodtjg.freedynamicdns.org

2022-01-31 hdpftak0szo5tbb.freedynamicdns.org

2022-02-01 hdpftab0taphtaf.freedynamicdns.org

2022-02-02 hdpftar1uatktjg.freedynamicdns.org

2022-02-03 hdpftjg0tjsetjs.freedynamicdns.org

2022-02-04 hdpftjs1wztltjs.freedynamicdns.org

2022-02-05 hdpftan1xatktaj.freedynamicdns.org

2022-02-06 hdpftak1sqtjtjf.freedynamicdns.org

2022-02-07 hdpftjg0sqpitak.freedynamicdns.org

2022-02-08 hdpftbs0ujo1tko.freedynamicdns.org

2022-02-09 hdpftas1tzodtjw.freedynamicdns.org

2022-02-10 hdpftjk0taphtaf.freedynamicdns.org

2022-02-11 hdpftbw1xao1tko.freedynamicdns.org

2022-02-12 hdpftas1tzoztjj.freedynamicdns.org

2022-02-13 hdpftao1xqodtjw.freedynamicdns.org

2022-02-14 hdpftko1tztktjk.freedynamicdns.org

2022-02-15 hdpftjj0wzs3tbf.freedynamicdns.org

2022-02-16 hdpftjj0wzs2tbs.freedynamicdns.org

2022-02-17 hdpftjf1tas2tbw.freedynamicdns.org

2022-02-18 hdpftag1wztktjk.freedynamicdns.org

2022-02-19 hdpftjn1xjtltjo.freedynamicdns.org

2022-02-20 hdpftas1tjtjtjf.freedynamicdns.org

2022-02-21 hdpftjn1sqtktjk.freedynamicdns.org

2022-02-22 hdpftbb1xjo3tko.freedynamicdns.org

2022-02-23 hdpftbs0sjo1tjn.freedynamicdns.org

2022-02-24 hdpftbf0tjo1tko.freedynamicdns.org

2022-02-25 hdpftbs0tqo1tas.freedynamicdns.org

2022-02-26 hdpftjo0sao5tak.freedynamicdns.org

2022-02-27 hdpftar0sasftaf.freedynamicdns.org

2022-02-28 hdpftjn1wztltjf.freedynamicdns.org

2022-03-01 hdpftaf0tjs1tak.freedynamicdns.org

2022-03-02 hdpftjw0tjs2taf.freedynamicdns.org

2022-03-03 hdpftjb0uatktaw.freedynamicdns.org

2022-03-04 hdpftjo1wzs4tko.freedynamicdns.org

2022-03-05 hdpftaj1uaoztjg.freedynamicdns.org

2022-03-06 hdpftjg1sas4tjb.freedynamicdns.org

2022-03-07 hdpftbs0tqphtar.freedynamicdns.org

2022-03-08 hdpftjn1uatktbk.freedynamicdns.org

2022-03-09 hdpftbf0xjs1tag.freedynamicdns.org

2022-03-10 hdpftko1tjoftjj.freedynamicdns.org

2022-03-11 hdpftjf0wqo5tbs.freedynamicdns.org

2022-03-12 hdpftjg1tjo3tjw.freedynamicdns.org

2022-03-13 hdpftaj1waoetjs.freedynamicdns.org

2022-03-14 hdpftjf1tatktab.freedynamicdns.org

2022-03-15 hdpftag1sjoztjj.freedynamicdns.org

2022-03-16 hdpftbo0szs2taf.freedynamicdns.org

2022-03-17 hdpftar1wzs0tas.freedynamicdns.org

2022-03-18 hdpftjr1wqoetjf.freedynamicdns.org

2022-03-19 hdpftjj0sjo4taw.freedynamicdns.org

2022-03-20 hdpftan0tqs1taf.freedynamicdns.org

2022-03-21 hdpftbs0sjphtan.freedynamicdns.org

2022-03-22 hdpftbf0sqthtjn.freedynamicdns.org

2022-03-23 hdpftab1xqtjtaj.freedynamicdns.org

2022-03-24 hdpftjg1szs4tjb.freedynamicdns.org

2022-03-25 hdpftjw0xqo4tbs.freedynamicdns.org

2022-03-26 hdpftaf1wqtjtjj.freedynamicdns.org

2022-03-27 hdpftar0xqpktaf.freedynamicdns.org

2022-03-28 hdpftbs0wzs1tag.freedynamicdns.org

2022-03-29 hdpftas1xjpitan.freedynamicdns.org

2022-03-30 hdpftbk1xjtjtaj.freedynamicdns.org

2022-03-31 hdpftjo1tzo1tjf.freedynamicdns.org

2022-04-01 hdpftak0sztltbf.freedynamicdns.org

2022-04-02 hdpftjg0sjsdtjf.freedynamicdns.org

2022-04-03 hdpftas1tatltbs.freedynamicdns.org

2022-04-04 hdpftan0sapmtak.freedynamicdns.org

2022-04-05 hdpftas1sztltbf.freedynamicdns.org

2022-04-06 hdpftbw0tjtmtar.freedynamicdns.org

2022-04-07 hdpftan0szodtag.freedynamicdns.org

2022-04-08 hdpftbo0sjs2taf.freedynamicdns.org

2022-04-09 hdpftan0wzpmtag.freedynamicdns.org

2022-04-10 hdpftaf0tjodtas.freedynamicdns.org

2022-04-11 hdpftbw0sjsetan.freedynamicdns.org

2022-04-12 hdpftjo1wathtjo.freedynamicdns.org

2022-04-13 hdpftag1tzsdtan.freedynamicdns.org

2022-04-14 hdpftas0tasetbo.freedynamicdns.org

2022-04-15 hdpftjb0wzs1tjg.freedynamicdns.org

2022-04-16 hdpftjr1tjo2tbk.freedynamicdns.org

2022-04-17 hdpftag1szo0tbk.freedynamicdns.org

2022-04-18 hdpftjg1xqtjtbs.freedynamicdns.org

2022-04-19 hdpftar1sqs4taw.freedynamicdns.org

2022-04-20 hdpftab1wzs4taj.freedynamicdns.org

2022-04-21 hdpftan1wzo1tab.freedynamicdns.org

2022-04-22 hdpftbb1xjsetbo.freedynamicdns.org

2022-04-23 hdpftjo1tjtktjj.freedynamicdns.org

2022-04-24 hdpftbw0tqtltjf.freedynamicdns.org

2022-04-25 hdpftjs1sqtjtjb.freedynamicdns.org

2022-04-26 hdpftaw1xqoztjb.freedynamicdns.org

2022-04-27 hdpftas0tqtmtar.freedynamicdns.org

2022-04-28 hdpftjs1xqtktbw.freedynamicdns.org

2022-04-29 hdpftbo1tas4taj.freedynamicdns.org

2022-04-30 hdpftbo1xjo3taj.freedynamicdns.org

2022-05-01 hdpftjg0uaoetaw.freedynamicdns.org

2022-05-02 hdpftjo1tjpitbb.freedynamicdns.org

2022-05-03 hdpftaj1xqsztbk.freedynamicdns.org

2022-05-04 hdpftjk1wzo5tjo.freedynamicdns.org

2022-05-05 hdpftbs0tjphtar.freedynamicdns.org

2022-05-06 hdpftjj1tjpmtjo.freedynamicdns.org

2022-05-07 hdpftan1wzthtag.freedynamicdns.org

2022-05-08 hdpftjs0xatitaf.freedynamicdns.org

2022-05-09 hdpftjs1szpktaw.freedynamicdns.org

2022-05-10 hdpftjb0uaoetbs.freedynamicdns.org

2022-05-11 hdpftjb0ujodtjs.freedynamicdns.org

2022-05-12 hdpftjw0ujo3tbs.freedynamicdns.org

2022-05-13 hdpftas1xas2tko.freedynamicdns.org

2022-05-14 hdpftaf1xapktjg.freedynamicdns.org

2022-05-15 hdpftbs0tas1tjn.freedynamicdns.org

2022-05-16 hdpftaf1wzpjtaj.freedynamicdns.org

2022-05-17 hdpftbo0sqtitag.freedynamicdns.org

2022-05-18 hdpftbb0wztitak.freedynamicdns.org

2022-05-19 hdpftko1wasetbo.freedynamicdns.org

2022-05-20 hdpftab1wapktjg.freedynamicdns.org

2022-05-21 hdpftbo1wzsztab.freedynamicdns.org

2022-05-22 hdpftbb1xjsdtbo.freedynamicdns.org

2022-05-23 hdpftar1xjsztaw.freedynamicdns.org

2022-05-24 hdpftar1wqsdtab.freedynamicdns.org

2022-05-25 hdpftjg1sqo4tbw.freedynamicdns.org

2022-05-26 hdpftak0taphtar.freedynamicdns.org

2022-05-27 hdpftjj0xqoztaf.freedynamicdns.org

2022-05-28 hdpftbs0wzthtag.freedynamicdns.org

2022-05-29 hdpftkk1wqsdtab.freedynamicdns.org

2022-05-30 hdpftjr1szo0tbo.freedynamicdns.org

2022-05-31 hdpftjw1sjsztab.freedynamicdns.org

2022-06-01 hdpftjo1ujsztak.freedynamicdns.org

2022-06-02 hdpftjr1sjpltbw.freedynamicdns.org

2022-06-03 hdpftjw0wao4tbf.freedynamicdns.org

2022-06-04 hdpftjj0xapltbw.freedynamicdns.org

2022-06-05 hdpftjn1tqo3tjk.freedynamicdns.org

2022-06-06 hdpftjb0xqpmtjk.freedynamicdns.org

2022-06-07 hdpftjf0xao4taw.freedynamicdns.org

2022-06-08 hdpftbb0wztjtjn.freedynamicdns.org

2022-06-09 hdpftbs1tqtmtkk.freedynamicdns.org

2022-06-10 hdpftao1wzs4tjb.freedynamicdns.org

2022-06-11 hdpftjf1sjpmtbw.freedynamicdns.org

2022-06-12 hdpftaw1waodtjw.freedynamicdns.org

2022-06-13 hdpftbo1xas5tab.freedynamicdns.org

2022-06-14 hdpftas0tzoftbb.freedynamicdns.org

2022-06-15 hdpftbf0tqsztag.freedynamicdns.org

2022-06-16 hdpftab1wqtitjb.freedynamicdns.org

2022-06-17 hdpftjj0xjo4tbb.freedynamicdns.org

2022-06-18 hdpftaf0wztjtjn.freedynamicdns.org

2022-06-19 hdpftan0wzsztak.freedynamicdns.org

2022-06-20 hdpftaj1ujtmtjb.freedynamicdns.org

2022-06-21 hdpftbb1xapktbo.freedynamicdns.org

2022-06-22 hdpftbs0szoztjf.freedynamicdns.org

2022-06-23 hdpftbk1xqtitaw.freedynamicdns.org

2022-06-24 hdpftjg1szo3tbw.freedynamicdns.org

2022-06-25 hdpftjn1sas4tan.freedynamicdns.org

2022-06-26 hdpftbw0sjsftak.freedynamicdns.org

2022-06-27 hdpftjj0xjpmtbf.freedynamicdns.org

2022-06-28 hdpftkk1uao3tbw.freedynamicdns.org

2022-06-29 hdpftan0wzsztak.freedynamicdns.org

2022-06-30 hdpftan0tqphtaf.freedynamicdns.org

2022-07-01 hdpftjr1tas1tjb.freedynamicdns.org

2022-07-02 hdpftjj0was4tjs.freedynamicdns.org

2022-07-03 hdpftjg0tjs4tjk.freedynamicdns.org

2022-07-04 hdpftjr1sjo5tan.freedynamicdns.org

2022-07-05 hdpftan1xas0taj.freedynamicdns.org

2022-07-06 hdpftjf0xqtltbf.freedynamicdns.org

2022-07-07 hdpftab1uapmtkk.freedynamicdns.org

2022-07-08 hdpftjg0xaodtaf.freedynamicdns.org

2022-07-09 hdpftbf0wzodtak.freedynamicdns.org

2022-07-10 hdpftas0sasftar.freedynamicdns.org

2022-07-11 hdpftbf0sjsftar.freedynamicdns.org

2022-07-12 hdpftjk1tzsdtjj.freedynamicdns.org

2022-07-13 hdpftaj1wapjtko.freedynamicdns.org

2022-07-14 hdpftbo0saoftag.freedynamicdns.org

2022-07-15 hdpftan0saoftas.freedynamicdns.org

2022-07-16 hdpftaj1wzpktjn.freedynamicdns.org

2022-07-17 hdpftjk1sasztjf.freedynamicdns.org

2022-07-18 hdpftbb1xjsdtjj.freedynamicdns.org

2022-07-19 hdpftar1sqphtaj.freedynamicdns.org

2022-07-20 hdpftbb1xqo4tbk.freedynamicdns.org

2022-07-21 hdpftjo1tjsftjf.freedynamicdns.org

2022-07-22 hdpftbf0sjtktjf.freedynamicdns.org

2022-07-23 hdpftbk1ujpktjn.freedynamicdns.org

2022-07-24 hdpftaf1szsdtbf.freedynamicdns.org

2022-07-25 hdpftjb0xqs5tbs.freedynamicdns.org

2022-07-26 hdpftag1szphtjw.freedynamicdns.org

2022-07-27 hdpftjs1sasetjb.freedynamicdns.org

2022-07-28 hdpftjg1xqsdtjb.freedynamicdns.org

2022-07-29 hdpftaj1sasetjw.freedynamicdns.org

2022-07-30 hdpftan1xatmtbo.freedynamicdns.org

2022-07-31 hdpftbf1xao4tbo.freedynamicdns.org

2022-08-01 hdpftaf1was3tak.freedynamicdns.org

2022-08-02 hdpftab1xqtmtjj.freedynamicdns.org

2022-08-03 hdpftbo0szphtan.freedynamicdns.org

2022-08-04 hdpftjk1sqo0tjw.freedynamicdns.org

2022-08-05 hdpftjw0sqs1taj.freedynamicdns.org

2022-08-06 hdpftjw0xapjtbb.freedynamicdns.org

2022-08-07 hdpftaj0szs4tjn.freedynamicdns.org

2022-08-08 hdpftbw0wao4tar.freedynamicdns.org

2022-08-09 hdpftar1tatmtaj.freedynamicdns.org

2022-08-10 hdpftas0sao5tar.freedynamicdns.org

2022-08-11 hdpftjb0uapltaf.freedynamicdns.org

2022-08-12 hdpftbf0tzs3tag.freedynamicdns.org

2022-08-13 hdpftas1xqodtjw.freedynamicdns.org

2022-08-14 hdpftbo0sas1tak.freedynamicdns.org

2022-08-15 hdpftjk1szo1tjw.freedynamicdns.org

2022-08-16 hdpftan1waodtaw.freedynamicdns.org

2022-08-17 hdpftbk1uatktab.freedynamicdns.org

2022-08-18 hdpftbw0uao5tbo.freedynamicdns.org

2022-08-19 hdpftbs0uaphtan.freedynamicdns.org

2022-08-20 hdpftbb1xqo5tbo.freedynamicdns.org

2022-08-21 hdpftbb0sjo4tan.freedynamicdns.org

2022-08-22 hdpftbf0sqo4tan.freedynamicdns.org

2022-08-23 hdpftbb1wzphtbk.freedynamicdns.org

2022-08-24 hdpftak1sqo1tbf.freedynamicdns.org

2022-08-25 hdpftjf0xjpjtjg.freedynamicdns.org

2022-08-26 hdpftjj0xapktjs.freedynamicdns.org

2022-08-27 hdpftjf0xqpjtbb.freedynamicdns.org

2022-08-28 hdpftjb0sqphtbs.freedynamicdns.org

2022-08-29 hdpftjw0sjpktbb.freedynamicdns.org

2022-08-30 hdpftjf0ujpltaj.freedynamicdns.org

2022-08-31 hdpftkk1szphtjo.freedynamicdns.org

2022-09-01 hdpftak0sqpktbf.freedynamicdns.org

2022-09-02 hdpftjo1tapltjw.freedynamicdns.org

2022-09-03 hdpftaj1xqpitaw.freedynamicdns.org

2022-09-04 hdpftbb0tztjtas.freedynamicdns.org

2022-09-05 hdpftao1ujs0tjw.freedynamicdns.org

2022-09-06 hdpftjn1tzs2tab.freedynamicdns.org

2022-09-07 hdpftjk1sapmtbw.freedynamicdns.org

2022-09-08 hdpftjr1wqoftbo.freedynamicdns.org

2022-09-09 hdpftjw0xatltjs.freedynamicdns.org

2022-09-10 hdpftjr1sao4tbw.freedynamicdns.org

2022-09-11 hdpftaw1uapmtjb.freedynamicdns.org

2022-09-12 hdpftar1uas0taw.freedynamicdns.org

2022-09-13 hdpftab1tapmtbs.freedynamicdns.org

2022-09-14 hdpftjn1tqs3tbk.freedynamicdns.org

2022-09-15 hdpftjn1tzs3tbo.freedynamicdns.org

2022-09-16 hdpftjf1tjs1taw.freedynamicdns.org

2022-09-17 hdpftag1szs3tbk.freedynamicdns.org

2022-09-18 hdpftjj0sqo3tjg.freedynamicdns.org

2022-09-19 hdpftbs0uasztjn.freedynamicdns.org

2022-09-20 hdpftaf1xas3tjw.freedynamicdns.org

2022-09-21 hdpftjn1tjphtjf.freedynamicdns.org

2022-09-22 hdpftkk1szo4tbw.freedynamicdns.org

2022-09-23 hdpftjn1sjo5tjo.freedynamicdns.org

2022-09-24 hdpftjb1taodtbw.freedynamicdns.org

2022-09-25 hdpftan0sjtltak.freedynamicdns.org

2022-09-26 hdpftan0sjtktag.freedynamicdns.org

2022-09-27 hdpftaf1sapktbb.freedynamicdns.org

2022-09-28 hdpftaf0wqpltbf.freedynamicdns.org

2022-09-29 hdpftkk1was2tab.freedynamicdns.org

2022-09-30 hdpftjs0tatjtag.freedynamicdns.org

2022-10-01 hdpftab0tjtmtaj.freedynamicdns.org

2022-10-02 hdpftjb0wao0taf.freedynamicdns.org

2022-10-03 hdpftkk1sjoztar.freedynamicdns.org

2022-10-04 hdpftar0sjtjtag.freedynamicdns.org

2022-10-05 hdpftab1xjpltjw.freedynamicdns.org

2022-10-06 hdpftao1szs1tjj.freedynamicdns.org

2022-10-07 hdpftas1wqphtjw.freedynamicdns.org

2022-10-08 hdpftbw0ujsftjn.freedynamicdns.org

2022-10-09 hdpftaw1tjs2tjw.freedynamicdns.org

2022-10-10 hdpftar1wqtktag.freedynamicdns.org

2022-10-11 hdpftbs0saoftar.freedynamicdns.org

2022-10-12 hdpftbk1wzs0taw.freedynamicdns.org

2022-10-13 hdpftjb0tjo3tjs.freedynamicdns.org

2022-10-14 hdpftbf0tzsztko.freedynamicdns.org

2022-10-15 hdpftao1wqs2tjb.freedynamicdns.org

2022-10-16 hdpftjn1tjo4tjk.freedynamicdns.org

2022-10-17 hdpftao1wqs1tjj.freedynamicdns.org

2022-10-18 hdpftag1wzphtjf.freedynamicdns.org

2022-10-19 hdpftan0wztmtak.freedynamicdns.org

2022-10-20 hdpftan0tatmtaf.freedynamicdns.org

2022-10-21 hdpftbk1watktas.freedynamicdns.org

2022-10-22 hdpftaj1wasetkk.freedynamicdns.org

2022-10-23 hdpftab1ujtktas.freedynamicdns.org

2022-10-24 hdpftaj1wzsdtkk.freedynamicdns.org

2022-10-25 hdpftab1xqsftas.freedynamicdns.org

2022-10-26 hdpftan0sztktas.freedynamicdns.org

2022-10-27 hdpftjk1xqo4tjo.freedynamicdns.org

2022-10-28 hdpftbo1tjphtaw.freedynamicdns.org

2022-10-29 hdpftan1tjs3tab.freedynamicdns.org

2022-10-30 hdpftjk1tzo5tbw.freedynamicdns.org

2022-10-31 hdpftjw0wqs0taw.freedynamicdns.org

2022-11-01 hdpftbb0tzsetjg.freedynamicdns.org

2022-11-02 hdpftas1tqtltjk.freedynamicdns.org

2022-11-03 hdpftjb0uasztbs.freedynamicdns.org

2022-11-04 hdpftjg0sqsetjs.freedynamicdns.org

2022-11-05 hdpftjj1tjs0tab.freedynamicdns.org

2022-11-06 hdpftbs0tqs3tan.freedynamicdns.org

2022-11-07 hdpftaf1wzo2tas.freedynamicdns.org

2022-11-08 hdpftjk1xathtjj.freedynamicdns.org

2022-11-09 hdpftjg1wzs5tjf.freedynamicdns.org

2022-11-10 hdpftbb1tqs5tjj.freedynamicdns.org

2022-11-11 hdpftan1xqoftab.freedynamicdns.org

2022-11-12 hdpftan0tjo5tak.freedynamicdns.org

2022-11-13 hdpftbf0sjo4tag.freedynamicdns.org

2022-11-14 hdpftbw1wqo2tko.freedynamicdns.org

2022-11-15 hdpftbf0tqo4tas.freedynamicdns.org

2022-11-16 hdpftaw0tqo2tko.freedynamicdns.org

2022-11-17 hdpftao1wqtmtjj.freedynamicdns.org

2022-11-18 hdpftjw0sas0tbf.freedynamicdns.org

2022-11-19 hdpftjn1waoztbo.freedynamicdns.org

2022-11-20 hdpftkk1szoztbk.freedynamicdns.org

2022-11-21 hdpftko1szoztbo.freedynamicdns.org

2022-11-22 hdpftas0szs2tar.freedynamicdns.org

2022-11-23 hdpftjs1tjthtbf.freedynamicdns.org

2022-11-24 hdpftjg1sztjtjo.freedynamicdns.org

2022-11-25 hdpftjk1xqtktjo.freedynamicdns.org

2022-11-26 hdpftan1ujoetaw.freedynamicdns.org

2022-11-27 hdpftko1tatktjo.freedynamicdns.org

2022-11-28 hdpftjj0sjsetjg.freedynamicdns.org

2022-11-29 hdpftjn1was2tan.freedynamicdns.org

2022-11-30 hdpftjb0uas0tjk.freedynamicdns.org

2022-12-01 hdpftak1xjs5tjw.freedynamicdns.org

2022-12-02 hdpftjw0tzpmtag.freedynamicdns.org

2022-12-03 hdpftbs0sjpltas.freedynamicdns.org

2022-12-04 hdpftjo1xjoftko.freedynamicdns.org

2022-12-05 hdpftbo0sqs3taj.freedynamicdns.org

2022-12-06 hdpftbk0sas3taf.freedynamicdns.org

2022-12-07 hdpftab1xqtktkk.freedynamicdns.org

2022-12-08 hdpftaf1szs4tjg.freedynamicdns.org

2022-12-09 hdpftao0wqtmtbb.freedynamicdns.org

2022-12-10 hdpftjk0tapltak.freedynamicdns.org

2022-12-11 hdpftjb0tqs3taf.freedynamicdns.org

2022-12-12 hdpftbw0saodtjn.freedynamicdns.org

2022-12-13 hdpftjk0tqpjtaf.freedynamicdns.org

2022-12-14 hdpftbb0sjpltas.freedynamicdns.org

2022-12-15 hdpftbs0taoztkk.freedynamicdns.org

2022-12-16 hdpftjj1tzsftbf.freedynamicdns.org

2022-12-17 hdpftjw0xqs0taj.freedynamicdns.org

2022-12-18 hdpftjk1xatmtjw.freedynamicdns.org

2022-12-19 hdpftaf1szs4taj.freedynamicdns.org

2022-12-20 hdpftbk1wqs4tjg.freedynamicdns.org

2022-12-21 hdpftbo1xjo3taw.freedynamicdns.org

2022-12-22 hdpftjg1wqtitjo.freedynamicdns.org

2022-12-23 hdpftjk1wqthtbw.freedynamicdns.org

2022-12-24 hdpftas0tasetar.freedynamicdns.org

2022-12-25 hdpftko1tzo1tbk.freedynamicdns.org

2022-12-26 hdpftjw0xqs1tjg.freedynamicdns.org

2022-12-27 hdpftjj0xas0tjk.freedynamicdns.org

2022-12-28 hdpftbb1tzodtko.freedynamicdns.org

2022-12-29 hdpftaj1tzo1tjb.freedynamicdns.org

2022-12-30 hdpftao1tjtitjk.freedynamicdns.org

2022-12-31 hdpftao1xjo2tjj.freedynamicdns.org